Program, information processing device and information processing method

Abstract

To provide a program capable of guaranteeing the validity of a data processing process, an information processing device and an information processing method.SOLUTION: A program makes a computer achieve an acquisition function for acquiring first unprocessed data of first data processing executed by a first user and first processed data of the first data processing, an issuance function for issuing a first electronic certificate for proving a combination of the first unprocessed data and the first processed data, and a provision function for providing a second user different from the first user with the first electronic certificate.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a program, an information processing device, and an information processing method. [Background technology]

[0002] In recent years, technology related to electronic certificates that certify the legitimacy of data (including, for example, the validity and authenticity of data) has become known. For example, Patent Document 1 discloses a method of generating an electronic signature based on a generated document and issuing an electronic certificate including this electronic signature as an electronic certificate that certifies the legitimacy (authenticity) of the document. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2022 / 220062 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, there are cases where value is found not only in the data itself, but also in the process of data processing up to now (hereinafter also referred to as "processing process"), such as in the so-called process economy, such as who generated the data, and who then processed it, when, where, and how. However, the above-mentioned conventional technology cannot guarantee the legitimacy of such data processing processes.

[0005] Therefore, an object of the present invention is to provide a program, an information processing device, and an information processing method that can ensure the validity of the data processing process. [Means for solving the problem]

[0006] A program according to one embodiment of the present invention causes a computer to realize an acquisition function that acquires first pre-processing data of a first data processing executed by a first user and first post-processing data of the first data processing, an issuance function that issues a first electronic certificate that certifies the combination of the first pre-processing data and the first post-processing data, and a provision function that provides the first electronic certificate to a second user different from the first user.

[0007] A program according to one embodiment of the present invention causes a computer to realize an acquisition function that acquires first pre-processing data of a first data processing executed by a first user and / or first post-processing data of the first data processing, and first history information regarding the history of the first data processing, an issuance function that issues a first electronic certificate that certifies the combination of the first pre-processing data and / or the first post-processing data, and the first history information, and a provision function that provides the first electronic certificate to a second user different from the first user.

[0008] An information processing device according to one embodiment of the present invention includes an acquisition unit that acquires first pre-processing data of a first data processing executed by a first user and first post-processing data of the first data processing, an issuing unit that issues a first electronic certificate that certifies the combination of the first pre-processing data and the first post-processing data, and a providing unit that provides the first electronic certificate to a second user different from the first user.

[0009] An information processing device according to one embodiment of the present invention includes an acquisition unit that acquires first pre-processing data of a first data processing executed by a first user and / or first post-processing data of the first data processing, and first history information regarding the history of the first data processing, an issuing unit that issues a first electronic certificate that certifies the combination of the first pre-processing data and / or the first post-processing data, and the first history information, and a providing function that provides the first electronic certificate to a second user different from the first user.

[0010] An information processing method according to one embodiment of the present invention includes a computer acquiring first pre-processing data for a first data processing performed by a first user and first processed data for the first data processing, issuing a first electronic certificate that certifies the combination of the first pre-processing data and the first processed data, and providing the first electronic certificate to a second user different from the first user.

[0011] An information processing method according to one embodiment of the present invention includes a computer acquiring first pre-processing data and / or first post-processing data of a first data processing executed by a first user, and first history information relating to a history of the first data processing, issuing a first electronic certificate that certifies the combination of the first pre-processing data and / or the first post-processing data, and the first history information, and providing the first electronic certificate to a second user different from the first user. Effect of the Invention

[0012] According to the present invention, it is possible to guarantee the validity of the data processing process. [Brief description of the drawings]

[0013] [Figure 1] 1 is a diagram for explaining an example of a system configuration of a data processing and recording system according to an embodiment of the present invention; [Diagram 2] 1 is a diagram for explaining an example of an overview of a data processing and recording system according to an embodiment of the present invention; [Diagram 3] 1 is a diagram for explaining an example of an overview of a data processing and recording system according to an embodiment of the present invention; [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a management device according to the present embodiment. [Diagram 5] FIG. 4 is a diagram illustrating an example of the operation of a management device according to the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a hardware configuration of a management device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] A preferred embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described with reference to the accompanying drawings. In each drawing, the same reference numerals denote the same or similar configurations.

[0015] In the present invention, "part", "means", "apparatus" or "system" does not simply mean physical means, but also includes cases where the functions of the "part", "means", "apparatus" or "system" are realized by software. In addition, the functions of one "part", "means", "apparatus" or "system" may be realized by a combination of two or more physical means, devices or software modules, and the functions of two or more "parts", "means", "apparatus" or "systems" may be realized by one physical means, device or software module.

[0016] The data processing and recording system 1 according to this embodiment is a system for recording the process of data processing up to now (hereinafter also referred to as the "processing process") and providing the record in response to a request from a user, etc. In other words, the data processing and recording system 1 discloses to the outside under certain conditions (or unconditionally) the processing process, such as who generated the data, and who subsequently processed it, when, where, and how.

[0017] Specifically, data processing may include data generation, data acquisition (including referencing and / or copying), data registration (including storage in a memory unit), data updating such as processing, data provision (including output, display and / or transmission to other devices), etc.

[0018] The data according to this embodiment is assumed to be various types of data, and may be, for example, still images, videos, audio data, text data (including source code, for example), programs, and the like.

[0019] <1. System configuration> An example of a system configuration of a data processing and recording system 1 according to this embodiment will be described with reference to Fig. 1. As shown in Fig. 1, the data processing and recording system 1 includes a management device 100, a first user device 200a, a second user device 200b, and a handling carrier device 300. The first user device 200a and the second user device 200b are also collectively referred to as "user device 200".

[0020] The management device 100 is communicably connected to the user device 200 and the dealer device 300 via a network N in order to link data, pre- and post-processing data (described later), history information, and / or electronic certificates between these devices. The management device 100 may also be communicably connected to other external devices, such as a certification authority device 400 of an external system 4, via the network N, for example.

[0021] The network N is composed of a wireless network or a wired network. Examples of the network include a mobile phone network, a PHS (Personal Handy-phone System) network, a wireless LAN (Local Area Network, including communication conforming to IEEE802.11 (so-called WI / Fi (registered trademark))), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation), WiMax (registered trademark), infrared communication, visible light communication, Bluetooth (registered trademark), a wired LAN, a telephone line, a power line communication network, a network conforming to IEEE1394, etc.

[0022] The management device 100 is an information processing device for providing a service (hereinafter referred to as a "processing record providing service") that enables the provision of information recorded regarding the data processing process (hereinafter referred to as "processing record information"). The management device 100 executes a predetermined program to realize a server function that provides the user with the processing record information acquired from the user device 200 or the handling business device 300 or issued by its own device, and a digital certificate of the processing record information (hereinafter referred to simply as a "digital certificate").

[0023] The processing record information may be, for example, data before processing of a data processing such as the first data processing or the second data processing (hereinafter also referred to as "pre-processing data"), data after processing of the data processing (hereinafter also referred to as "post-processing data"), or history information related to the history of the data processing. Furthermore, the pre-processing data and the post-processing data are collectively referred to as "pre- and post-processing data". The pre- and post-processing data may be, for example, a copy of all or a part of the data on which processing has been performed. Furthermore, the processing record information may be a combination of these data.

[0024] The first data processing is data processing executed by the first user. The second data processing is processing executed by the first user and is subsequent to the first data processing. The data to be processed by the second data processing has a certain relationship with the data to be processed by the first data processing, such as continuity, and for example, the pre-processing data of the second data processing may be the same data as the post-processing data of the first data processing, or may be updated data of the post-processing data of the first data processing.

[0025] The second data processing may be, for example, the following processing with respect to the first data processing. A series of actions performed by a user that are included in the same transaction Processing that has a certain continuity (e.g., performed subsequent to a first data processing)

[0026] For example, when the history information indicates the history of the first data processing, the history information may include user identification information for identifying the first user. According to such a configuration, for example, the user identification information itself or information that can identify which user the second user is using the user identification information can be extracted from the user information or the like and provided to the second user. This makes it possible for the second user to confirm which user performed the data processing. In addition, the history information may be, for example, a log output when the data processing is performed.

[0027] For example, the management device 100 may use an API (Application Programming Interface) provided by the user device 200 and / or the handling business device 300 to acquire the processing record information and the like. The management device 100 may also provide the user device 200 with an API for providing the processing record information and / or a digital certificate, for example. The user device 200 may acquire the processing record information and the like by using this API. Such cooperation between devices (in other words, external I / F) may be realized by using an SDK (Software Development Kit) for the data processing record system 1 including such an API.

[0028] The user device 200 is an information processing device used by a user, and is, for example, a terminal device such as a smartphone, a laptop, or a tablet. The user device 200 executes a predetermined program to connect to the management device 100 and / or the handling company device 300 to transmit and receive processing record information and the like, and to accept request inputs from the user. Note that this predetermined program may be, for example, a Web browser that the user device 200 includes as standard, or an application program dedicated to the data processing record system 1 installed in the user device 200.

[0029] A user is a person who uses the data processing record system 1, and may be, for example, a data owner, a data user, a data manager (administrator), a business providing a processing record providing service (including an employee), or the like. In this embodiment, an example will be described in which the business providing the processing record providing service is the administrator of the management device 100. A user may be identified, for example, by a user account (a combination of a user ID and a password) of the processing record providing service or the service provided by the business. Hereinafter, a user who is a processor who has caused data processing to be executed (i.e., a user who is the entity that has instructed the execution) is also referred to as a "first user". Hereinafter, a user different from the first user (for example, a third-party user who wants to inquire about the processing record information of the data processing) is also referred to as a "second user".

[0030] The handling business device 300 is an information processing device that executes data processing and is used by a business that handles the data to be processed (hereinafter, also referred to as a "handling business"). The handling business may be a user of the data processing recording system 1. In this case, the handling business device 300 may also serve as the user device 200. The handling business may be, for example, an operator that operates a platform for a virtual space such as a metaverse or a game, or an operator that operates various sites such as an EC site.

[0031] The certification authority device 400 is a certification authority (e.g., a government or a trusted third party) that can issue a digital certificate for a user's digital signature. The certification authority may be a public or private institution, and may be, for example, a Trusted Third Party (TTP) or a Certification Authority (CA) as a trusted third party.

[0032] <2. Overview> An example of the outline of the data processing and recording system 1 will be described with reference to Fig. 2. In the example of Fig. 2, an example will be described in which the processing target is image data. Note that in this example, an example will be described in which the same handling business device 300 executes the first data processing and the second data processing, but the device that executes the data processing is not limited to this. For example, the first user device 200a may execute the data processing locally, or multiple different handling business devices 300 may execute the first data processing and the second data processing, respectively.

[0033] (1) As shown in FIG. 2, a first A user (one embodiment of a first user) instructs a handling service provider device 300 to process image data D (one embodiment of first pre-processed data) as a first data processing operation from a first user device 200a1 (one embodiment of a first user device 200a).

[0034] (2) Upon receiving this instruction, the handling provider device 300 causes the management device 100 to register the unprocessed image data D as first processing record information of the first data processing before executing the processing process of the image data D. As another example of the timing of registering the unprocessed image data D, the first user device 200a1 may register the unprocessed image data D stored in its own device as a backup after executing the processing process.

[0035] (3) Upon receiving the instruction from the first A user, the handling business device 300 executes processing of the image data D as the first data processing.

[0036] (4) After executing the processing, the handling business device 300 registers the processed image data D2 (one aspect of the first processed data) and a log indicating the processing history of the processing (one aspect of the first history information) as first processing record information of the first data processing in the management device 100. In addition, at this time, the first processing record information may include a user ID (one aspect of the user identification information) indicating that the processor of the processing is the 1A user.

[0037] (5) The management device 100 issues a first electronic certificate for the registered first processing record information. The first electronic certificate is, for example, information for proving the validity of the first processing record information. This validity may be, for example, the validity of the first processing record information, the completeness of the first processing record information, and / or the authenticity of the registered processor (first A user) and / or the first processing record information. The management device 100 may also combine the first pre-processing data, the first post-processing data, and / or the first history information, which are the first processing record information. The management device 100 may issue an electronic certificate for this combination. (6) The management device 100 associates this combination with the first electronic certificate and registers it in the storage unit 130.

[0038] (7) The management device 100 acquires a request for inquiry of the first processing record information and / or the first electronic certificate from the second user device 200b of the second user. When the management device 100 acquires this inquiry request, it provides the first processing record information and / or the first electronic certificate to the second user via the second user device 200b. This allows the second user to confirm that the image data D1 has been processed by the firstA user to become the image data D2. Furthermore, the management device 100 can guarantee the legitimacy of this to the second user by the first electronic certificate.

[0039] (8) The 1B user (one aspect of the 1st user) instructs the handling business device 300 to process the image data D2 (one aspect of the data before the second processing) as the second data processing subsequent to the first data processing from the 1st user device 200a2 (one aspect of the 1st user device 200a). The process (9) to (11) related to this second data processing is similar to the above (2) to (4), and therefore the explanation is omitted.

[0040] (12) The management device 100 issues a second electronic certificate for the registered second processing record information and information for associating the first data processing with the second data processing (hereinafter also referred to as "associated information"). In this example, the associated information is a serial number assigned to each of the first data processing and the second data processing. The process of (13) related to the second data processing is the same as that of (6) above, and therefore will not be described here.

[0041] (14) The management device 100 acquires a request for inquiry of the second processing record information and / or the second electronic certificate from the second user device 200b of the second user. When the management device 100 acquires this inquiry request, it provides the second processing record information and / or the second electronic certificate to the second user via the second user device 200b. This allows the second user to confirm that the image data D2 has been processed by the firstB user to become the image data D3. In addition, the management device 100 can guarantee the legitimacy of this to the second user by the second electronic certificate. Furthermore, the management device 100 may provide the first processing record information and / or the first electronic certificate of the first data processing preceding the second data processing together with the second processing record information in response to the inquiry request from the second user.

[0042] With the above configuration, the second user can check the processing record information while ensuring the legitimacy of the processing record information of the data processing to a certain extent. Therefore, the data processing and recording system 1 can guarantee the legitimacy of the data processing process.

[0043] In this example, the data processing to be recorded and / or certified is data manipulation, but this is not intended to limit the data processing in the data processing recording system 1. The data processing may be at least one of the following processes (A) to (C), such as (A) the first user device 200a acquiring first data, (B) registering the acquired first data in a storage unit of the first user device 200a, and (C) transmitting the registered first data to the second user device 200b, in response to an instruction from a firstA user who is a processor.

[0044] Referring to FIG. 3, the processing of each functional unit of the management device 100 will be described. <A1) Handler Registration> (0-1) As shown in FIG. 3, as a pre-registration of the handling business operator, the acquisition unit 111 of the management device 100 acquires the handling business operator information from the handling business operator device 300 of the handling business operator and registers it in the storage unit 130.

[0045] The handling business operator information is information regarding the handling business operator. The handling business operator information may include, for example, when the handling business operator is an individual, as attribute information, name, address, and / or email address, etc. Also, the handling business operator information may include, for example, when the handling business operator is a corporation, as attribute information, corporate name, trade name, location, contact information, and / or information regarding the corporation's website (e.g., URL, etc.). Further, the handling business operator information may include, for example, the type of data to be handled (e.g., still image, video, text, program, etc.).

[0046] <A2) Processor Registration> (0-2) As a pre-registration of the first user who is a processor, the acquisition unit 111 of the management device 100 acquires the user information of the first user from the first user device 200a of the first user and registers it in the storage unit 130.

[0047] The user information is information regarding the user. The user information may include information regarding the user account such as the user identification information (user ID) and the corresponding password. Also, the user information may include, for example, when the user is an individual, as attribute information, name, address, and / or email address, etc. Also, the user information may include, for example, when the user is a corporation (or its employee), as attribute information, corporate name, trade name, location, contact information, and / or information regarding the corporation's website, etc. Further, the user information may include the device information of the user device 200 used by the user.

[0048] User information is, for example, information related to user identification. In addition to the user's name, address, and contact information, it may include information related to the user's My Number card used for identification, and / or information related to the user's driver's license used for identification, etc.

[0049] User information may include, for example, as information used for user authentication, the user's possession information (information identifying the possessions held by the user and / or location information indicating the location of the possessions, etc.), biometric information (for example, the user's face, fingerprint, palmprint, voiceprint, and / or iris, etc.), and / or memory information (for example, a password or PIN code, etc.).

[0050] Device information may include device identification information, product name, MAC address, IP address, and / or manufacturing number, etc., for identifying various devices such as the user device 200.

[0051] <A3) Data Registration> (1) The acquisition unit 111 of the management device 100 acquires pre - processing data and / or post - processing data of data processing from the first user device 200a of the first user or the handling business operator device 300, and registers them in the storage unit 130.

[0052] <B1) History Recording> (2) The acquisition unit 111 of the management device 100 acquires history information indicating the history of data processing from the first user device 200a or the handling business operator device 300, and registers it in the storage unit 130. At this time, the acquisition unit 111 may generate, as processing record information, history information indicating the processing history of the acquisition of pre - processing data, post - processing data, and / or history information, and record it in the storage unit 130.

[0053] (3) The generation unit 114 of the management device 100 may generate processing content information indicating the content of the executed data processing, instead of (or in addition to complementarily) the history information acquired from the first user device 200a or the handling business operator device 300, and record it in the storage unit 130. Further, for example, when the first user has successfully authenticated the user via the first user device 200a and provided the pre - and post - processing data and the history information to the management device 100 as processing record information, the authentication unit 118 of the management device 100 may generate history information of this user authentication processing history (including the result of user authentication).

[0054] <B2) Certificate Issuance> (4) The issuance unit 113 of the management device 100 issues an electronic certificate that proves at least any one of the following combinations. The issuance unit 113 registers the issued electronic certificate in the storage unit 130 in association with the corresponding processing record information (in other words, the processing record information to be proved). · The combination of pre - processing data and post - processing data · The combination of pre - processing data and / or post - processing data and the history information of data processing

[0055] (5) The providing unit 116 of the management device 100 provides the electronic certificate issued in (4) above to the first user via the first user device 200a.

[0056] <B3) Certificate Verification> (6) The acquisition unit 111 of the management device 100 acquires a verification request for an electronic certificate of the processing record information of data processing from the second user device 200b of the second user. The electronic certificate to be verified may be, for example, an electronic certificate that the management device 100 has provided to a user such as the second user in the past, or an electronic certificate registered in the storage unit 130. In the former case, the verification request may include the electronic certificate provided in the past.

[0057] (7) The verification unit 115 of the management device 100 verifies the electronic certificate required in (6) above. (8) The verification unit 115 provides the verification result information indicating the result of this verification to the second user via the second user device 200b.

[0058] <B4) Inquiry> (9) The acquisition unit 111 of the management device 100 acquires a request for providing processing record information and / or its electronic certificate from the second user device 200b of the second user as an inquiry of the processing record.

[0059] (10) The providing unit 116 of the management device 100 provides the processing record information and / or the electronic certificate required in (6) above to the second user via the second user device 200b.

[0060] Under the above configuration, the second user can confirm this processing record information and ensure to a certain extent the validity of the electronic certificate of the processing record information. Therefore, the data processing record system 1 can ensure the validity of the data processing process.

[0061] <3. Functional Configuration> Referring to FIG. 4, the functional configuration of the management device 100 according to the present embodiment will be described. As shown in FIG. 4, the management device 100 includes a control unit 110, a communication unit 120, and a storage unit 130.

[0062] The control unit 110 includes an acquisition unit 111, an issuance unit 113, and a providing unit 116. Further, the control unit 110 may include, for example, an identification unit 112, a generation unit 114, a verification unit 115, a providing unit 116, an identity confirmation unit 117, and / or an authentication unit 118.

[0063] [Acquisition Unit] The acquisition unit 111 acquires various data (including various instructions and requests from the user) from the user device 200 and / or the handling service provider device 300, etc. The acquisition unit 111 may acquire various data in any manner. For example, the acquisition unit 111 may receive a data file indicating pre- and post-processing data or history information from the user device 200 or the handling service provider device 300 in an event-driven manner or periodically in response to a request for provision from the acquisition unit 111 or the first user device 200a. The acquisition unit 111 may, for example, instruct an API or SDK library implemented by the handling service provider device 300 to refer to pre- and post-processing data or history information as an information inquiry, and acquire these data as a result.

[0064] The acquisition unit 111 acquires first pre-processing data of a first data processing executed by a first user and first post-processing data of the first data processing. The acquisition unit 111 may also acquire, for example, second post-processing data of a second data processing subsequent to the first data processing and second history information relating to the history of the second data processing.

[0065] For example, when an encryption key of a user such as an administrator or processor is leaked, the acquiring unit 111 may acquire a revocation request for an electronic certificate issued using this encryption key from the user device 200 of the user. When acquiring this revocation request, the acquiring unit 111 may register the requested electronic certificate (or an electronic signature encrypted with the encryption key included in the electronic certificate) in a certificate revocation list (so-called CRL: Certificate Revocation List).

[0066] The acquiring unit 111 may, for example, acquire the digital signature generated by the issuing unit 113 from the storage unit 130. As another example, the acquiring unit 111 may acquire the digital signature of a user, such as an administrator or a processor, from the user device 200 of the user. The digital certificate may include information (such as the user's key information) for proving the validity of the digital signature acquired in this manner.

[0067] The acquiring unit 111 may acquire, for example, the portions of the pre-processing data and the post-processing data identified by the identifying unit 112. When history information is used for this identification, the acquiring unit 111 needs to acquire this history information prior to the pre-processing and post-processing data.

[0068] For example, when acquiring the first post-processing data from the user device 200 or the handling provider device 300, the acquiring unit 111 may determine the consistency with the first pre-processing data provided by these devices. The acquiring unit 111 may acquire the first post-processing data based on the result of this determination. For example, when there is a discrepancy in the file format between the pre-processing data and the post-processing data (for example, a JPEG file and a TXT file), the acquiring unit 111 may determine that there is no consistency.

[0069] [Specific part] The identification unit 112 identifies the portions of the pre-processing data and the post-processing data that are the target of data processing. The identification unit 112 may identify the portions of the pre-processing data and the post-processing data that are the target of data processing, for example, based on history information corresponding to the pre- and post-processing data that are the target of data processing. The identification unit 112 may also extract features of the pre- and post-processing data that are the target of data processing, and identify the portions of the pre- and post-processing data and the post-processing data that are the target of data processing, based on the extracted features.

[0070] [Publishing Department] The issuing unit 113, as a so-called private CA, issues a digital certificate that certifies a combination of processing record information. The issuing unit 113 may register this issued digital certificate in the storage unit 130. Furthermore, the issuing unit 113 may, for example, assign a serial number generated by the generating unit 114 to the issued digital certificate. In this case, the issuing unit 113 may include the assigned serial number in the digital certificate.

[0071] The issuing unit 113 may generate a digital signature of the user based on the processing record information, for example. The issuing unit 113 may register the generated digital signature in the storage unit 130. Specifically, the issuing unit 113 may generate a hash value of all or a part of the combination of the processing record information. The issuing unit 113 may encrypt the generated hash value using key information to generate a digital signature. The issuing unit 113 may include the generated digital signature in a digital certificate.

[0072] The key information is, for example, information about an encryption key of a user such as an administrator or a processor. The key information may not be the encryption key itself, but may be a token having the authority to use the encryption key. The encryption key may be, for example, a common key in a common key cryptosystem, or a pair of a public key and a private key in a public key cryptosystem. In the case of encryption of an electronic signature, the private key of the first user or the administrator is used as the key information. In this case, the electronic certificate may include a public key that is paired with the encrypted private key.

[0073] For example, when using a public key cryptography method as described above, the issuing unit 113 may issue an electronic certificate based on X.509, which is the ITU-T (International Telecommunication Union-Telecommunication sector) public key infrastructure (PKI) standard.

[0074] For example, the issuing unit 113 may generate a hash value of all or part of the digital certificate. The issuing unit 113 may encrypt the generated hash value using key information of a user such as an administrator, and use the encrypted value as the digital signature of the user.

[0075] The issuing unit 113 may issue a first electronic certificate that certifies, for example, a combination of the first pre-processing data and the first post-processing data. The issuing unit 113 may also issue a first electronic certificate that certifies, for example, a combination of the first pre-processing data and / or the first post-processing data and the first history information.

[0076] The issuing unit 113 may, for example, set an expiration date for the issued electronic certificate. The issuing unit 113 may include the set expiration date in the electronic certificate. The issuing unit 113 may set the expiration date of the electronic certificate based on, for example, the type of pre- and post-processing data to be certified, user authentication result information, and / or user identity verification result information.

[0077] As another example, the issuing unit 113 may not issue a digital certificate by itself, but may request the authentication device to issue a digital certificate for processing record information (e.g., information generated by the authentication device, such as history information regarding acquisition of data before and after data processing). The issuing unit 113 may obtain, for example, from the authentication authority system, a digital certificate issued by the authentication authority system as a response to the issuance request.

[0078] The issuing unit 113 may issue, for example, an electronic certificate (hereinafter also referred to as a "combined electronic certificate") that certifies a combination of the first pre-processing data and / or the second post-processing data, the first history information, and the second history information.

[0079] The issuing unit 113 may issue a second digital certificate that certifies, for example, a combination of the second pre-processing data and / or the second post-processing data and the second history information.

[0080] The issuing unit 113 may, for example, issue a digital certificate that certifies the combination of the parts of the pre-processing data and the post-processing data identified by the identifying unit 112. The issuing unit 113 may, for example, extract the identified parts from the pre-processing data and the post-processing data registered in the storage unit 130, and generate a hash value of the combination of the extracted parts. The issuing unit 113 may encrypt the hash value thus generated using key information, generate a digital signature, and include the encrypted hash value in the digital certificate. With such a configuration, it is possible to narrow down the targets to be certified, and efficiently guarantee the validity of the processing process.

[0081] [Generation part] The generating unit 114 generates various data in response to a user request or the like. The generating unit 114 generates related information indicating the relationship between the first data processing and the second data processing, indicating that the second data processing follows the first data processing. The generating unit 114 may generate and assign a serial number to each of the electronic certificates issued by the issuing unit 113 as the related information, for example. The first electronic certificate and / or the second electronic certificate issued by the issuing unit 113 may include, for example, this generated related information. With this configuration, the electronic certificate can include information indicating the relationship between the first electronic certificate and the second electronic certificate.

[0082] The generating unit 114 may generate, for example, processing content information indicating the content of the executed data processing. The generating unit 114 may, for example, identify a difference between pre-processing data and post-processing data, and use the identified difference as the content of the data processing (in other words, the processing steps of the data processing).

[0083] [Verification Department] The verification unit 115 verifies the electronic certificate in response to a request from a user, etc. Specifically, the verification unit 115 may determine the presence or absence and / or degree of legitimacy of the electronic certificate (e.g., authenticity and / or validity of the electronic certificate). The verification unit 115 may, for example, obtain key information of the electronic signature and verify the electronic signature using the obtained key information. For example, when the electronic signature is a hash value of the electronic certificate, the verification unit 115 may decrypt the electronic signature using a public key and compare the decrypted electronic signature with the hash value of the electronic certificate. By verifying the electronic signature in this way, the integrity of the electronic certificate and the authenticity of the issuer of the electronic certificate (e.g., an administrator or a certification authority) may be ensured.

[0084] For example, when the digital signature included in the digital certificate is a hash value of the processing record information, the verification unit 115 may decrypt the digital signature using an encryption key and compare the decrypted digital signature with the hash value of the processing record information. By performing verification in this manner, the integrity of the processing record information to be certified by the digital certificate and the authenticity of the issuer of the digital certificate may be ensured.

[0085] The verification unit 115 may verify the validity of the electronic certificate based on, for example, revocation list information indicating a certificate revocation list or the expiration date included in the electronic certificate.

[0086] The verification unit 115 may provide the second user with information for verifying the digital certificate (e.g., key information of the public key of the user who is the administrator or processor, etc.) The second user may verify the digital certificate by himself / herself using the second user device 200b based on the provided information.

[0087] [Provider] The providing unit 116 provides various data to the user device 200 and the like. The providing unit 116 may provide various data in any manner. For example, the providing unit 116 may transmit a data file or a message including pre- and post-processing data, history information, and / or a digital certificate to these devices in an event-driven manner. As another example, the providing unit 116 may provide these data to the user device 200 and the like via an API or SDK library implemented by the providing unit 116 itself.

[0088] The providing unit 116 provides the first electronic certificate issued by the issuing unit 113 to the second user via the second user device 200b or the like.

[0089] According to the above configuration, the providing unit 116 can provide the second user with a digital certificate for verifying the validity of the processing record information of the data processing. Therefore, the data processing and recording system 1 can guarantee the validity of the data processing process.

[0090] The providing unit 116 may provide the combined digital certificate issued by the issuing unit 113 to the second user via the second user device 200b or the like, for example.

[0091] According to the above configuration, the providing unit 116 can provide the second user with an electronic certificate for collectively verifying the validity of the processing record information of the second data processing having a certain continuity with the first data processing. Therefore, the data processing recording system 1 can guarantee the validity of the processing steps of a plurality of data processings.

[0092] For example, the providing unit 116 may provide the second electronic certificate issued by the issuing unit 113 in association with the first electronic certificate to the second user via the second user device 200b or the like.

[0093] According to the above configuration, the providing unit 116 can provide the second user with the second electronic certificate for proving the validity of the processing record information of the second data processing having a certain continuity with the first data processing in association with the first electronic certificate. Therefore, the data processing recording system 1 can guarantee the validity of a series of multiple data processing processes.

[0094] For example, the providing unit 116 may provide the verification result information indicating the result of the verification by the verifying unit 115 to the second user via the second user device 200b or the like.

[0095] According to the above configuration, the providing unit 116 can provide the second user with the result of verifying the authenticity of the electronic certificate. Therefore, the data processing and recording system 1 can guarantee the authenticity of the electronic certificate.

[0096] For example, the providing unit 116 may provide the second user with the digital signature acquired by the acquiring unit 111 in association with a digital certificate including information for verifying the validity of the digital signature.

[0097] [Identification Department] The identity verification unit 117 performs identity verification of the user based on the user information. This identity verification is to electronically verify the certainty that the user is an actual person (so-called eKYC), and may be, for example, identity proofing defined by NIST (National Institute of Standards and Technology) SP 800-63-3.

[0098] The identity verification unit 117 may generate, as the processing record information, history information regarding the identity verification process history, including identity verification result information indicating the result of the identity verification of the user. The identity verification unit 117 may register the generated history information in the storage unit 130.

[0099] [Authentication section] The authentication unit 118 performs user authentication one or more times in response to an authentication request acquired by the acquisition unit 111. Performing user authentication multiple times may mean, for example, performing multi-factor authentication such as two-factor authentication using multiple authentication factors, or performing multi-stage authentication such as two-stage authentication performing authentication in stages. As another example, performing user authentication multiple times may mean performing two or more authentications with different authentication levels.

[0100] The user authentication may be, for example, authentication defined by NIST SP 800-63-3. The authentication level applied to the user authentication may be, for example, AAL (Authenticator Assurance Level) defined by NIST SP 800-63B as follows: Level 1: Of the three authentication factors (knowledge, possession, and biometrics), one or more factors must be used, and there is a certain degree of confidence in the person's authentication. In other words, this can be achieved by performing at least single-factor authentication. Level 2: Of the three factors, multiple factors such as ID password + one-time password must be used, and there is a considerable degree of reliability in authenticating the person. Unlike level 3, level 2 can also be achieved by using software as the second factor authentication method. Level 3: Two-factor authentication, where the second factor must be authenticated using tamper-resistant hardware, and the reliability of identity authentication is very high (specifically, a PIN code + a card with an IC chip + My Number card, etc.).

[0101] The authentication unit 118 may generate, as the processing record information, history information regarding the processing history of the user authentication, including authentication result information indicating the result of the user authentication. The authentication unit 118 may register the generated history information in the storage unit 130.

[0102] [Communications Department] The communication unit 120 transmits and receives various data to and from the user device 200, the agent device 300, and / or other devices of the external system 4, via the network N.

[0103] [Storage] The storage unit 130 stores processing record information (pre- and post-processing data and history information), electronic certificates, and / or user information, etc. The storage unit 130 may store each piece of data using a database management system (DBMS), or may store each piece of information using a file system. When using a DBMS, the storage unit 130 may provide a table for each piece of data, and manage these pieces of data by associating the tables with each other.

[0104] <4. Example of operation> An example of the operation of the management device 100 will be described with reference to Fig. 5. Fig. 5(a) is a flow diagram showing the flow of processing in the management device 100 from acquiring processing record information to registering it in the storage unit 130. Fig. 5(b) is a flow diagram showing the flow of processing from acquiring a request to provide processing record information, etc. from a second user to providing the requested information. Note that the order of processing shown below is an example and may be changed as appropriate.

[0105] 5(a), the acquisition unit 111 of the management device 100 acquires processing record information such as pre- and post-processing data and / or history information (S10). The issuance unit 113 of the management device 100 issues a digital certificate for a combination of the acquired processing record information (S11). The control unit 110 of the management device 100 associates the acquired processing record information with the issued digital certificate and registers them in the storage unit 130 (S12).

[0106] 5(b), the acquisition unit 111 of the management device 100 acquires a request for providing a combination of processing record information and / or a digital certificate from the second user via the second user device 200b (S20). The provision unit 116 of the management device 100 provides the requested combination of processing record information and / or a digital certificate to the second user via the second user device 200b (S21).

[0107] <6. Hardware configuration> 6, an example of a hardware configuration in which the above-mentioned management device 100 is realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into a plurality of devices.

[0108] As shown in FIG. 6, a computer 800 includes a processor 801, a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811, and a display device 813.

[0109] The processor 801 controls various processes in the computer 800 by executing programs stored in the memory 803. For example, each functional unit of the control unit 110 of the management device 100 can be realized by the processor 801 executing a program temporarily stored in the memory 803.

[0110] The memory 803 is a storage medium such as a RAM (Random Access Memory), etc. The memory 803 temporarily stores the program code of the program executed by the processor 801, or data required when the program is executed.

[0111] The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system or various programs for implementing each of the above configurations. In addition, the storage device 805 can also store tables for registering various data such as processing record information, electronic certificates, and / or user information, and a DB for managing the tables. Such programs or data are loaded into the memory 803 as necessary, and are referred to by the processor 801.

[0112] The input I / F unit 807 is a device for receiving input from a user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, and a wearable device. The input I / F unit 807 may be connected to the computer 800 via an interface such as a Universal Serial Bus (USB).

[0113] The data I / F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I / F unit 809 is a drive device for reading data stored in various storage media. The data I / F unit 809 may be provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as a USB.

[0114] The communication I / F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with an external device of the computer 800. The communication I / F unit 811 may be provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as a USB.

[0115] The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, and a display of a wearable device. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. In addition, when a touch panel is adopted as the input I / F unit 807, the display device 813 can be configured integrally with the input I / F unit 807.

[0116] The above-mentioned embodiment is an example for explaining the present invention, and is not intended to limit the present invention to the embodiment. In addition, the present invention can be modified in various ways without departing from the gist of the present invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent, and such an embodiment is also included in the scope of the present invention.

[0117] [Variations] Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[0118] [Variation 1] At least a part of the components of the management device 100 according to the above embodiment may be provided in the user device 200 and / or the dealer device 300. [Explanation of symbols]

[0119] 1...data processing and recording system, 100...management device, 110...control unit, 111...acquisition unit, 113...issuance unit, 116...provision unit, 120...communication unit, 130...storage unit, 200...user device, 300...dealer device, 400...certification authority device, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I / F unit, 809...data I / F unit, 811...communication I / F unit, 813...display device

Claims

1. On the computer, an acquisition function for acquiring first pre-processing data of a first data processing executed by a first user and first post-processing data of the first data processing; an issuing function for issuing a first electronic certificate that certifies a combination of the first pre-processing data and the first post-processing data; a providing function of providing the first electronic certificate to a second user different from the first user; program.

2. On the computer, an acquisition function for acquiring first pre-processing data of a first data processing executed by a first user and / or first post-processing data of the first data processing, and first history information relating to a history of the first data processing; an issuing function for issuing a first electronic certificate that certifies a combination of the first pre-processing data and / or the first post-processing data and the first history information; a providing function of providing the first electronic certificate to a second user different from the first user; program.

3. The first data processing is generation of first data, acquisition of first data, registration of first data, update of first data, or provision of first data.

3. The program according to claim 1 or 2.

4. The first history information includes user identification information for identifying the first user. The program according to claim 2.

5. The acquisition function acquires second processed data of a second data process executed by the first user and subsequent to the first data process, and second history information relating to a history of the second data process; the issuing function issues a combined digital certificate that certifies a combination of the first pre-processing data and / or the second post-processing data, the first history information, and the second history information; the providing function provides the second user with the combined digital certificate; The program according to claim 2.

6. The acquisition function acquires second processed data of a second data processing which is a second process on data executed by the first user and follows the first data processing, and second history information relating to a history of the second data processing, the issuing function issues a second electronic certificate that certifies a combination of the second processed data and the second history information; the providing function provides the second user with the second electronic certificate in association with the first electronic certificate; The program according to claim 2.

7. a generating function of generating association information indicating an association between the first data processing and the second data processing, the association information indicating that the second data processing follows the first data processing; the first electronic certificate and / or the second electronic certificate includes the related information; The program according to claim 6.

8. causing the computer to realize a verification function for verifying the first electronic certificate in response to a request from a user; The providing function provides the second user with verification result information indicating a result of the verification.

3. The program according to claim 1 or 2.

9. The acquisition function acquires a digital signature of the first user generated based on the first pre-processing data and / or the first post-processing data; the first electronic certificate includes information for verifying the authenticity of the electronic signature; the providing function provides the electronic signature to the second user in association with the first electronic certificate; 3. The program according to claim 1 or 2.

10. causing the computer to realize a specification function of specifying a portion of the first pre-processing data and the first post-processing data that has been subjected to the first data processing; the issuing function issues the first electronic certificate certifying a combination of the specified parts of the first pre-processing data and the first post-processing data. The program according to claim 1.

11. an acquisition unit that acquires first pre-processing data of a first data processing executed by a first user and first post-processing data of the first data processing; an issuing unit that issues a first electronic certificate that certifies a combination of the first pre-processing data and the first post-processing data; and a providing unit that provides the first electronic certificate to a second user that is different from the first user. Information processing device.

12. The computer Acquiring first pre-processing data of a first data processing executed by a first user and first processed data of the first data processing; issuing a first electronic certificate certifying a combination of the first pre-processing data and the first processed data; providing the first digital certificate to a second user different from the first user; Information processing methods.

13. an acquisition unit that acquires first pre-processing data of a first data processing executed by a first user and / or first post-processing data of the first data processing, and first history information relating to a history of the first data processing; an issuing unit that issues a first electronic certificate that certifies a combination of the first pre-processing data and / or the first post-processing data and the first history information; a provision function of providing the first electronic certificate to a second user different from the first user; Information processing device.

14. The computer acquiring first pre-processing data of a first data processing executed by a first user and / or first post-processing data of the first data processing, and first history information relating to a history of the first data processing; issuing a first electronic certificate certifying a combination of the first pre-processing data and / or the first post-processing data and the first history information; providing the first digital certificate to a second user different from the first user; Information processing methods.

Images