INFORMATION PROCESSING SYSTEM AND CONTROL METHOD

A system including: a first information processing device configured to: transmit one or more certificates issued to a specific user; acquire one or more pieces of encrypted information each including identification information of a user, and encrypted with a public key of the user to whom the certificate is issued; generate one or more pieces of decryption information that respectively correspond to the one or more pieces of encrypted information by decrypting the one or more pieces of encrypted information; and transmit the one or more pieces of decryption information; and a second information processing device configured to: receive the one or more certificates and the one or more pieces of decryption information; and evaluate a submission status of the certificate by the specific user based on the number of one or more certificates and the number of pieces of decryption information including the identification information of the specific user.

FIELD

The present invention relates to an information processing system and the like.

BACKGROUND

Crypto-assets such as bitcoin are attracting attention around the world, and various research and development efforts are underway to utilize the underlying blockchain technology. As one of the various research and development efforts, Sovrin Foundation, Decentralized Identity Foundation and the like are developing the technology called decentralized identity and self-sovereign identity on the basis of the fact that blockchain is a decentralized trust-generating technology.

Conventionally, various internet services have managed a variety of personal attributes such as name, address, date of birth, and place of work within the services in a closed manner, making it difficult to utilize the information even though the information is the person's own information. The attributes are also called identities.

Meanwhile, in the case of a real service, not the internet, for example, a driver's license issued by a public safety commission can be used for various requirements, such as to open an account at a bank or to verify the age when purchasing alcohol. Therefore, the self-sovereign identity implements a mechanism that enables self-management of credentials that guarantee that the person's own attributes have been confirmed by a third party, and enables provision of the credentials to some services. The third party is a credential issuer and corresponds to, for example, the public safety commission.

Note that Sovrin Foundation implements trust of the credential issuers in a decentralized manner by managing a public key of the above-described third party and a method of accessing a service of the third party on the blockchain. Examples of the method of accessing a service of the third party include a method using a uniform resource locator (URL), a method that authenticates and permits access, and the like.

FIG.24is a diagram for describing an example of the self-sovereign identity. Issuers5a,5b, and5cissue signed certificates6a,6b, and6cto a user7. The certificates6a,6b, and6ccorrespond to credentials. For example, the certificate6aissued by the issuer5ais an employment certificate of the user7, and includes the name, date of birth, employee number, affiliation, year of employment, annual income, and the like. In the self-sovereign identity, the user7himself manages the certificates6ato6cand can himself choose the certificate to disclose to a verifier8. In the example ofFIG.24, an example in which the user7discloses the certificate6ato the verifier8among the certificates6ato6cis illustrated.

Examples of the related art include: [Patent Document 1] Japanese Laid-open Patent Publication No. 2007-183910; and [Patent Document 2] Japanese National Publication of International Patent Application No. 2006-510265.

SUMMARY

According to an aspect of the embodiments, there is provided an information processing system including: a first information processing device and a second information processing device, wherein the first information processing device includes a first memory, and a first processor coupled to the first memory, the first processor being configured to perform first processing including: transmitting, by the first processor of the first information processing device, one or more certificates issued to a specific user to the second information processing device; acquiring, by the first processor of the first information processing device, one or more pieces of encrypted information that each include identification information of a user generated in response to issuance of a certificate to each of one or more users that include the specific user, and encrypted with a public key of the user to whom the certificate is issued; generating, by the first processor of the first information processing device, one or more pieces of decryption information that respectively correspond to the one or more pieces of encrypted information by decrypting the acquired one or more pieces of encrypted information with a private key that corresponds to the public key of the specific user; and transmitting, by the first processor of the first information processing device, the generated one or more pieces of decryption information to the second information processing device, and the second information processing device includes a second memory, and a second processor coupled to the second memory, the second processor being configured to perform second processing including: receiving, by the second processor of the second information processing device, the one or more certificates transmitted by the first information processing device and the one or more pieces of decryption information transmitted by the first information processing device; and evaluating, by the second processor of the second information processing device, a submission status of the certificate by the specific user on the basis of the number of received one or more certificates and the number of pieces of decryption information that include the identification information of the specific user among the received one or more pieces of decryption information.

DESCRIPTION OF EMBODIMENTS

The self-sovereign identity allows a service provider to ask a user to disclose a certificate (credential) to be used to provide a service. Meanwhile, since the user manages the certificates, it is difficult to determine whether or not the user has disclosed all of information.

For example, in a case where a life insurance is offered as a service, the more health-related information about the user can be obtained, the better premiums can be quoted. In a case of providing such a service with the self-sovereign identity, users may not disclose health information that leads to higher premiums but only health information that leads to lower premiums.

In other words, the self-sovereign identity has a problem that it is not possible to detect submission omission of an issued certificate (credential).

In one aspect, an object of the present invention is to provide an information processing system and control method capable of detecting submission omission of an issued certificate.

Embodiments of an information processing system and a control method disclosed in the present application will be described in detail below with reference to the drawings. Note that the present embodiments do not limit the present disclosure.

Embodiment

Prior to describing an information processing system according to the present embodiment, a reference technique will be described. In the reference technique, what kind of credential has been issued to a user is managed in an open place. For example, when a credential issuer issues a credential, issuance information indicating that the credential has been issued is stored on a blockchain. This allows a service provider to check the information on the blockchain and determine whether or not the user has disclosed all pieces of information.

FIG.1is a diagram for describing the reference technique. In the example illustrated inFIG.1, in a case where an issuer9ahas issued a certificate (medical history certificate)10ato a user12, the issuer9agenerates an issuance certificate11aand registers the issuance certificate11ain an issuance information storage unit13on a blockchain. The certificate10aincludes a user ID “IDa”, a date of admission “aa/aa/aa”, a date of discharge “bb/bb/bb”, and a disease name “cancer”. The issuance information includes the user ID “IDa” and a type “medical history”. The user ID is information for identifying a user, and the user ID of the user12is assumed to be “IDa”.

In a case where an issuer9bhas issued a certificate (medical history certificate)10bto the user12, the issuer9bgenerates an issuance certificate11band registers the issuance certificate11bin the issuance information storage unit13on the blockchain. The certificate10aincludes the user ID “IDa”, the date of admission “cc/cc/cc”, the date of discharge “dd/dd/dd”, and the disease name “fracture”. The issuance information includes the user ID “IDa” and a type “medical history”.

For example, it is assumed that the user12has disclosed only the certificate10bto a verifier14and has not disclosed the certificate10a. Here, when the verifier14refers to the issuance information storage unit13, the pieces of issuance information11aand11bof the issuance information having the user ID “IDa” and the type “medical history” are registered. When the user ID of the user12is “IDa”, the verifier14can determine that there are two certificates regarding the medical history issued to the user12. The verifier14can determine that the user12has not disclosed all the certificates regarding the medical history because the number of certificates disclosed by the user12is one.

However, in the reference technique described inFIG.1, a third party user15can refer to the number of certificates issued to the user12with the user ID “IDa”. As a result, the user12may be presumed to have a long medical history, for example, which may lead to a privacy leak problem.

Next, a configuration of the information processing system according to the present embodiment will be described.FIG.2is a diagram illustrating the configuration of the information processing system according to the present embodiment. As illustrated inFIG.2, the information processing system includes issuer terminals50aand50b, an issuance information management server60, a user terminal100, and an information processing device200. The issuer terminals50aand50b, the issuance information management server60, the user terminal100, and the information processing device200are interconnected via a network70.

The user terminal100is an example of a “first information processing device”. The information processing device200is an example of a “second information processing device”.

The issuer terminals50aand50bare devices that issue certificate information (credentials) to the user. The issuer terminals50aand50bare collectively referred to as “issuer terminal(s)50” as appropriate. When issuing the certificate information, the issuer terminal50generates issuance information indicating that the certificate information has been issued and encrypts the issuance information with a public key of the user. The issuance information that is encrypted is referred to as encrypted issuance information. The issuer terminal50transmits the encrypted issuance information to the issuance information management server60. The encrypted issuance information is an example of “encrypted information”.

AlthoughFIG.2illustrates the issuer terminals50aand50b, the information processing system according to the present embodiment may include other issuer terminals.

The issuance information management server60is a server that holds the encrypted issuance information transmitted from the issuer terminal50. The issuance information management server60may store the encrypted issuance information using a blockchain mechanism.

The user terminal100is a terminal of the user who requests issuance of a certificate. The user terminal100issues issuance request of the certificate information to the issuer terminal50and receives the certificate information according to an operation of the user or the like. The user terminal100transmits the certificate information to the information processing device200in a case of receiving a predetermined service from the information processing device200. In the case of transmitting the certificate information, the user terminal100transmits, to the information processing device200, verification information for verifying whether or not the certificate information to be disclosed is appropriately disclosed. As will be described below, the verification information is generated on the basis of the encrypted issuance information acquired from the issuance information management server60.

AlthoughFIG.2illustrates the user terminal100, the information processing system according to the present embodiment may include user terminals of other users.

The information processing device200is a device that provides the user terminal100with a predetermined service. The information processing device200requests the user terminal100to disclose the certificate information in the case of providing the predetermined service. The information processing device200receives the certificate information and the verification information from the user terminal100, and evaluates whether or not the certificate information to be disclosed is appropriately disclosed according to the verification information. The information processing device200provides the user terminal100with the service in a case where the certificate information to be disclosed is appropriately disclosed.

Next, an example of processing of the information processing system according to the present embodiment will be described.FIG.3is a diagram for describing processing of the information processing system according to the present embodiment.

The issuer terminal50manages some information regarding users (a user1A and other users), and transmits such information as the certificate information to the user terminal that has issued the issuance request. Some information regarding users includes, for example, employment information, medical history information, educational background information, possessed qualification information, and the like of the users. In the case of issuing the certificate information, the issuer terminal50guarantees validity of the certificate information by adding an electronic signature to the certificate information.

The user1A operates the user terminal100and accesses the issuer terminal50, and issues the issuance request of the certificate after executing authentication using the user ID, a password, and the like. The user terminal100has a “public key Cpk” and a “private key Csk” of the user1A. The user terminal100transmits the public key Cpkto the issuer terminal50in the case of issuing the issuance request of the certificate to the issuer terminal50.

The issuer terminal50generates the certificate information corresponding to the successfully authenticated user1A, and transmits the generated certificate information to the user terminal100. When having generated the certificate information, the issuer terminal50generates the issuance information and encrypts the issuance information with the public key Cpkto generate the encrypted issuance information. For example, the issuance information includes the user ID that identifies the user and a random number. The issuer terminal50generates the random number at the timing of generating the issuance information. The issuer terminal50transmits the encrypted issuance information to the issuance information management server60to register the encrypted issuance information in an issuance information table64a.

For example, the issuer terminal50atransmits certificate information51ato the user terminal100. The issuer terminal50atransmits encrypted issuance information52ato the issuance information management server60to register the encrypted issuance information52ain the issuance information table64a. The issuer terminal50btransmits certificate information51bto the user terminal100. The issuer terminal50btransmits encrypted issuance information52bto the issuance information management server60to register the encrypted issuance information52bin the issuance information table64a.

The issuer terminal50generates the certificate information and the encrypted issuance information by executing the above-described processing even in a case of accepting the issuance request of the certificate from the user terminal of a user other than the user1A. The encrypted issuance information is encrypted with the public key transmitted from the user terminal that has issued the issuance request. The issuer terminal50transmits the certificate information to the user terminal that has issued the issuance request, transmits the encrypted issuance information to the issuance information management server60, and registers the encrypted issuance information in the issuance information table64a.

The issuance information management server60includes the issuance information table64a. Each time receiving the encrypted issuance information from the issuer terminal50, the issuance information management server60registers the received encrypted issuance information in the issuance information table64a. A plurality of pieces of the encrypted issuance information held by the issuance information table64abecome issuance information encrypted with the public key of each user.

In the example illustrated inFIG.2, the issuance information table64aincludes the pieces of encrypted issuance information52aand52bfor the user1A and encrypted issuance information53afor a user1B. The pieces of encrypted issuance information52aand52bare issuance information encrypted with the public key of the user1A. The encrypted issuance information53ais issuance information encrypted with the public key of the user1B. Illustration of the user1B is omitted.

The user terminal100executes the following processing in the case of receiving the service from the information processing device200. The user terminal100transmits the pieces of certificate information51aand51breceived from the issuer terminal50to the information processing device200.

The user terminal100acquires all pieces of encrypted issuance information included in the issuance information table64afrom the issuance information management server60. The user terminal100decrypts each of the acquired pieces of encrypted issuance information with the user's own private key Cskto generate each decryption information. It is assumed that one piece of decryption information is generated for one piece of encrypted issuance information.

Of the plurality of pieces of encrypted issuance information acquired from the issuance information management server60, the encrypted issuance information encrypted with the public key Cpkof the user1A is normally decrypted with the private key Cskof the user1A. The successfully decrypted decryption information includes the user ID of the user1A and the random number.

Meanwhile, the issuance information encrypted with a key other than the public key of the user1A is not normally decrypted with the private key Cskof the user1A. The decryption information that is not normally decrypted includes a meaningless character string or the like.

The user terminal100registers the normally decrypted decryption information and the decryption information that has not been normally decrypted in verification information80and transmits the verification information80to the information processing device200. In the example illustrated inFIG.3, the number of pieces of normally decrypted decryption information is “2”, and the other pieces of decryption information are pieces of the decryption information that are not normally decrypted.

The information processing device200receives the pieces of certificate information51aand51band the verification information80from the user terminal100. The information processing device200evaluates the submission status of the certificate information on the basis of the number of pieces of certificate information received from the user terminal100and the number of normally decrypted decryption information among the pieces of decryption information included in the verification information80.

In a case where the number of pieces of certificate information received from the user terminal100matches the number of pieces of normally decrypted decryption information, the information processing device200determines that the submission status of the certificate by the user is appropriate. In the example described inFIG.3, regarding the certificate information transmitted from the user terminal100, the number of pieces of certificate information51aand51bis “2” and the number of pieces of normally decrypted decryption information in the verification information80is “2”, and thus the submission status of the certificate by the user1A is determined to be appropriate.

Note that the user terminal100and the information processing device200perform zero-knowledge proof processing regarding the private key Csk. This makes it possible to prove that the user terminal100has decrypted the encrypted issuance information with the private key Csk.

Hereinafter, configurations of the issuer terminal50, the issuance information management server60, the user terminal100, and the information processing device200described with reference toFIGS.2and3will be described in order.

FIG.4is a functional block diagram illustrating a configuration of the issuer terminal according to the present embodiment. InFIG.4, the configuration of the issuer terminal50awill be described as an example, but the configuration of the issuer terminal50bcorresponds to the configuration of the issuer terminal50a. As illustrated inFIG.4, the issuer terminal50includes a communication unit51, an input unit52, a display unit53, a storage unit54, and a control unit55.

The communication unit51transmits and receives information to and from the issuance information management server60, the user terminal100, and the like via the network70. For example, the communication unit51is implemented by a network interface card (NIC) or the like.

The input unit52is an input device for inputting various types of information to the issuer terminal50a. The input unit52corresponds to a keyboard, a mouse, a touch panel, or the like.

The display unit53is a display device that displays information output from the control unit55. The display unit53corresponds to a liquid crystal display, an organic electro luminescence (EL) display, a touch panel, or the like.

The storage unit54includes a user information management table54a. The storage unit54is implemented by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

The user information management table54ais information used for generating the certificate information, and includes, for example, the employment information, medical history information, educational background information, possessed qualification information, and the like of the user. Here, as an example, the user information management table54ais assumed to hold the medical history information of each user.

FIG.5is a table illustrating an example of a data structure of the user information management table. As illustrated inFIG.5, the user information management table54aassociates the user ID with the medical history information. The user ID is information that uniquely identifies the user. The medical history information indicates the medical history of the user. The medical history information associates the date of admission, the date of discharge, and the disease name.

The description returns toFIG.4. The control unit55includes an acceptance unit55a, a certificate generation unit55b, a random number generation unit55c, an issuance information generation unit55d, an encryption unit55e, and a transmission unit55f. The control unit55is implemented by, for example, a central processing unit (CPU) or a micro processing unit (MPU). Furthermore, the control unit55may be executed by, for example, an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

When accepting an access from the user terminal100, the acceptance unit55aexecutes authentication processing using the user ID and the password. The acceptance unit55ais assumed to hold information of a correct combination of the user ID and the password, and execute the authentication processing using the information.

The acceptance unit55aaccepts information of the issuance request of the certificate from the user terminal100in a case where the authentication of the user terminal100is successful. In the following description, the information of the issuance request of the certificate is referred to as “issuance request information”. It is assumed that the issuance request information includes information for identifying the user terminal that has issued the issuance request, the user ID, and the public key Cpk. The acceptance unit55aoutputs the issuance request information to the certificate generation unit55b, the random number generation unit55c, the issuance information generation unit55d, and the encryption unit55e.

The certificate generation unit55bis a processing unit that generates the certificate information in the case of accepting the issuance request information from the acceptance unit55a. The certificate generation unit55bcompares the user ID of the issuance request information with the user information management table54a, and acquires the medical history information corresponding to the user ID. In the example illustrated inFIG.5, the medical history information includes the date of admission, the date of discharge, the disease name, and the like.

The certificate generation unit55bgenerates the certificate information by adding an electronic signature to the acquired medical history information. The certificate generation unit55boutputs the generated certificate information to the transmission unit55f. The certificate generation unit55bmay add type information and date and time information, which will be described below, to the certificate information.

The random number generation unit55cis a processing unit that generates a random number in a case of accepting the issuance request information from the acceptance unit55a. The random number generation unit55coutputs the generated random number to the issuance information generation unit55d.

The issuance information generation unit55dis a processing unit that generates the issuance information indicating that the certificate information has been issued. The issuance information generation unit55dgenerates the issuance information by linking the user ID included in the issuance request information and the random number accepted from the random number generation unit55c.

The issuance information generation unit55dadds the type information and date and time information to the issuance information. The type information is information indicating the type of user information stored in the user information management table54a. For example, in the case where the user information is medical history information, the type information is “medical history”. In the case where the user information is employment information, the type information is “employment”. In the case where the user information is educational background information, the type information is “educational background”. In the case where the user information is possessed qualification information, the type information is “qualification”.

Since the user information in the user information management table54aillustrated inFIG.5is the medical history information, the issuance information generation unit55dadds the type information “medical history” to the issuance information.

The issuance information generation unit55dsets the date and time when the issuance request information is accepted from the acceptance unit55aas the date and time information, and adds the date and time information to the issuance information. The issuance information generation unit55dis assumed to acquire the date and time from a timer (not illustrated).

The issuance information generation unit55doutputs the issuance information to which the type information and the date and time information are attached, to the encryption unit55e.

The encryption unit55eis a processing unit that encrypts the issuance information with the public key included in the issuance request information to generate the encrypted issuance information. The encryption unit55eoutputs the encrypted issuance information to the transmission unit55f.FIG.6is a table illustrating an example of a data structure of the encrypted issuance information. As illustrated inFIG.6, the encrypted issuance information includes an encryption information area, a type information area, and a date and time information area.

The encryption information area contains information obtained by encrypting the issuance information with a public key. enc(Cpk,r1∥Da) indicates information obtained by encrypting the issuance information with the public key Cpk, the issuance information being obtained by concatenating the user ID “IDa” and the random number “r1”.

The type information area contains the type information. The date and time information area contains the date and time information. The encryption unit55eregisters the type information and the date and time information in the type information area and the date and time information area as they are without encryption.

The transmission unit55ftransmits the certificate information to the user terminal that has issued the issuance request. For example, the transmission unit55ftransmits the certificate information to the user terminal100. The transmission unit55ftransmits the encrypted issuance information to the issuance information management server60.

FIG.7is a functional block diagram illustrating a configuration of the issuance information management server according to the present embodiment. As illustrated inFIG.7, the issuance information management server60includes a communication unit61, an input unit62, a display unit63, a storage unit64, and a control unit65.

The communication unit61transmits and receives information to and from the issuer terminal50, the user terminal100, the information processing device200and the like via the network70. For example, the communication unit61is implemented by an NIC or the like.

The input unit62is an input device for inputting various types of information to the issuance information management server60. The input unit62corresponds to a keyboard, a mouse, a touch panel, or the like.

The display unit63is a display device that displays information output from the control unit65. The display unit63corresponds to a liquid crystal display, an organic electro luminescence (EL) display, a touch panel, or the like.

The storage unit64has the issuance information table64a. The storage unit64is implemented by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk.

The issuance information table64ais a table that holds the encrypted issuance information transmitted from the issuer terminal50.FIG.8is a table illustrating an example of a data structure of the issuance information table. As illustrated inFIG.8, the issuance information table64aincludes encryption information, type information, and date and time information. The encryption information is information obtained by encrypting the issuance information. The type information is information indicating the type of user information used in the case of issuing the certificate information corresponding to the issuance information. The date and time information is information indicating the date and time when the certificate information (issuance information) has been issued.

For example, it is assumed that information obtained by combining the encryption information, the type information, and the date and time information corresponds to the encrypted issuance information.

The description returns toFIG.7. The control unit65includes a registration unit65aand a response unit65b. The control unit65is implemented by, for example, a CPU or an MPU. Furthermore, the control unit65may be implemented by, for example, an integrated circuit such as an ASIC or an FPGA.

The registration unit65ais a processing unit that receives the encrypted issuance information from the issuer terminal50and registers the received encrypted issuance information in the issuance information table64a.

The response unit65btransmits the encrypted issuance information registered in the issuance information table60ato the user terminal100in the case of accepting the issuance information request from the user terminal100. The response unit65btransmits all pieces of encrypted issuance information registered in the issuance information table64ato the user terminal100in a case where the issuance information request does not include specification of the type information and the date and time information.

In a case where predetermined type information is specified in the issuance information request, the response unit65bdetects the encrypted issuance information corresponding to the specified type information from the issuance information table64a. The response unit65btransmits the detected encrypted issuance information to the user terminal100. In the following description, the specified predetermined type information is referred to as “specified type information”.

In a case where a date and time period is specified in the issuance information request, the response unit65bdetects the encrypted issuance information corresponding to the specified date and time period from the issuance information table64a. The response unit65btransmits the detected encrypted issuance information to the user terminal100. In the following description, the specified date and time period is referred to as a “specified date and time period”.

In a case where the specified type information and the specified date and time period are specified in the issuance information request, the response unit65bdetects the encrypted issuance information corresponding to the specified type information and the specified date and time period. The response unit65btransmits the detected encrypted issuance information to the user terminal100.

FIG.9is a functional block diagram illustrating a configuration of the user terminal according to the present embodiment. As illustrated inFIG.9, the user terminal100includes a communication unit110, an input unit120, a display unit130, a storage unit140, and a control unit150.

The communication unit110transmits and receives information to and from the issuer terminal50, the issuance information management server60, the information processing device200, and the like via the network70. For example, the communication unit110is implemented by an NIC or the like.

The input unit120is an input device that inputs various types of information to the user terminal100. The input unit120corresponds to a keyboard, a mouse, a touch panel, or the like.

The display unit130is a display device that displays information output from the control unit150. The display unit130corresponds to a liquid crystal display, an organic EL display, a touch panel, or the like.

The storage unit140includes public key information141, private key information142, a certificate table143, and an encrypted issuance information table144. The storage unit140is implemented by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk.

The public key information141is information of the public key Cpkissued to the user terminal100.

The private key information142is information of the private key Cskissued to the user terminal100.

According to public key cryptography, information encrypted with the public key Cpkcan be decrypted only with the private key Csk.

The certificate table143is a table that holds the certificate information issued by the issuer terminal50.FIG.10is a table illustrating an example of a data structure of the certificate table. As illustrated inFIG.10, the certificate table143associates item numbers with the certificate information. In the example illustrated inFIG.10, the certificate table143holds the certificate information issued by the issuer terminal50aand the certificate information issued by the issuer terminal50b.

The encrypted issuance information table144is a table that holds encrypted issuance information acquired from the issuance information management server60.FIG.11is a table illustrating an example of a data structure of the encrypted issuance information table. As illustrated inFIG.11, the encrypted issuance information table144includes the encryption information, the type information, and the date and time information. Description regarding the encryption information, the type information, and the date and time information is similar to that given with reference toFIG.8.

The description returns toFIG.9. The control unit150includes a certificate request unit151, an acquisition unit152, a decryption unit153, a transmission processing unit154, and a proof processing unit155. The control unit150is implemented by, for example, a CPU or an MPU. Furthermore, the control unit150may be implemented by, for example, an integrated circuit such as an ASIC or an FPGA.

The certificate request unit151is a processing unit that accesses the issuer terminal50and transmits issuance request information to the issuer terminal50in the case where the authentication is successful. For example, the certificate request unit151is assumed to accept specification of the issuer terminal50to which the certificate information is requested via the input unit120or the like, and access the issuer terminal50that has accepted the specification. The certificate request unit151accepts the user ID and the password from the user through the input unit120or the like and transmits the accepted user ID and password to the issuer terminal50to perform an authentication request.

The certificate request unit151acquires the public key Cpkfrom the public key information141. The certificate request unit151sets the information identifying the user terminal100, the user ID, and the public key Cpkin the issuance request information, and transmits the issuance request information to the specified issuer terminal50.

The certificate request unit151receives the certificate information from the issuer terminal50that has transmitted the issuance request information. The certificate request unit151registers the received certificate information in the certificate table143.

The acquisition unit152is a processing unit that transmits the issuance information request to the issuance information management server60to acquire the encrypted issuance information from the issuance information management server60. The acquisition unit152registers the encrypted issuance information acquired from the issuance information management server60in the encrypted issuance information table144.

In a case of accepting input of the specified type information and the specified date and time period from the input unit120or the like, the acquisition unit152sets the specified type information and the specified date and time information in the issuance information request and transmits the issuance information request into the issuance information management server60.

Furthermore, the acquisition unit152may transmit the issuance information request to the issuance information management server60in a case of accepting a certificate information disclosure request from the information processing device200to be described below. The acquisition unit152may accept specification of the specified type information and the specified date and time period in the disclosure request. In the case where the specified type information and the specified date and time period are specified in the disclosure request, the acquisition unit152sets the specified type information and the specified date and time information in the issuance information request and transmits the issuance information request into the issuance information management server60.

The decryption unit153is a processing unit that decrypts the encrypted issuance information registered in the encrypted issuance information table144using the private key Csk. The decryption unit153acquires the private key Cskfrom the private key information142.

FIG.12is a diagram for describing an example of processing of the decryption unit. In the example illustrated inFIG.12, it is assumed that three pieces of encrypted issuance information are registered in the encrypted issuance information table144. The decryption unit153decrypts the encryption information “enc(Cpk,r1∥IDa)” with the private key Cskto generate decryption information80a. Since the encryption information “enc(Cpk,r1∥IDa)” is information encrypted with the public key Cpk, the encryption information is properly decrypted and becomes information in which the random number r1and the user ID “IDa” are concatenated.

The decryption unit153decrypts the encryption information “enc(Dpk,r2∥IDb)” with the private key Cskto generate decryption information80b. Since the encryption information “enc(Dpk,r2∥IDb)” is information encrypted with a public key Dpkof another user, the encryption information is not properly decrypted and contains an incomprehensible character string.

The decryption unit153decrypts the encryption information “enc(Cpk,r3∥IDa)” with the private key Cskto generate decryption information80c. Since the encryption information “enc(Cpk,r3∥IDa)” is information encrypted with the public key Cpk, the encryption information is properly decrypted and becomes information in which the random number r3and the user ID “IDa” are concatenated.

As described with reference toFIG.12, in the case where three pieces of encrypted issuance information are registered in the encrypted issuance information table144, the three pieces of decryption information80ato80care generated. The decryption unit153registers the plurality of pieces of decryption information80ato80cin a verification information85and outputs the information to the transmission processing unit154.

The transmission processing unit154is a processing unit that transmits the certificate information stored in the certificate table143and the verification information85acquired from the decryption unit153to the information processing device200. The transmission processing unit154corresponds to a first transmission unit and a second transmission unit.

The transmission processing unit154may transmit all pieces of the certificate information registered in the certificate table143to the information processing device200, or may transmit the certificate information specified by the user1A via the input unit120to the information processing device200. The transmission processing unit154may add the user ID when transmitting the certificate information and the verification information85.

The proof processing unit155is a processing unit that executes data communication with the information processing device200to execute zero-knowledge proof, and proves that each piece of decryption information included in the verification information85is information decrypted with the private key Csk. A processing procedure regarding the proof processing unit155will be described below.

FIG.13is a functional block diagram illustrating a configuration of the information processing device according to the present embodiment. As illustrated inFIG.13, the information processing device200includes a communication unit210, an input unit220, a display unit230, a storage unit240, and a control unit250.

The communication unit210transmits and receives information to and from the issuer terminal50, the issuance information management server60, the user terminal100, and the like via the network70. For example, the communication unit210is implemented by an NIC or the like.

The input unit220is an input device that inputs various types of information to the information processing device200. The input unit220corresponds to a keyboard, a mouse, a touch panel, or the like.

The display unit230is a display device that displays information output from the control unit250. The display unit230corresponds to a liquid crystal display, an organic EL display, a touch panel, or the like.

The storage unit240includes a certificate management table241and the verification information table242. The storage unit240is implemented by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk.

The certificate management table241is a table that holds the certificate information received from the user terminal.FIG.14is a table illustrating an example of a data structure of the certificate management table. As illustrated inFIG.14, the certificate management table associates the user ID with the certificate information. The user ID is information that uniquely identifies the user. The certificate information corresponds to the certificate information received from the user terminal corresponding to the user ID. There may be a plurality of pieces of certificate information.

The verification information table242is a table that holds the verification information received from the user terminal.FIG.15is a table illustrating an example of a data structure of the verification information table. As illustrated inFIG.15, the verification information table242associates the user ID with the verification information. The user ID is information that uniquely identifies the user. The verification information is information including the decryption information decrypted with the private key of the user.

The description returns toFIG.13. The control unit250includes a reception unit251, an evaluation unit252, and a verification processing unit253. The control unit250is implemented by a CPU or an MPU. Furthermore, the control unit250may be implemented by, for example, an integrated circuit such as an ASIC or an FPGA.

The reception unit251is a processing unit that receives the certificate information and the verification information from the user terminal100(or another user terminal). The reception unit251registers the certificate information in the certificate management table241in association with the user ID. The reception unit251registers the verification information in the verification information table242in association with the user ID.

For example, in the case of receiving the pieces of certificate information51aand51bfrom the user terminal100with the user ID “IDa” as described with reference toFIG.3, the reception unit251registers the certificate information51aand51bin the certificate management table241in association with the user ID “IDa”.

In the case where the reception unit251receives the verification information85from the user terminal100with the user ID “IDa”, the reception unit251registers the verification information85in the verification information table242in association with the user ID “IDa”.

Note that in the case of requesting the user terminal for the certificate information, the reception unit251may transmit, to the user terminal, information of the disclosure request specifying the specified type information and the specified date and time period.

The evaluation unit252is a processing unit that evaluates the submission status of the certificate information on the basis of the certificate management table241and the verification information table242. The evaluation unit252outputs an evaluation result to the display unit230for display.

An example of processing of the evaluation unit252will be described. Here, description will be given using the certificate information and verification information received from the user terminal100. The evaluation unit252acquires the certificate information corresponding to the user ID “IDa” from the certificate management table241, and counts the number of pieces of certificate information. The number of certificates is referred to as a “first number”. In the example described with reference toFIG.3, since the pieces of certificate information51aand51bare received from the user terminal100with the user ID “IDa”, the first number is “2”.

The evaluation unit252acquires the verification information85corresponding to the user ID “IDa” from the verification information table242. In the example illustrated inFIG.12, the verification information85includes the pieces of decryption information80ato80c. The evaluation unit252counts the number of properly decrypted pieces of decryption information among the pieces of decryption information80ato80c. The number of properly decrypted pieces of decryption information is referred to as a “second number”.

For example, the evaluation unit252determines that the decryption information has been properly decrypted in a case where the decryption information has a predetermined pattern, and determines that the decryption information has not been properly decrypted in a case where the decryption information does not correspond to the predetermined pattern. The evaluation unit252sets the predetermined pattern as information in which the user ID and a numerical value by the random number are concatenated. The predetermined pattern may be agreed between the information processing device200and the issuer terminal50in advance.

In the example described with reference toFIG.12, the pieces of decryption information80aand80care information obtained by concatenating the user ID and the random number. Therefore, the evaluation unit252specifies the second number as “2”.

In a case where the first number and the second number match, the evaluation unit252evaluates that the corresponding user has properly submitted the certificate information. In the above-described example, the first number=2 and the second number=2, so the evaluation unit252evaluates that the user1A with the user ID “IDa” has properly submitted the certificate information.

On the other hand, in a case where the first number and the second number do not match, the evaluation unit252evaluates that the corresponding user has not submitted the certificate information properly.

The verification processing unit253is a processing unit that executes data communication with the user terminal100to perform the zero-knowledge proof, and verifies that each piece of decryption information included in the verification information85is information decrypted with the private key Cskof the user terminal100.

In the following description, zero-knowledge proof processing executed by the proof processing unit155of the user terminal100and the verification processing unit253of the information processing device200will be described. As a premise, public key cryptography RSA is assumed to be used for encryption and decryption of issuance information. A prover side is the proof processing unit155.

In the public key cryptography RSA, encryption enc(m) of message m is calculated by equation (1) where the public key is (e, p). To decrypt the encrypted message enc(m) with a private key d, equation (2) is calculated.

The proof processing unit155proves to the verification processing unit253that k messages m1, . . . , mkhave been calculated with the private key d without disclosing the private key d. The message m is the decryption information included in the verification information85. In the example illustrated inFIG.12, messages m1, m2and m3are the pieces of decryption information80a,80b, and80c.

The verification processing unit253generates a random number c and transmits the random number c to the proof processing unit155.

The proof processing unit155calculates s=r+cd and transmits s to the verification processing unit253.

The verification processing unit253verifies that {enc(m1)}smod p is equal to t1×m1c, . . . , {enc(mk)}sis equal to tk×mkc. The verification processing unit253can verify that the decryption has been properly performed on the user terminal100side using the private key d in a case where all the pairs are equal.

The evaluation unit252described above may obtain the verification result of the verification processing unit253and evaluate that the corresponding user has properly submitted the certificate information in the case where the decryption has been properly performed, and the first number matches the second number.

Note that the reason why the above-described proof is correct is that the equation can be expanded as follows, and it can be seen that the verification equation is correct.

Note that obtaining r from t1and tkis difficult because it involves solving a discrete logarithm problem, and d is not able to be obtained from s=r+cd without knowing r. Therefore, the private key d is never leaked to the verifier side.

Furthermore, the verification processing unit253needs to know correspondence between each piece of the issuance information obtained by decrypting an encrypted portion sent from the proof processing unit155and each piece of the issuance information containing an encrypted portion obtained from the issuance information management server60(blockchain). Therefore, the issuance information management server60assigns a number to the issuance information, and sends the number together with the information when sending the information from the proof processing unit155to the verification processing unit253. Note that, since the verification processing unit253obtains the issuance information (encrypted issuance information) in the same order when obtaining the issuance information from the issuance information management server60, the information may be associated in the same order or may be associated using an ID that is assigned when the information is usually saved in the blockchain.

Next, an example of processing procedures of the issuer terminal50, the user terminal100, and the information processing device200included in the information processing system according to the present embodiment will be described.

FIG.16is a flowchart illustrating a processing procedure of the issuer terminal according to the present embodiment. As illustrated inFIG.16, the acceptance unit55aof the issuer terminal50accepts access from the user terminal100and executes the authentication processing (step S101). In a case where the authentication is successful, the acceptance unit55aaccepts the issuance request of the certificate (the user ID and the public key) from the user terminal100(step S102).

The certificate generation unit55bof the issuer terminal50generates the certificate information (step S103). The random number generation unit55cof the issuer terminal50generates the random number (step S104). The issuance information generation unit55dof the issuer terminal50generates the issuance information on the basis of the user ID and the random number (step S105).

The encryption unit55eof the issuer terminal50generates the encrypted issuance information using the public key (step S106). The transmission unit55fof the issuer terminal50transmits the certificate information to the user terminal100(step S107). The transmission unit55ftransmits the encrypted issuance information to the issuance information management server60(step S108).

FIG.17is a flowchart (1) illustrating a processing procedure of the user terminal.FIG.17illustrates processing in which the user terminal100requests the issuer terminal50to issue the certificate information. As illustrated inFIG.17, the certificate request unit151of the user terminal100accesses the issuer terminal50and executes the authentication processing (step S201).

In a case where the authentication is successful, the certificate request unit151transmits the information of the issuance request of the certificate to the issuer terminal50(step S202).

The certificate request unit151receives the certificate information from the issuer terminal50(step S203). The certificate request unit151registers the certificate information in the certificate table143(step S204).

FIG.18is a flowchart (2) illustrating a processing procedure of the user terminal.FIG.18illustrates processing in a case where the user terminal100accepts the disclosure request of the certificate information from the information processing device200. As illustrated inFIG.18, the acquisition unit152of the user terminal100accepts the disclosure request of the certificate information from the information processing device200(step S301). The acquisition unit152transmits the issuance information request to the issuance information management server60(step S302).

The acquisition unit152receives the encrypted issuance information from the issuance information management server60, and registers the encrypted issuance information in the encrypted issuance information table144(step S303). The decryption unit153of the user terminal100decrypts each piece of encrypted issuance information included in the encrypted issuance information table144using the private key to generate the verification information (step S304).

The transmission processing unit154of the user terminal100transmits the certificate information and the verification information to the information processing device200(step S305). The proof processing unit155of the user terminal100executes the zero-knowledge proof with the information processing device200(step S306).

FIG.19is a flowchart illustrating a processing procedure of the information processing device. As illustrated inFIG.19, the reception unit251of the information processing device200transmits the disclosure request of the certificate information to the user terminal100(step S401).

The reception unit251receives the certificate information and the verification information from the user terminal100, and registers the information in the storage unit240(step S402). The evaluation unit252specifies the number (first number) of pieces of certificate information (step S403).

The evaluation unit252specifies the number (second number) of pieces of properly decrypted decryption information among the pieces of decryption information included in the verification information (step S404). The evaluation unit252determines whether or not the first number and the second number match (step S405).

In the case where the first number and the second number match (step S406, Yes), the evaluation unit252proceeds to step S407. On the other hand, in the case where the first number and the second number do not match (step S406, No), the evaluation unit252proceeds to step S411.

Step S407is described. The verification processing unit253of the information processing device200executes the zero-knowledge proof with the user terminal100(step S407). In the case where the user terminal100has performed the decryption with an appropriate private key (step S408, Yes), the verification processing unit253proceeds to step S409. On the other hand, in the case where the user terminal100has not performed the decryption with an appropriate private key (step S408, No), the verification processing unit253proceeds to step S411.

Step S409is described. The evaluation unit252evaluates that there is no submission omission in the certificate information (step S409). The evaluation unit252outputs the evaluation result to the display unit230(step S410).

Step S411is described. The evaluation unit252evaluates that there is submission omission in the certificate information (step S411) and proceeds to step S410.

Next, effects of the information processing system according to the present embodiment will be described. According to the information processing system, the user terminal100acquires one or more pieces of encrypted issuance information from the issuance information management server60and decrypts the encrypted issuance information with the public key to generate a plurality of pieces of decryption information. The user terminal100transmits, to the information processing device200, one or more pieces of certificate information transmitted from the issuer terminal50and the verification information including one or more pieces of decryption information. The information processing device200receives the one or more pieces of certificate information and verification information, and evaluates the submission status of the certificate information by a specific user on the basis of the first number and the second number. Therefore, the submission omission of an issued certificate can be detected.

The user terminal100and the information processing device200determine whether or not the decryption information is information decrypted with the private key Cskof the user terminal100on the basis of the zero-knowledge proof. Therefore, it is possible to suppress the user terminal100from deceiving the number of pieces of decryption information that can be properly decrypted, using a key other than the private key Csk.

The user terminal100acquires the encrypted information corresponding to predetermined type information from the issuance information management server60on the basis of the type information added to the encrypted issuance information. Thereby, it is possible to evaluate the submission status of the certificate information, using the encrypted issuance information of the predetermined type information.

The user terminal100acquires the encrypted information corresponding to the date and time information in the predetermined period from the issuance information management server60on the basis of the date and time information added to the encrypted issuance information. Thereby, it is possible to evaluate the submission status of the certificate information, using the encrypted issuance information issued in the predetermined period.

The encrypted issuance information includes the information obtained by encrypting information obtained by concatenating the user ID and the random number. Thereby, it is possible to suppress all pieces of decryption information that have been properly decrypted using the private key from being the same.

Furthermore, the information processing device200can suppress the user from disclosing disadvantageous information by detecting the submission omission of the issued certificate, so that the following effects can be obtained.

First, the user ID part of the issuance information, which is necessary to prove that all pieces of certificate information (credentials) have been disclosed, is anonymized. This content is not able to be confirmed by anyone other than the issuer terminal50that has registered the issuance information and the corresponding user. Therefore, it is possible to prevent leakage of privacy information that a user with a certain user ID has received a certain type of certificate information.

Furthermore, the verifier of the information processing device200can know which information the issuance information of the user at the time of being transmitted during proof by the user terminal100corresponds to, by comparing the issuance information with all pieces of encrypted issuance information of the issuance information management server60(on the blockchain), but the verifier is not able to know the issuance information on the blockchain is the issuance information of the user even if new issuance information is added thereafter. That is, the information on the blockchain is encrypted, and the verifier is not told the private key, so even if a new credential is issued to the user, the verifier will not know it.

Moreover, the verifier only knows the user's issuance information regarding the certificate type to be disclosed and is not able to know the issuance information of other certificate types. This also means that the private key is not disclosed to the verifier, so the verifier is not able to know information unrelated to the proof.

Next, an example of a hardware configuration of a computer that implements functions similar to those of the issuer terminal50, the issuance information management server60, the user terminal100, and the information processing device200described in the above embodiment will be described in order.

FIG.20is a diagram illustrating an example of a hardware configuration of a computer that implements functions similar to those of the issuer terminal according to the embodiment.

As illustrated inFIG.20, a computer300includes a CPU301that executes various types of arithmetic processing, an input device302that receives data input from the user, and a display303. Furthermore, the computer300includes a communication device304that exchanges data with an external device or the like via a wired or wireless network, and an interface device305. Furthermore, the computer300includes a RAM306that temporarily stores various types of information, and a hard disk device307. Then, each of the devices301to307is connected to a bus308.

The hard disk device307includes an acceptance program307a, a certificate generation program307b, a random number generation program307c, an issuance information generation program307d, an encryption program307e, and a transmission program307f. Furthermore, the CPU301reads each of the programs307ato307fand expands the read program in the RAM306.

The acceptance program307afunctions as an acceptance process306a. The certificate generation program307bfunctions as a certificate generation process306b. The random number generation program307cfunctions as a random number generation process306c. The issuance information generation program307dfunctions as an issuance information generation process306d. The encryption program307efunctions as encryption process306e. The transmission program307ffunctions as a transmission process306f.

Processing of the acceptance process306acorresponds to the processing of the acceptance unit55a. Processing of the certificate generation process306bcorresponds to the processing of the certificate generation unit55b. Processing of the random number generation process306ccorresponds to the processing of the random number generation unit55c. Processing of the issuance information generation process306dcorresponds to the processing of the issuance information generation unit55d. Processing of the encryption process306ecorresponds to the processing of the encryption unit55e. Processing of the transmission process306fcorresponds to the processing of the transmission unit55f.

Note that each of the programs307ato307fmay not necessarily be stored in the hard disk device307beforehand. For example, each of the programs is stored in a “portable physical medium” to be inserted in the computer300, such as a flexible disk (FD), a compact disc read only memory (CD-ROM), a digital versatile disc (DVD), a magneto-optical disk, or an IC card. Then, the computer300may also read and execute each of the programs307ato307f.

FIG.21is a diagram illustrating an example of a hardware configuration of a computer that implements functions similar to those of the issuance information management server according to the embodiment.

As illustrated inFIG.21, a computer400includes a CPU401that executes various types of arithmetic processing, an input device402that receives data input from the user, and a display403. Furthermore, the computer400includes a communication device404that exchanges data with an external device or the like via a wired or wireless network, and an interface device405. Furthermore, the computer400includes a RAM406that temporarily stores various types of information and a hard disk device407. Then, each of the devices401to407is connected to a bus408.

The hard disk device407has a registration program407aand a response program407b. Furthermore, the CPU401reads each of the programs407aand407band expands the read program in the RAM406.

The registration program407afunctions as a registration process406a. The response program407bfunctions as a response process406b.

Processing of the registration process406acorresponds to the processing of the registration unit65a. Processing of the response process406bcorresponds to the processing of the response unit65b.

Note that each of the programs407aand407bmay not necessarily be stored in the hard disk device407beforehand. For example, each of the programs is stored in a “portable physical medium” to be inserted in the computer400, such as a flexible disk (FD), a CD-ROM, a DVD, a magneto-optical disk, or an IC card. Then, the computer400may read and execute each of the programs407aand407b.

FIG.22is a diagram illustrating an example of a hardware configuration of a computer that implements functions similar to those of the user terminal according to the embodiment.

As illustrated inFIG.22, a computer500includes a CPU501that executes various types of arithmetic processing, an input device502that receives data input from the user, and a display503. Furthermore, the computer500includes a communication device504that exchanges data with an external device or the like via a wired or wireless network, and an interface device505. Furthermore, the computer500includes a RAM506that temporarily stores various types of information and a hard disk device507. Then, each of the devices501to507is connected to a bus508.

The hard disk device507includes a certificate request program507a, an acquisition program507b, a decryption program507c, a transmission processing program507d, and a proof processing program507e. Furthermore, the CPU501reads each of the programs507ato507eand expands the read program in the RAM506.

The certificate request program507afunctions as a certificate request process506a. The acquisition program507bfunctions as an acquisition process506b. The decryption program507cfunctions as a decryption process506c. The transmission processing program507dfunctions as a transmission processing process506d. The proof processing program507efunctions as a proof processing process506e.

Processing of the certificate request process506acorresponds to the processing of the certificate request unit151. Processing of the acquisition process506bcorresponds to the processing of the acquisition unit152. Processing of the decryption process506ccorresponds to the processing of the decryption unit153. Processing of the transmission processing process506dcorresponds to the processing of the transmission processing unit154. Processing of the proof processing process506ecorresponds to the processing of the proof processing unit155.

Note that each of the programs507ato507edoes not necessarily have to be stored in the hard disk device507beforehand. For example, each of the programs is stored in a “portable physical medium” to be inserted in the computer500, such as a flexible disk (FD), a CD-ROM, a DVD, a magneto-optical disk, or an IC card. Then, the computer500may read and execute each of the programs507ato507e.

FIG.23is a diagram illustrating an example of a hardware configuration of a computer that implements functions similar to those of the user terminal according to the embodiment.

As illustrated inFIG.23, a computer600includes a CPU601that executes various types of arithmetic processing, an input device602that receives data input from the user, and a display603. Furthermore, the computer600includes a communication device604that exchanges data with an external device or the like via a wired or wireless network, and an interface device605. Furthermore, the computer600includes a RAM606that temporarily stores various types of information and a hard disk device607. Then, each of the devices601to607is connected to a bus608.

The hard disk device607includes a reception program607a, an evaluation program607b, and a verification processing program607c. Furthermore, the CPU601reads each of the programs607ato607cand expands the read program in the RAM606.

The reception program607afunctions as a reception process606a. The evaluation program607bfunctions as an evaluation process606b. The verification processing program607cfunctions as a verification processing process605c.

Processing of the reception process606acorresponds to the processing of the reception unit251. Processing of the evaluation process606bcorresponds to the processing of the evaluation unit252. Processing of the verification processing process606ccorresponds to the processing of the verification processing unit253.

Note that each of the programs607ato607cmay not necessarily be stored in the hard disk device607beforehand. For example, each of the programs is stored in a “portable physical medium” to be inserted in the computer600, such as a flexible disk (FD), a CD-ROM, a DVD, a magneto-optical disk, or an IC card. Then, the computer600may read and execute each of the programs607ato607c.