Information processing program, information processing method and information processing apparatus

Abstract

To enable verifying a workflow.SOLUTION: An information processing apparatus 100 generates a function f(-) that includes confidential information s as a segment. The information processing apparatus 100 generates a random number r1 that is added to received data D1 and a random number r2 that is added to received data D2. The information processing apparatus 100 calculates an output value f(D1+r1) of the function f(-) depending on an input value D1+r1 that is obtained by adding the random number r1 to data D1, and calculates an output value f(D2+r2) of the function f(-) depending on an input value D2+r2 that is obtained by adding the random number r2 to data D2. The information processing apparatus 100 generates a hash value of data, in which a hash value of data combined between each of generated random numbers and each of calculated output values is combined with the confidential information, as data corresponding to an OR requirement 110. The information processing apparatus 100 generates a hash chain 102 for a data string that includes data corresponding to the OR requirement 110 and that fits in with a workflow 101.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing program, an information processing method, and an information processing device. [Background technology]

[0002] Conventionally, there is a technology called hash chain, which calculates a hash value of the data obtained by combining the first data of a data string with an initial value, and then calculates hash values ​​of the data obtained by combining the second and subsequent data of the data string with the hash value calculated immediately before. According to hash chain, a hash value that makes it possible to verify the data order of the data string can be calculated at the end. It is conceivable to use hash chain for the purpose of verifying a workflow. A workflow represents, for example, the flow of a business in which multiple approvers approve a document.

[0003] Prior art includes, for example, a technique that generates a hash node that records a hash value created for each event information that occurs and the event information, and generates a hash chain that links them in the order of generation. Another technique includes, for example, a technique that uses the simplex hash values ​​of the event information to be inserted and the primary adjacent data to calculate a continuity hash value that makes it possible to verify the continuity between the event information and the primary adjacent data. Another technique includes, for example, a technique that manages data related to construction work using a hash chain. Another technique includes, for example, a technique that converts sequentially occurring operation data into a hash chain. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2006-343790 A [Patent Document 2] JP 2009-128956 A [Patent Document 3] JP 2020-202442 A [Patent Document 4] US Patent Application Publication No. 2016 / 0344737 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the conventional technology, there are cases where a workflow including a part in which the order in which approvers give approval does not matter can be made verifiable by the hash chain. For example, if a workflow includes a part that indicates that among a first number of approvers, any second number of approvers approves a document regardless of the order in which the approvers give approval, the workflow cannot be made verifiable by the hash chain.

[0006] In one aspect, the present invention aims to make workflows verifiable. [Means for solving the problem]

[0007] According to one embodiment, an information processing program, an information processing method, and an information processing device are proposed that generate a function including secret information based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second or more users among a first number of users in accordance with a secret sharing technique, and when data of each of the second or more users among the first number of users is accepted, calculate an output value of the generated function according to an input value obtained by adding a random number to the accepted data of each of the second or more users, and form a hash chain for a data sequence that follows the workflow, including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the accepted data of each of the second or more users and the calculated output value. Effect of the Invention

[0008] According to one aspect, workflows can be made verifiable. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of an information processing method according to an embodiment. [Diagram 2] FIG. 2 is an explanatory diagram illustrating an example of an information processing system 200. As shown in FIG. [Diagram 3] FIG. 3 is a block diagram showing an example of a hardware configuration of the information processing device 100. As shown in FIG. [Figure 4] FIG. 4 is a block diagram showing an example of the hardware configuration of the verification side device 201. As shown in FIG. [Diagram 5] FIG. 5 is a block diagram showing an example of a functional configuration of the information processing system 200. As shown in FIG. [Figure 6] FIG. 6 is an explanatory diagram (part 1) showing the flow of operations of the information processing system 200. [Figure 7] FIG. 7 is a diagram (part 2) illustrating the flow of operations of the information processing system 200. [Figure 8] FIG. 8 is a diagram illustrating an example of forming a hash chain 810 for a workflow 800 that includes an AND requirement. [Figure 9] FIG. 9 is an explanatory diagram (part 1) showing an example of preparing secret information and a function. [Figure 10] FIG. 10 is an explanatory diagram (part 2) showing an example of preparing secret information and a function. [Figure 11] FIG. 11 is an explanatory diagram (part 3) showing an example of preparing secret information and a function. [Figure 12] FIG. 12 is an explanatory diagram (part 4) showing an example of preparing secret information and a function. [Figure 13] FIG. 13 is a diagram illustrating an example of forming a hash chain 1310 for a workflow 1300 that includes an OR requirement. [Figure 14] FIG. 14 is an explanatory diagram showing an example of the effect. [Figure 15] FIG. 15 is a flowchart illustrating an example of a procedure of the first generation process. [Figure 16] FIG. 16 is a flowchart illustrating an example of a procedure of the first verification process. [Figure 17] FIG. 17 is a flowchart illustrating an example of a procedure of the second generation process. [Figure 18] FIG. 18 is a flowchart illustrating an example of a procedure of the second verification process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of an information processing program, an information processing method, and an information processing device according to the present invention will be described in detail with reference to the drawings.

[0011] (An example of an information processing method according to an embodiment) 1 is an explanatory diagram showing an example of an information processing method according to an embodiment. An information processing device 100 is a computer for making a workflow verifiable. The information processing device 100 is, for example, a server or a PC (Personal Computer).

[0012] A workflow represents the flow of business operations. For example, a workflow represents the flow of business operations in which multiple approvers approve documents or images. In the following explanation, a workflow representing n approvers X1, X2, ..., Xn approving in order may be expressed as "X1 → X2 → ... → Xn."

[0013] Here, it is conceivable to use the hash chain for the purpose of verifying a workflow. For example, in the past, it was possible to verify whether the data order of a data sequence held by a verifier is an appropriate order that follows a formal workflow, based on the final hash value of a hash chain for a data sequence that follows a formal workflow. This makes it possible to verify whether the workflow represented by a data sequence held by the verifier is a formal workflow. In the following description, the data order may be expressed as "D(X1) → D(X2) → ... → D(Xn)". D(Xi) represents the data of approver Xi.

[0014] Specifically, a workflow may represent the approval of a document by each of three approvers in a prescribed order. In this case, a management server that manages a formal workflow calculates the final hash value of a hash chain for a data sequence in which data representing the approval of each of the three approvers is arranged in the prescribed order of the formal workflow, and provides the calculated value to a verifier.

[0015] Meanwhile, the verifier accepts data representing the approval of each of the three approvers. The verifier calculates a final hash value of a hash chain for a data sequence in which the data representing the approval of each of the three approvers is arranged in the order in which it was accepted. If the verifier determines that the provided final hash value matches the calculated final hash value, it determines that the acceptance order is an appropriate order in accordance with a formal workflow, and that the target workflow represented by the acceptance order is a formal workflow.

[0016] Here, it may be desirable to use a hash chain to make it possible to verify a workflow including a portion that does not matter in which order approvers give their approval. For example, a workflow may be considered in which one requirement is that all of a first number of approvers give their approval, regardless of the order in which the approvers give their approval. The first number is, for example, an integer equal to or greater than 2. For example, a workflow may be considered in which one requirement is that all of a second or more approvers out of the first number of approvers give their approval, regardless of the combination of approvers and regardless of the order in which the approvers give their approval. The second number is, for example, an integer equal to or greater than 1.

[0017] In the following explanation, a requirement that indicates that all the first approvers approve, regardless of the order in which they approve, may be written as an "AND requirement." In the following explanation, an AND requirement that indicates that n approvers Y1, Y2, ..., Yn approve, regardless of the order, may be written as "Y1 AND Y2 AND ... AND Yn."

[0018] In the following explanation, a requirement that indicates that all of the second or more approvers out of the first number of approvers approve, regardless of the combination of approvers or the order in which they approve, may be written as an "OR requirement." In the following explanation, an OR requirement that indicates that any k approvers out of n approvers Z1, Z2, ..., Zn approve, regardless of the order, may be written as "k people out of Z1, Z2, ..., Zn."

[0019] However, in the past, there were cases where a hash chain could not be used to verify a workflow including a part in which the order in which the approver approves does not matter. For example, it was not possible to verify whether the data order of a data string held by a verifier is an appropriate order in accordance with a formal workflow, and it was not possible to determine whether the target workflow represented by the data order is a formal workflow. For example, in the past, a hash chain could only express a unique data order of a data string. For this reason, there is a problem in that a hash chain cannot be used to verify a workflow including a part in which the order in which the approver approves does not matter.

[0020] In response to this, a method 1 can be considered in which a formal workflow is added to the final hash value of the hash chain and provided to the verifier. For example, a formal workflow 1 including an AND requirement, “A→{B1 AND B2 AND B3}→C”, can be considered. Workflow 1 includes “A→B1→B2→B3→C” and “A→B3→B2→B1→C”, etc. Therefore, data orders such as “D(A)→D(B1)→D(B2)→D(B3)→D(C)” and “D(A)→D(B3)→D(B2)→D(B1)→D(C)” are appropriate orders according to workflow 1.

[0021] In method 1, the hash chain can still only express a unique data order of a data string. Therefore, the management server can only calculate the final hash value of the hash chain based on, for example, any one of the workflows "A → B1 → B2 → B3 → C" included in workflow 1, and provide it to the verifier by attaching workflow 1. The final hash value guarantees that only the data order "D(A) → D(B1) → D(B2) → D(B3) → D(C)" is an appropriate order according to workflow 1. In this case, even if the verifier refers to workflow 1, he or she cannot verify whether a data order such as "D(A) → D(B3) → D(B2) → D(B1) → D(C)" is an appropriate order according to workflow 1 based on the provided final hash value.

[0022] Also, for example, workflow 2 "A → {two of B1, B2, B3} → C" including OR requirements is conceivable. Workflow 2 includes "A → B1 → B2 → B3 → C", "A → B1 → B2 → C", and "A → B3 → B1 → C". Therefore, data orders such as "D(A) → D(B1) → D(B2) → D(B3) → D(C)", "D(A) → D(B1) → D(B2) → D(C)", and "D(A) → D(B3) → D(B1) → D(C)" are appropriate orders according to workflow 2.

[0023] In method 1, the hash chain can still only express a unique data order of a data string. Therefore, the management server can only calculate the final hash value of the hash chain based on, for example, any one of the workflows "A→B1→B2→B3→C" included in workflow 2, and provide it to the verifier by attaching workflow 2. The final hash value guarantees that only the data order "D(A)→D(B1)→D(B2)→D(B3)→D(C)" is an appropriate order according to workflow 2. In this case, even if the verifier refers to workflow 1, he or she cannot verify whether a data order such as "D(A)→D(B1)→D(B2)→D(C)" is an appropriate order according to workflow 1 based on the provided final hash value.

[0024] Furthermore, in method 1, the hash chain does not include information about AND or OR requirements. Therefore, if the workflow provided to the verifier is tampered with, the verifier may erroneously determine whether the data order of the data string that the verifier possesses is an appropriate order according to the official workflow. For example, even if the workflow provided to the verifier is tampered with from "A→{B1 AND B2}→C" to "A→B1→B2→C," the verifier cannot detect that the provided workflow has been tampered with.

[0025] In addition, the management server may obtain a data string according to a workflow by forwarding an approval request including the current data string, the final hash value of the current hash chain for the current data string, and a workflow to each of multiple approvers. In this case, the approver verifies the workflow in response to the approval request, adds his / her own data to the current data string, and then returns the approval request to the management server.

[0026] In this case, if the workflow of the approval request to be forwarded is tampered with, the approver may mistakenly determine whether the data order of the current data sequence of the approval request to be forwarded is the appropriate order according to the official workflow. Even if the workflow of the approval request to be forwarded is tampered with from "A → {2 people out of B1, B2, B3} → C" to "A → {1 person out of B1, B2} → C", the approver cannot detect that the workflow of the approval request to be forwarded has been tampered with. Therefore, the approver may add his / her own data to the current data sequence and send the approval request back to the management server.

[0027] Meanwhile, method 2 can be considered, which uses a group signature that meets the OR requirement to form a hash chain. A group signature indicates, for example, that one of the members of a group has signed. Method 2 cannot handle the OR requirement that indicates approval by two or more approvers. Method 2 has the problem that the certification authority must guarantee which group the group verification key corresponds to.

[0028] In this embodiment, therefore, an information processing method that can make a workflow verifiable appropriately will be described. Specifically, according to this embodiment, regardless of the combination of approvers and regardless of the order in which the approvers approve, a workflow including an OR requirement that indicates that all of any second or more approvers among a first number of approvers approves can be made verifiable appropriately.

[0029] 1, an information processing device 100 acquires a workflow 101. The workflow 101 includes one or more requirements. The workflow 101 includes, as one requirement, accepting data of each of a second or more users among a first number of users. The user is, for example, an approver who approves a document, an image, or the like. The workflow 101 includes, for example, an OR requirement 110.

[0030] The OR requirement 110 is, for example, {k people among X1, X2, ..., Xn}. n corresponds to a first number. k corresponds to a second number. In the example of FIG. 1, n=4. In the example of FIG. 1, k=2. In the example of FIG. 1, the workflow 101 includes, for example, the OR requirement 110 {2 people among X1, X2, X3, Xn}. The workflow 101 may include another requirement 121 before the OR requirement 110. The workflow 101 may include another requirement 122 after the OR requirement 110.

[0031] (1-1) The information processing device 100 generates a function including secret information based on the first number and the second number in the workflow 101 according to a secret sharing technique. The function has a shape that can be specified based on the coordinates of any of the second numbers among the coordinates of the first number in the coordinate space, for example.

[0032] The function includes the secret information as information that can be uniquely identified when the shape of the function is determined, for example. Specifically, the function includes the secret information as an intercept. Specifically, the function may include the secret information as something other than an intercept. Specifically, the function may include the secret information as a minimum value.

[0033] 1, the information processing device 100 specifically generates a function f(·) including the secret information s as an intercept so that the shape of the function can be specified if any k=2 or more coordinates among n=4 coordinates are identified. In this way, the information processing device 100 can prepare a function that can generate information that can express the OR requirement 110.

[0034] (1-2) The information processing device 100 accepts data of each of the second or more users among the first number of users. When the information processing device 100 accepts the data of each of the second or more users, it generates a random number to be added to the accepted data of each of the second or more users. The information processing device 100 calculates an output value of the generated function according to an input value obtained by adding the generated random number to the accepted data of each of the second or more users.

[0035] In the example of FIG. 1, the information processing device 100 receives data D1 of user X1 and data D2 of user X2. In the example of FIG. 1, the information processing device 100 generates a random number r1 to be added to the data D1 and a random number r2 to be added to the data D2. In the example of FIG. 1, the information processing device 100 calculates an output value f(D1+r1) of the function f(·) according to an input value D1+r1 obtained by adding the random number r1 to the data D1. The information processing device 100 calculates an output value f(D2+r2) of the function f(·) according to an input value D2+r2 obtained by adding the random number r2 to the data D2. In this way, the information processing device 100 can prepare information that enables the OR requirement 110 to be expressed.

[0036] (1-3) The information processing device 100 generates data corresponding to the OR requirement 110 by combining the secret information with a hash value of data obtained by combining the random number added to the data of each of the received second or more users and the calculated output value. The information processing device 100 forms a hash chain 102 for a data string along the workflow 101, including the generated data corresponding to the OR requirement 110. The data corresponding to the OR requirement 110 is, for example, a hash value of data obtained by combining the secret information with a hash value of data obtained by combining each of the random numbers and each of the output values.

[0037] In the example of FIG. 1, the information processing device 100 generates data f(D1+r1)||r1||f(D2+r2)||r2 by combining each of the generated random numbers with each of the calculated output values. The information processing device 100 calculates a hash value H(f(D1+r1)||r1||f(D2+r2)||r2) of the generated data. The information processing device 100 generates data s||H(f(D1+r1)||r1||f(D2+r2)||r2) by combining the calculated hash value with secret information. The information processing device 100 generates the hash value H(s||H(f(D1+r1)||r1||f(D2+r2)||r2)) of the generated data as data corresponding to the OR requirement 110.

[0038] The information processing device 100 generates a data string according to the workflow 101, including data corresponding to the OR requirement 110. The data string includes, for example, data corresponding to each requirement of the workflow 101. The data string includes, for example, before the data corresponding to the OR requirement 110, data corresponding to another requirement 121 existing before the OR requirement 110. The data string includes, for example, after the data corresponding to the OR requirement 110, data corresponding to another requirement 122 existing after the OR requirement 110. The information processing device 100 forms a hash chain 102 for the generated data string.

[0039] The hash chain 102 has an initial value. The hash chain 102 represents the calculation of a hash value of data obtained by combining the first data with the initial value. The hash chain 102 represents the calculation of hash values ​​of data obtained by combining the second and subsequent data with the hash value calculated immediately before. In the example of FIG. 1, the hash chain 102 represents the calculation of a hash value of data obtained by combining at least data corresponding to the OR requirement 110 with the initial value or the hash value calculated immediately before. This allows the information processing device 100 to calculate the final hash value of the hash chain 102 that enables the workflow 101 to be properly verified.

[0040] (1-4) The information processing device 100 assigns combinations of the generated random numbers and the calculated output values ​​to pairs of the initial value of the hash chain 102 and the final hash value of the hash chain 102, and outputs them together with the workflow 101. The output destination is, for example, the verification side. This enables the information processing device 100 to properly verify the workflow 101 on the verification side.

[0041] The information processing device 100 can, for example, appropriately verify a workflow 101 that includes an OR requirement representing that all of a second or more number of approvers out of a first number of approvers approve, regardless of the combination of approvers or the order in which the approvers approve.

[0042] The information processing device 100 can include information on the OR requirement in the hash chain 102. Therefore, when the output workflow 101 is tampered with, the information processing device 100 can make it easier for the verification side to detect that the output workflow 101 has been tampered with. For example, when the OR requirement 110 of the workflow 101 is tampered with, the information processing device 100 can make the secret information s unrecoverable on the verification side. Therefore, the information processing device 100 can make it possible for the verification side to detect that the workflow 101 has been tampered with.

[0043] Here, for convenience of explanation, a case has been described in which the information processing device 100 forms the hash chain 102 for a data string including all the data corresponding to each requirement of the workflow 101, but this is not limiting. For example, a hash chain may be formed sequentially while collecting data corresponding to each requirement of the workflow 101.

[0044] Here, a case has been described in which the information processing device 100 generates a hash value of data obtained by combining each of the generated random numbers and each of the calculated output values ​​with secret information as data corresponding to the OR requirement 110, but this is not limiting. For example, the information processing device 100 may generate data obtained by combining a hash value of data obtained by combining each of the generated random numbers and each of the calculated output values ​​with secret information as data corresponding to the OR requirement 110.

[0045] Here, the case where the functions of the information processing device 100 are realized by a single computer has been described, but the present invention is not limited to this. For example, the functions of the information processing device 100 may be realized by a plurality of computers. Specifically, the functions of the information processing device 100 may be realized on the cloud.

[0046] (An example of the information processing system 200) Next, an example of an information processing system 200 to which the information processing device 100 shown in FIG. 1 is applied will be described with reference to FIG.

[0047] 2 is an explanatory diagram showing an example of an information processing system 200. In FIG. 2, the information processing system 200 includes the information processing device 100, a verification side device 201, a creation side device 202, and an approval side device 203.

[0048] In the information processing system 200, the information processing device 100 and the verification side device 201 are connected via a wired or wireless network 210. The network 210 is, for example, a local area network (LAN), a wide area network (WAN), or the Internet.

[0049] In the information processing system 200, the information processing device 100 and the creation side device 202 are connected via a wired or wireless network 210. In the information processing system 200, the information processing device 100 and the approval side device 203 are connected via a wired or wireless network 210.

[0050] The information processing device 100 is a computer for forming a hash chain. A user of the information processing device 100 is, for example, an administrator. The information processing device 100 receives a workflow from a creation side device 202. The workflow represents a series of requirements corresponding to the flow of business. A requirement is that an approver approves a document or an image, etc. A requirement is, for example, that one approver approves. A requirement may be, for example, an AND requirement or an OR requirement.

[0051] When a workflow includes an OR requirement indicating that any k approvers out of n approvers approve the workflow, the information processing device 100 generates secret information s and a function f with the secret information s as an intercept according to a (k,n)-secret sharing technique. The function f is a k-1-th degree function. The information processing device 100 stores the generated secret information s and the generated function f in association with the identifier of the workflow. This allows the information processing device 100 to obtain a guideline for detecting that the workflow has been tampered with.

[0052] The information processing device 100 generates an initial value of the hash chain. The information processing device 100 transmits an approval request to the approval side device 203 of each of one or more approvers who first request approval of a document, image, etc., based on a workflow. The approval request includes, for example, a current state list in which data representing approval is arranged, an initial value and a final hash value of the current state hash chain for the current state list, and a workflow. The current state list is empty in the initial state. The final hash value of the current state hash chain is empty in the initial state. For example, after transmitting the approval request, the information processing device 100 does not need to store the workflow.

[0053] The information processing device 100 receives the approval request with the updated current list from the approval side device 203. The information processing device 100 updates the final hash value of the current hash chain for the current list of the approval request according to the current list of the approval request. For example, when data corresponding to an OR requirement is added to the current list, the information processing device 100 updates the final hash value of the current hash chain of the approval request based on the generated function f. The information processing device 100 determines whether or not there are one or more approvers who will be requested to approve a document, image, etc. next based on the workflow of the approval request. When the information processing device 100 determines that there are one or more approvers who will be requested to approve a document, image, etc. next, it forwards the approval request to the approval side device 203 of each of the one or more approvers.

[0054] When the information processing device 100 determines that there are no more approvers who will next request approval of a document, image, etc., the information processing device 100 acquires a current list of approval requests, an initial value and a final hash value of the current hash chain, and a workflow. The information processing device 100 generates workflow information including the current list, the initial value and the final hash value of the current hash chain, and the workflow, and transmits it to the verification side device 201. The information processing device 100 is, for example, a server or a PC.

[0055] The verification side device 201 is a computer for verifying a workflow. A user of the verification side device 201 is, for example, a verifier. The verification side device 201 receives workflow information from the information processing device 100. Based on the workflow information, the verification side device 201 acquires a current status list, an initial value and a final hash value of the current status hash chain, and a workflow.

[0056] The verification side device 201 forms a comparison hash chain corresponding to the acquired current list based on the initial value of the acquired current hash chain according to the workflow, and calculates the final hash value of the comparison hash chain. The verification side device 201 determines whether the final hash value of the acquired current hash chain matches the calculated final hash value of the comparison hash chain.

[0057] If the verification side device 201 determines that there is a match, it determines that the data order of the acquired current status list is an appropriate order according to the acquired workflow and that the acquired workflow has not been tampered with.If the verification side device 201 determines that there is no match, it determines that the data order of the acquired current status list is not an appropriate order according to the acquired workflow or that the acquired workflow has been tampered with.

[0058] The verification side device 201 outputs the judgment result so that the verifier can refer to it. This enables the verification side device 201 to verify the workflow. The verification side device 201 can enable the verifier to know that an attack on the workflow has occurred. The verification side device 201 can improve security. The verification side device 201 is, for example, a PC, a tablet terminal, or a smartphone.

[0059] The creation side device 202 is a computer for creating a workflow. A user of the creation side device 202 is, for example, a creator. The creation side device 202 creates a workflow based on an operational input by the creator, and transmits the workflow to the information processing device 100. The creation side device 202 is, for example, a PC, a tablet terminal, or a smartphone.

[0060] The approval side device 203 is a computer for approving documents, images, etc. A user of the approval side device 203 is, for example, an approver. The approval side device 203 receives an approval request from the information processing device 100. Based on the received approval request, the approval side device 203 acquires a current status list, an initial value and a final hash value of the current hash chain, and a current workflow.

[0061] The approval side device 203 forms a comparison hash chain corresponding to the acquired current list based on the initial value of the acquired current hash chain according to the current workflow, and calculates the final hash value of the comparison hash chain. The approval side device 203 judges whether the final hash value of the acquired current hash chain matches the final hash value of the calculated comparison hash chain.

[0062] If the approval side device 203 determines that they match, it determines that the data order of the acquired current status list is an appropriate order according to the acquired current status workflow, and that the acquired current status workflow has not been tampered with.If the approval side device 203 determines that they do not match, it determines that the data order of the acquired current status list is not an appropriate order according to the acquired current status workflow, or that the acquired current status workflow has been tampered with.

[0063] The approval side device 203 outputs the judged result so that the approver can refer to it. This allows the approval side device 203 to verify the current workflow. The approval side device 203 allows the approver to know that there has been an attack on the current workflow. The approval side device 203 can improve security in the approver's approval action.

[0064] In response to the approval request, the approval side device 203 adds data representing the approval of the approver to a list of current status of approval requests based on an operation input by the approver. The approval side device 203 returns the approval request to the information processing device 100. The approval side device 203 is, for example, a PC, a tablet terminal, or a smartphone.

[0065] Here, the case where the information processing device 100 is a computer different from the verification side device 201 has been described, but is not limited to this. For example, the information processing device 100 may have a function as the verification side device 201 and operate as the verification side device 201. Here, the case where the information processing device 100 is a computer different from the creation side device 202 has been described, but is not limited to this. For example, the information processing device 100 may have a function as the creation side device 202 and operate as the creation side device 202. Here, the case where the information processing device 100 is a computer different from the approval side device 203 has been described, but is not limited to this. For example, the information processing device 100 may have a function as the approval side device 203 and operate as the approval side device 203.

[0066] Here, the case where the verification side device 201 is a computer different from the creation side device 202 has been described, but is not limited to this. For example, the verification side device 201 may have the function of the creation side device 202 and operate as the creation side device 202. Here, the case where the verification side device 201 is a computer different from the approval side device 203 has been described, but is not limited to this. For example, the verification side device 201 may have the function of the approval side device 203 and operate as the approval side device 203. Here, the case where the creation side device 202 is a computer different from the approval side device 203 has been described, but is not limited to this. For example, the creation side device 202 may have the function of the approval side device 203 and operate as the approval side device 203.

[0067] (Example of hardware configuration of information processing device 100) Next, an example of the hardware configuration of the information processing device 100 will be described with reference to FIG.

[0068] Fig. 3 is a block diagram showing an example of a hardware configuration of the information processing device 100. In Fig. 3, the information processing device 100 has a CPU (Central Processing Unit) 301, a memory 302, a network I / F (Interface) 303, a recording medium I / F 304, and a recording medium 305. In addition, each component is connected to each other via a bus 300.

[0069] Here, the CPU 301 is responsible for the overall control of the information processing device 100. The memory 302 has, for example, a read only memory (ROM), a random access memory (RAM), and a flash ROM. Specifically, for example, the flash ROM and the ROM store various programs, and the RAM is used as a work area for the CPU 301. The programs stored in the memory 302 are loaded into the CPU 301, causing the CPU 301 to execute the coded processes.

[0070] The network I / F 303 is connected to the network 210 through a communication line, and is connected to other computers via the network 210. The network I / F 303 manages an internal interface with the network 210, and controls input and output of data from other computers. The network I / F 303 is, for example, a modem or a LAN adapter.

[0071] The recording medium I / F 304 controls reading / writing data from / to the recording medium 305 under the control of the CPU 301. The recording medium I / F 304 is, for example, a disk drive, a solid state drive (SSD), a universal serial bus (USB) port, etc. The recording medium 305 is a non-volatile memory that stores data written under the control of the recording medium I / F 304. The recording medium 305 is, for example, a disk, a semiconductor memory, a USB memory, etc. The recording medium 305 may be detachable from the information processing device 100.

[0072] In addition to the above-mentioned components, the information processing device 100 may have, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, etc. Furthermore, the information processing device 100 may have a plurality of recording medium I / Fs 304 and recording media 305. Furthermore, the information processing device 100 may not have the recording medium I / Fs 304 and the recording media 305.

[0073] (Example of Hardware Configuration of Verification Side Device 201) Next, an example of the hardware configuration of the verification side device 201 included in the information processing system 200 shown in FIG. 2 will be described with reference to FIG.

[0074] Fig. 4 is a block diagram showing an example of the hardware configuration of the verification side device 201. In Fig. 4, the verification side device 201 has a CPU 401, a memory 402, a network I / F 403, a recording medium I / F 404, a recording medium 405, a display 406, and an input device 407. In addition, each component is connected to each other by a bus 400.

[0075] Here, the CPU 401 is responsible for the overall control of the verification side device 201. The memory 402 has, for example, a ROM, a RAM, and a flash ROM. Specifically, for example, the flash ROM and the ROM store various programs, and the RAM is used as a work area for the CPU 401. The programs stored in the memory 402 are loaded into the CPU 401, causing the CPU 401 to execute the coded processes.

[0076] The network I / F 403 is connected to the network 210 through a communication line, and is connected to other computers via the network 210. The network I / F 403 manages an internal interface with the network 210, and controls input and output of data from other computers. The network I / F 403 is, for example, a modem or a LAN adapter.

[0077] The recording medium I / F 404 controls reading / writing data from / to the recording medium 405 under the control of the CPU 401. The recording medium I / F 404 is, for example, a disk drive, an SSD, a USB port, etc. The recording medium 405 is a non-volatile memory that stores data written under the control of the recording medium I / F 404. The recording medium 405 is, for example, a disk, a semiconductor memory, a USB memory, etc. The recording medium 405 may be detachable from the verification side device 201.

[0078] The display 406 displays data such as a cursor, an icon, a tool box, documents, images, and function information. The display 406 is, for example, a CRT (Cathode Ray Tube), a liquid crystal display, or an organic EL (Electroluminescence) display. The input device 407 has keys for inputting characters, numbers, various instructions, and the like, and inputs data. The input device 407 may be a keyboard, a mouse, or a touch panel input pad or numeric keypad.

[0079] The verification side device 201 may have, for example, a printer, a scanner, a microphone, a speaker, etc., in addition to the above-mentioned components. The verification side device 201 may have a plurality of recording medium I / Fs 404 and recording media 405. The verification side device 201 may not have the recording medium I / Fs 404 and recording media 405.

[0080] (Example of Hardware Configuration of Production Side Device 202) A specific example of the hardware configuration of the creation side device 202 included in the information processing system 200 shown in FIG. 2 is similar to the example of the hardware configuration of the verification side device 201 shown in FIG. 4, and therefore a description thereof will be omitted.

[0081] (Example of Hardware Configuration of Approval Side Device 203) A hardware configuration example of the approval side apparatus 203 included in the information processing system 200 shown in FIG. 2 is specifically similar to the hardware configuration example of the verification side apparatus 201 shown in FIG. 4, so a description thereof will be omitted.

[0082] (Example of Functional Configuration of Information Processing System 200) Next, an example of a functional configuration of the information processing system 200 will be described with reference to FIG.

[0083] 5 is a block diagram showing an example of a functional configuration of the information processing system 200. The information processing device 100 includes a first storage unit 500, a first acquisition unit 501, a generation unit 502, a calculation unit 503, a first formation unit 504, and a first output unit 505.

[0084] The first storage unit 500 is realized by, for example, a storage area such as the memory 302 or the recording medium 305 shown in Fig. 3. In the following, a case where the first storage unit 500 is included in the information processing device 100 will be described, but this is not limiting. For example, the first storage unit 500 may be included in a device different from the information processing device 100, and the stored contents of the first storage unit 500 may be accessible from the information processing device 100.

[0085] The first acquisition unit 501 to the first output unit 505 function as an example of a control unit. Specifically, the first acquisition unit 501 to the first output unit 505 realize their functions by, for example, causing the CPU 301 to execute a program stored in a storage area such as the memory 302 or the recording medium 305 shown in Fig. 3, or by the network I / F 303. The processing results of each functional unit are stored in, for example, a storage area such as the memory 302 or the recording medium 305 shown in Fig. 3.

[0086] The first storage unit 500 stores various information that is referred to or updated in the processing of each functional unit. The first storage unit 500 stores, for example, a workflow. A workflow represents a series of requirements corresponding to a business flow. A requirement is, for example, accepting user data.

[0087] The user is, for example, a user. The user data is, for example, data representing the user's approval. The requirement is, in particular, that the user approves a document or an image, etc. The user data is, in particular, a digital signature. The user data may in particular be a hash value of the digital signature.

[0088] The requirement, for example, is to accept data from one user, and indicates approval by the one user. In the following description, the requirement to accept data from one user may be referred to as an "individual requirement". The requirement may be, for example, an AND requirement or an OR requirement. The OR requirement, for example, is to accept data from each of any second or more users among the first number of users, and indicates approval by each of any second or more users among the first number of users. The AND requirement, for example, is to accept data from each of a third number of users, and indicates approval by each of a plurality of users. The workflow is acquired, for example, by the first acquisition unit 501.

[0089] The first acquisition unit 501 acquires various information used in the processing of each functional unit. The first acquisition unit 501 stores the acquired various information in the first storage unit 500 or outputs it to each functional unit. The first acquisition unit 501 may also output the various information stored in the first storage unit 500 to each functional unit. The first acquisition unit 501 acquires various information based on, for example, an operation input by an administrator. The first acquisition unit 501 may receive various information from, for example, a device different from the information processing device 100.

[0090] The first acquisition unit 501 acquires, for example, a workflow. Specifically, the first acquisition unit 501 acquires the workflow by receiving it from another computer. The other computer is, for example, the creation side device 202. Specifically, the first acquisition unit 501 may acquire the workflow by accepting an input of the workflow based on an operation input by an administrator.

[0091] The first acquisition unit 501, for example, acquires user data corresponding to each of a series of requirements of a workflow. Specifically, the first acquisition unit 501 acquires the user data by receiving the user data from another computer. The other computer is, for example, the approval side device 203. Specifically, the first acquisition unit 501 may acquire the user data by accepting input of the user data based on an operation input by an administrator.

[0092] More specifically, the first acquisition unit 501 acquires data of a second or more users among the first number of users corresponding to the OR requirement. More specifically, the first acquisition unit 501 acquires data of a third number of users corresponding to the AND requirement. More specifically, the first acquisition unit 501 acquires data of one user corresponding to the individual requirement.

[0093] The first acquisition unit 501 may receive a start trigger for starting processing of any one of the functional units. The start trigger may be, for example, a predetermined operational input by an administrator. The start trigger may be, for example, reception of predetermined information from another computer. The start trigger may be, for example, output of predetermined information by any one of the functional units.

[0094] Specifically, the first acquisition unit 501 accepts the acquisition of a workflow as a start trigger for starting processing by the generation unit 502. Specifically, the first acquisition unit 501 accepts the acquisition of user data as a start trigger for starting processing by the calculation unit 503 and the first formation unit 504.

[0095] The generating unit 502 generates a function including secret information based on the first number and the second number in the workflow according to a secret sharing technique. For example, when the workflow includes an OR requirement, the generating unit 502 generates a function including secret information based on the first number and the second number in the workflow according to a secret sharing technique. Specifically, the generating unit 502 generates a function with the secret information as an intercept, which has a shape that can be specified based on the coordinates of any of the second numbers among the coordinates of the first number in the coordinate space according to the secret sharing technique. This allows the generating unit 502 to prepare a function that can generate information that can express the OR requirement.

[0096] When the second number is 1, the generating unit 502 generates a function including secret information so as to pass through coordinates represented by a predetermined input value and a predetermined output value corresponding to the predetermined input value. The predetermined input value is set in advance, for example, by an administrator. The predetermined output value is set in advance, for example, by an administrator. In this way, the generating unit 502 can prepare a function that enables generation of information that enables expression of an OR requirement even when the second number is 1.

[0097] When first acquisition unit 501 receives data of each of the second or more users among the first number of users, calculation unit 503 generates a random number corresponding to each of the received data of the second or more users. Calculation unit 503 calculates an output value of the function generated by generation unit 502 according to an input value obtained by adding the generated random number to the data of each of the second or more users. In this way, calculation unit 503 can generate information that makes it possible to express an OR requirement.

[0098] The first formation unit 504 generates data corresponding to the OR requirement by combining a secret information with a hash value of data obtained by combining a random number added to the data of each of the received second or more users and the calculated output value. The first formation unit 504 generates, for example, a hash value of data obtained by combining each of the random numbers generated by the calculation unit 503 and each of the output values ​​calculated by the calculation unit 503 with the secret information as data corresponding to the OR requirement. In this way, the first formation unit 504 can express the OR requirement.

[0099] The first formation unit 504 generates data corresponding to the OR requirement by combining a secret information with a hash value of data obtained by combining a random number added to the data of each of the received second or more users, the calculated output value, a predetermined input value, and a predetermined output value. The first formation unit 504 generates a hash value of data obtained by combining, for example, each of the random numbers generated by the calculation unit 503, each of the output values ​​calculated by the calculation unit 503, a predetermined input value, and a predetermined output value with the secret information. In this way, the first formation unit 504 can express the OR requirement even if the second number is 1.

[0100] When an AND requirement is included in a workflow and data for each of the third number of users is received by the first acquisition unit 501, the first formation unit 504 generates data corresponding to the AND requirement obtained by combining the received data for each of the third number of users. For example, the first formation unit 504 generates a hash value of the data obtained by combining the received data for each of the third number of users as data corresponding to the AND requirement. In this way, the first formation unit 504 can express the AND requirement.

[0101] The first forming unit 504 forms a hash chain for a data string along the workflow including the generated data. The first forming unit 504 generates a data string in which, for example, data corresponding to the individual requirements acquired by the first acquiring unit 501, data corresponding to the generated OR requirements, or data corresponding to the generated AND requirements are arranged along the workflow.

[0102] The first formation unit 504 generates, for example, an initial value of a hash chain. The first formation unit 504 forms a hash chain for the generated data string based on, for example, the generated initial value. The first formation unit 504 calculates, for example, a final hash value of the formed hash chain. In this way, the first formation unit 504 can obtain a final hash value that enables the workflow to be verified.

[0103] The first output unit 505 outputs the processing result of at least one of the functional units. The output format is, for example, display on a display, printout on a printer, transmission to an external device via the network I / F 303, or storage in a storage area such as the memory 302 or the recording medium 305. This allows the first output unit 505 to notify the administrator of the processing result of at least one of the functional units, thereby improving the convenience of the information processing device 100.

[0104] The first output unit 505 identifies a pair of the initial value of the hash chain generated by the first formation unit 504 and the final hash value of the hash chain calculated by the first formation unit 504. The first output unit 505 outputs output information in which a combination of each of the random numbers generated by the calculation unit 503 and each of the output values ​​calculated by the calculation unit 503 is added to the identified pair.

[0105] The output information may include, for example, a workflow. The output information may include, for example, a list of user data acquired by the first acquisition unit 501. Specifically, the first output unit 505 transmits the output information to the verification side device 201. Thereby, the first output unit 505 can make it possible to externally verify the validity of the data string and the validity of the workflow.

[0106] The first output unit 505 identifies a pair of the initial value of the hash chain generated by the first formation unit 504 and the final hash value of the hash chain calculated by the first formation unit 504. The first output unit 505 outputs output information to the identified pair, in which each of the random numbers generated by the calculation unit 503, each of the output values ​​calculated by the calculation unit 503, and a combination of a predetermined input value and a predetermined output value are assigned to each of the identified pairs.

[0107] The output information may include, for example, a workflow. The output information may include, for example, a list of user data acquired by the first acquisition unit 501. Specifically, the first output unit 505 transmits the output information to the verification side device 201. Thereby, the first output unit 505 can make it possible to externally verify the validity of the data string and the validity of the workflow.

[0108] The verification side apparatus 201 includes a second storage unit 510 , a second acquisition unit 511 , a restoration unit 512 , a second formation unit 513 , a determination unit 514 , and a second output unit 515 .

[0109] The second storage unit 510 is realized by, for example, a storage area such as the memory 402 or the recording medium 405 shown in Fig. 3. In the following, a case where the second storage unit 510 is included in the verification side device 201 will be described, but this is not limiting. For example, the second storage unit 510 may be included in a device different from the verification side device 201, and the storage contents of the second storage unit 510 may be referable from the verification side device 201.

[0110] The second acquisition unit 511 to the second output unit 515 function as an example of a control unit. Specifically, the second acquisition unit 511 to the second output unit 515 realize their functions by, for example, causing the CPU 401 to execute a program stored in a storage area such as the memory 402 or the recording medium 405 shown in Fig. 3, or by the network I / F 403. The processing result of each functional unit is stored in, for example, a storage area such as the memory 402 or the recording medium 405 shown in Fig. 3.

[0111] The second storage unit 510 stores various information that is referred to or updated in the processing of each functional unit. The second storage unit 510 stores, for example, a target workflow to be determined as true or false. The target workflow represents a series of requirements corresponding to the flow of business. The requirement is, for example, accepting user data. The requirement is, for example, an individual requirement. The requirement may be, for example, an AND requirement or an OR requirement. The OR requirement is, for example, accepting data of each of any fifth or more users out of a fourth number of users. The AND requirement is, for example, accepting data of each of a sixth number of users. The target workflow is acquired, for example, by the second acquisition unit 511.

[0112] The second storage unit 510 stores, for example, data of users. The second storage unit 510 specifically stores data of any of a fifth number of users among a fourth number of users corresponding to the OR requirement. The second storage unit 510 specifically stores data of a sixth number of users corresponding to the AND requirement. The second storage unit 510 specifically stores data of one user corresponding to an individual requirement. The user data is acquired by, for example, the second acquisition unit 511.

[0113] The second acquisition unit 511 acquires various information used in the processing of each functional unit. The second acquisition unit 511 stores the acquired various information in the second storage unit 510 or outputs it to each functional unit. The second acquisition unit 511 may also output the various information stored in the second storage unit 510 to each functional unit. The second acquisition unit 511 acquires various information based on, for example, an operation input by the verifier. The second acquisition unit 511 may receive various information from, for example, a device different from the verification side device 201.

[0114] The second acquisition unit 511 acquires a target workflow to be determined as true or false. The second acquisition unit 511 acquires, for example, output information output by the first output unit 505, and acquires a workflow included in the acquired output information as the target workflow.

[0115] The second acquisition unit 511 acquires data of users corresponding to each of a series of requirements in the acquired target workflow. For example, the second acquisition unit 511 acquires output information output by the first output unit 505, and acquires data of each of the multiple users recorded in a list of the acquired output information.

[0116] Specifically, the second acquisition unit 511 acquires data of any of the fifth or more users among the fourth number of users corresponding to the OR requirement based on the list. Specifically, the second acquisition unit 511 acquires data of a sixth number of users corresponding to the AND requirement based on the list. Specifically, the second acquisition unit 511 acquires data of one user corresponding to the individual requirement based on the list.

[0117] The second acquisition unit 511 acquires candidate data to be a combination of an output value of a true function including first secret information generated according to a secret sharing technique according to an input value obtained by adding a random number to data of each of the acquired fifth or more users, and the random number. The second acquisition unit 511 acquires, for example, the output information output by the first output unit 505, and acquires combinations of each random number of the acquired output information and each output value as candidate data.

[0118] The second acquisition unit 511 acquires a candidate pair that is a pair of an initial value of a true hash chain for a data string along the true workflow and a final hash value of the true hash chain. The second acquisition unit 511 acquires, for example, the output information output by the first output unit 505, and acquires a pair of the initial value of the acquired output information and the final hash value as a candidate pair.

[0119] The second acquisition unit 511 may acquire a predetermined input value and a predetermined output value corresponding to the predetermined input value. For example, the second acquisition unit 511 acquires output information output by the first output unit 505, and acquires the predetermined input value of the acquired output information and the predetermined output value corresponding to the predetermined input value.

[0120] The second acquisition unit 511 may receive a start trigger for starting processing of any one of the functional units. The start trigger may be, for example, a predetermined operational input by the verifier. The start trigger may be, for example, reception of predetermined information from another computer. The start trigger may be, for example, output of predetermined information by any one of the functional units.

[0121] The second acquisition unit 511 accepts, for example, the acquisition of the target workflow, the list of user data, the candidate data, and the candidate pairs as a start trigger for starting processing by the restoration unit 512, the second formation unit 513, and the judgment unit 514.

[0122] The restoration unit 512 restores the second secret information according to a secret sharing technique when the target workflow includes an OR requirement and the data of each of the five or more users is accepted by the second acquisition unit 511. The restoration unit 512 restores the second secret information based on, for example, the data of each of the five or more users and the acquired candidate data.

[0123] As a result, the restoration unit 512 can restore appropriate second secret information that matches the first secret information when the data of each of the five or more users and the candidate data are authentic. When the data of any of the five or more users is not authentic or when the candidate data is not authentic, the restoration unit 512 can make the second secret information not match the first secret information, and can obtain a guideline for verifying the target workflow.

[0124] For example, when the fifth number is 1, the restoration unit 512 restores the second secret information based on the data of each of the users equal to or greater than the fifth number, the candidate data acquired by the second acquisition unit 511, a specified input value, and a specified output value.

[0125] As a result, the restoration unit 512 can restore appropriate second secret information that matches the first secret information when the data of each of the five or more users and the candidate data are authentic. When the data of any of the five or more users is not authentic or when the candidate data is not authentic, the restoration unit 512 can make the second secret information not match the first secret information, and can obtain a guideline for verifying the target workflow.

[0126] When the target workflow includes an OR requirement, the second formation unit 513 generates data corresponding to the OR requirement, which is obtained by combining a hash value of data obtained by combining each of the acquired candidate data with the restored second secret information. For example, the second formation unit 513 generates a hash value of data obtained by combining a hash value of data obtained by combining each of the acquired candidate data with the restored second secret information as data corresponding to the OR requirement. In this way, the second formation unit 513 can express the OR requirement.

[0127] When the fifth number is 1, the second formation unit 513 generates data corresponding to the OR requirement, which is obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data with a predetermined input value and a predetermined output value. When the fifth number is 1, the second formation unit 513 generates data corresponding to the OR requirement, which is a hash value of data obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data with a predetermined input value and a predetermined output value. In this way, the second formation unit 513 can express the OR requirement.

[0128] When the target workflow includes an AND requirement and data of each of the sixth number of users is received by the second acquisition unit 511, the second formation unit 513 generates data corresponding to the AND requirement obtained by combining the received data of each of the sixth number of users. For example, the second formation unit 513 generates a hash value of the data obtained by combining the received data of each of the sixth number of users as data corresponding to the AND requirement. This allows the second formation unit 513 to express the AND requirement.

[0129] The second forming unit 513 forms a target hash chain for a data sequence along the target workflow including the generated data. The second forming unit 513 generates a data sequence in which, for example, data corresponding to the individual requirements acquired by the second acquiring unit 511, data corresponding to the generated OR requirements, or data corresponding to the generated AND requirements are arranged along the target workflow.

[0130] The second forming unit 513 forms a target hash chain for the generated data sequence based on, for example, the initial value represented by the acquired candidate pair. The forming unit calculates a final hash value of the formed target hash chain based on, for example, the initial value represented by the acquired candidate pair. In this way, the forming unit can obtain the final hash value of the target hash chain that enables verification of the target workflow.

[0131] The determination unit 514 determines whether the final hash value of the true hash chain represented by the acquired candidate pair matches the calculated final hash value of the target hash chain. If the determination unit 514 determines that they match, it determines that the target workflow is true, and determines that the data order of the data of each of the multiple users recorded in the list is valid.

[0132] On the other hand, if the determination unit 514 determines that there is no match, it determines that the target workflow is false or that the data order of the data of each of the multiple users recorded in the list is incorrect. This enables the determination unit 514 to verify the target workflow and to verify the data order of the data of each of the multiple users recorded in the list.

[0133] The second output unit 515 outputs the processing result of at least one of the functional units. The output format is, for example, display on a display, printout on a printer, transmission to an external device via the network I / F 403, or storage in a storage area such as the memory 402 or the recording medium 405. This allows the second output unit 515 to notify the verifier of the processing result of at least one of the functional units, thereby improving the convenience of the information processing device 100.

[0134] The second output unit 515 outputs, for example, the result determined by the determination unit 514 so that the verifier can refer to it. In this way, the second output unit 515 can make it possible for the verifier to refer to, for example, the result of verifying the target workflow and the result of verifying the data order of the data of each of the multiple users recorded in the list.

[0135] (Operation flow of information processing system 200) Next, the flow of operations of the information processing system 200 will be described with reference to FIGS.

[0136] 6 and 7 are explanatory diagrams showing the flow of operations of the information processing system 200. In FIG. 6, the creation side device 202 creates a workflow based on operational input by the creator. The workflow represents a series of requirements corresponding to the flow of business. The requirement is to accept data representing the approval of the approver. The data is, for example, a hash value of an electronic signature. The requirement is, for example, an individual requirement, an AND requirement, or an OR requirement. The creation side device 202 transmits the workflow to the information processing device 100. The information processing device 100 receives the workflow from the creation side device 202.

[0137] The information processing device 100 includes a hash chain calculation unit 610. The hash chain calculation unit 610 generates an initial value of a hash chain in association with an identifier of a workflow. The hash chain calculation unit 610 identifies one or more approvers who request initial approval based on the workflow. The hash chain calculation unit 610 transmits an approval request 601 including a workflow to which a list for registering data and an initial value and a final hash value of the hash chain are attached to the approval side device 203 corresponding to each of the identified one or more approvers. The list is empty in the initial state. The final hash value is empty in the initial state.

[0138] When the approval side device 203 receives the approval request 601, it judges whether the approval request 601 is valid or not based on the list and the initial value and final hash value of the hash chain. For example, when the list is empty and the final hash value is empty, the approval side device 203 judges that the approval request 601 is valid. If the approval request 601 is valid, the approval side device 203 returns the approval request 601 in which data representing the approval of the approver is added to the list based on the operation input of the approver to the hash chain calculation unit 610.

[0139] When the hash chain calculation unit 610 receives the approval request 601, it calculates a final hash value of the hash chain based on the initial value of the hash chain and the list included in the approval request 601, and assigns it to the approval request 601. When the hash chain calculation unit 610 receives the approval request 601, it identifies one or more approvers who will be requested to approve next, according to the workflow included in the approval request 601. The hash chain calculation unit 610 transmits the latest approval request 601 to the approval side device 203 corresponding to each of the identified one or more approvers.

[0140] When the approval side device 203 receives the approval request 601, it judges whether the approval request 601 is valid or not based on the list and the initial value and final hash value of the hash chain. For example, the approval side device 203 calculates a final hash value based on the list and the initial value of the hash chain, and judges whether the calculated final hash value matches the final hash value included in the approval request 601. For example, if they match, the approval side device 203 judges that the approval request 601 is valid, and if they do not match, it judges that the approval request 601 is invalid. If the approval request 601 is valid, the approval side device 203 returns the approval request 601 in which data representing the approval of the approver is added to the list based on the approver's operation input to the hash chain calculation unit 610.

[0141] When the hash chain calculation unit 610 receives an approval request 601, if there are no one or more approvers who are to next request approval and cannot be identified, the hash chain calculation unit 610 transmits the latest approval request 601 to the verification side device 201 as workflow information 602.

[0142] The verification side device 201 has a hash chain verification unit 620. When the hash chain verification unit 620 receives the workflow information 602, it judges whether or not the combination of the list and the workflow is valid based on the list and the initial value and final hash value of the hash chain. For example, the hash chain verification unit 620 calculates a final hash value based on the list and the initial value of the hash chain, and judges whether or not the calculated final hash value matches the final hash value included in the workflow information 602. If they match, the hash chain verification unit 620 judges that the combination of the list and the workflow is valid, and if they do not match, it judges that the combination of the list and the workflow is invalid. The verification side device 201 outputs the result of judging whether or not the combination of the list and the workflow is valid so that the verifier can refer to it.

[0143] Next, moving on to the explanation of FIG. 7, a case where a workflow includes an OR requirement will be described. In FIG. 7, the hash chain calculation unit 610 includes a secret sharing generation unit 710. The secret sharing generation unit 710 includes a function generation unit 711. The creation side device 202 creates a workflow based on an operational input by the creator. In the example of FIG. 7, the workflow includes an OR requirement {two of approvers A, B, and C}. The creation side device 202 transmits the workflow to the information processing device 100. The information processing device 100 receives the workflow from the creation side device 202.

[0144] When a workflow includes an OR requirement of {k approvers out of n approvers}, the function generating unit 711 generates secret information s and a function f based on n and k, and stores them in association with the identifier of the workflow. In the example of FIG. 7, n=3. Also, k=2. The function f has a shape that can be specified based on k or more coordinates. The hash chain calculating unit 610 generates an initial value of the hash chain in association with the identifier of the workflow.

[0145] The hash chain calculation unit 610 sequentially identifies one or more approvers who request approval according to the workflow, as in Fig. 6. When the hash chain calculation unit 610 identifies n approvers who request approval for the OR requirement, it transmits an approval request 601 to the approval side device 203 corresponding to each of the n approvers. When the approval request 601 is received, the approval side device 203 judges whether the approval request 601 is valid or not based on the list and the initial value and final hash value of the hash chain. If the approval request 601 is valid, the approval side device 203 returns the approval request 601 in which data representing the approver's approval is added to the list based on the approver's operation input to the hash chain calculation unit 610.

[0146] The hash chain calculation unit 610 waits until it receives approval requests 601 from the approval side devices 203 corresponding to k or more approvers among n approvers requesting approval for the OR requirement. The hash chain calculation unit 610 integrates the approval requests 601 received from the approval side devices 203 corresponding to the k or more approvers, and combines the lists. The hash chain calculation unit 610 calculates the final hash value of the hash chain based on the initial value of the hash chain and the combined list, and assigns it to the integrated approval request 601.

[0147] In the example of FIG. 7, the hash chain calculation unit 610 receives approval requests 601 from the approval side devices 203 corresponding to the approvers A and C, respectively, for the OR requirement {two of approvers A, B, and C}. The hash chain calculation unit 610 integrates the approval requests 601 received from the approval side devices 203 corresponding to the approvers A and C, respectively, and combines the lists. The list is the data of approver A, A And approver C's data h C Specifically, the hash chain calculation unit 610 calculates the data h A ,h C The corresponding random number r A ,r C Generate a function f and data h A ,h CBased on this, f(h A +r A ),f(h C +r C ) is calculated.

[0148] Specifically, the hash chain calculation unit 610 calculates r A ,r C ,f(h A +r A ),f(h C +r C ) and the secret information s are combined to generate a hash value of the data corresponding to the OR requirement {two of approvers A, B, and C}. A ,r C ,f(h A +r A ),f(h C +r C ) is added to the integrated approval request 601 as additional information.

[0149] Specifically, the hash chain calculation unit 610 calculates a final hash value of the hash chain based on data corresponding to the generated OR requirement {two of approvers A, B, C}, and assigns it to the integrated approval request 601. More specifically, the hash chain calculation unit 610 determines whether or not a previously calculated final hash value exists. More specifically, if a previously calculated final hash value exists, the hash chain calculation unit 610 calculates a hash value of data obtained by combining the previously calculated final hash value and data corresponding to the generated OR requirement {two of approvers A, B, C}, as the latest final hash value.

[0150] More specifically, if there is no such request, the hash chain calculation unit 610 calculates a hash value of data obtained by combining the initial value of the hash chain and data corresponding to the generated OR requirement {two of approvers A, B, and C} as the latest final hash value. The hash chain calculation unit 610 identifies one or more approvers who will be requested to approve next according to the workflow included in the integrated approval request 601. The hash chain calculation unit 610 transmits the integrated approval request 601 to the approval side device 203 corresponding to each of the identified one or more approvers.

[0151] When the approval side device 203 receives the approval request 601, it judges whether the approval request 601 is valid or not based on the list and the initial value and final hash value of the hash chain. For example, when an OR requirement is included in the workflow, the approval side device 203 calculates the final hash value based on the OR requirement, the list, and the initial value of the hash chain.

[0152] Specifically, the approval side device 203 receives the list and the additional information r A ,r C ,f(h A +r A ),f(h C +r C Specifically, the approval side device 203 restores the secret information s based on the additional information r A ,r C ,f(h A +r A ),f(h C +r C ) and the restored secret information s, and generates a hash value of the data corresponding to the OR requirement. Specifically, the approval side device 203 forms a hash chain based on the list, the initial value of the hash chain, and the generated data corresponding to the OR requirement, and calculates a final hash value.

[0153] The approval side device 203, for example, judges whether the calculated final hash value matches the final hash value included in the approval request 601. If they match, the approval side device 203 judges that the approval request 601 is legitimate, and if they do not match, the approval request 601 is judged to be invalid. If the approval request 601 is legitimate, the approval side device 203 returns the approval request 601 in which data representing the approver's approval has been added to the list based on the approver's operation input to the hash chain calculation unit 610.

[0154] The hash chain verification unit 620 includes a restoration unit 720. When the hash chain verification unit 620 receives the workflow information 602, the hash chain verification unit 620 determines whether or not a combination of the list and the workflow is valid based on the list, and the initial value and final hash value of the hash chain. For example, when the workflow includes an OR requirement, the hash chain verification unit 620 calculates a final hash value based on the list and the initial value of the hash chain based on the OR requirement.

[0155] Specifically, the restoration unit 720 restores h A ,h C and r for additional information A ,r C ,f(h A +r A ),f(h C +r C Specifically, the hash chain verification unit 620 recovers the secret information s based on the additional information r A ,r C ,f(h A +r A ),f(h C +r C ) and the restored secret information s, and generates a hash value of the data that corresponds to the OR requirement. Specifically, the hash chain verification unit 620 forms a hash chain based on the list, the initial value of the hash chain, and the generated data that corresponds to the OR requirement, and calculates a final hash value.

[0156] The hash chain verification unit 620, for example, determines whether the calculated final hash value matches the final hash value included in the workflow information 602. If they match, the hash chain verification unit 620 determines that the combination of the list and the workflow is valid, and if they do not match, the hash chain verification unit 620 determines that the combination of the list and the workflow is invalid. The verification side device 201 outputs the result of determining whether the combination of the list and the workflow is valid so that the verifier can refer to it.

[0157] (An example of the operation of the information processing device 100) Next, an example of the operation of the information processing device 100 will be described with reference to Fig. 8 to Fig. 14. First, for example, a case where the information processing device 100 receives a workflow including an AND requirement will be described with reference to Fig. 8. Specifically, an example where the information processing device 100 forms a hash chain 810 for a workflow 800 including an AND requirement will be described with reference to Fig. 8.

[0158] Fig. 8 is an explanatory diagram showing an example of forming a hash chain 810 for a workflow 800 including an AND requirement. In the example of Fig. 8, the workflow 800 represents an individual requirement 801, an AND requirement 802, and an individual requirement 803, which are arranged in this order.

[0159] The individual requirement 801 is data h representing the approval of the approver A. A This indicates that the data h A is a hash value of the digital signature. AND requirement 802 is a set of n approvers B1, B2, ..., B n Data representing each approval B1 ,h B2 ,…,h Bn The individual requirement 803 includes data h representing the approval of the approver C. C This indicates that the request is accepted.

[0160] The information processing device 100 generates an initial value r for the hash chain 810. AThe information processing device 100 receives the data h A is set as data corresponding to the individual requirement 801. The information processing device 100 sets the data h A When you accept r and h A Combined with r||h A The hash value H(r||h A ) is calculated.

[0161] The information processing device 100 stores data h B1 ,h B2 ,…,h Bn The information processing device 100 receives B1 ,h B2 ,…,h Bn The combined data h B1 ||h B2 ||…||h Bn The hash value H(h B1 ||h B2 ||…||h Bn ) is calculated. The information processing device 100 calculates H(h B1 ||h B2 ||…||h Bn ) is set as data corresponding to the AND requirement 802. A ) and H(h B1 ||h B2 ||…||h Bn ) and H(r||h A )||H(h B1 ||h B2 ||…||h Bn ) hash value H(H(r||h A )||H(h B1 ||h B2 ||…||h Bn ) is calculated.

[0162] The information processing device 100 stores data h C The information processing device 100 receives the data h C is set as data corresponding to the individual requirement 803. The information processing device 100 sets the data h C When accepting, H(H(r||h A )||H(h B1 ||hB2 ||…||h Bn )) and h C The information processing device 100 combines the combined H(H(r||h A )||H(h B1 ||h B2 ||…||h Bn ))||h A The hash value H(H(H(r||h A )||H(h B1 ||h B2 ||…||h Bn ))||h A ) is calculated.

[0163] The information processing device 100 calculates H(H(H(r||h A )||H(h B1 ||h B2 ||…||h Bn ))||h A ) is set as the final hash value l. A ,h B1 ,h B2 ,…,h Bn ,h C , the initial value r, the final hash value l, and workflow information including the workflow 800 to the verification side device 201.

[0164] This enables the information processing device 100 to express the AND requirement in the hash chain 810. The information processing device 100 can reflect the AND requirement in the final hash value of the hash chain 810.

[0165] The information processing device 100, for example, in the verification side device 201, B1 ,h B2 ,…,h Bn The information processing device 100 can appropriately verify the AND requirement regardless of the data order. A ,h B1 ,h B2 ,…,h Bn ,h CThis makes it possible to accurately determine whether or not a combination of the list and the workflow 800 is valid.

[0166] Next, a case where the information processing device 100 receives a workflow including an OR requirement will be described with reference to Figs. 9 to 13. For example, when the information processing device 100 receives a workflow including an OR requirement, the information processing device 100 prepares secret information and a function according to a secret sharing technique. Specifically, an example of preparing secret information and a function will be described with reference to Figs. 9 to 12.

[0167] 9 to 12 are explanatory diagrams showing an example of preparing secret information and functions. First, moving to the explanation of FIG. 9, a secret sharing method will be explained. As shown in FIG. 9, the secret sharing method is specifically a method in which n shares [s] are i k shares of [s] i Let us divide the secret s into n shares [s] so that the secret s can be recovered based on i The secret sharing technique distributes secret information s and a function f to a plurality of secret information s and a plurality of secret information s. The information processing device 100 utilizes a secret sharing technique to express an OR requirement. For example, the information processing device 100 prepares secret information s and a function f according to the secret sharing technique to express an OR requirement. Next, the description will move to FIG. 10 to explain an example of the function f.

[0168] FIG. 10 shows an example of a function f generated according to Shamir's secret sharing method. The function f corresponds to, for example, a curve 1001 in a coordinate space 1000. The intercept of the function f indicates the secret information s. The coordinates on the function f indicate the share [s]. i The function f is a k-1 degree function with the secret information s as an intercept. Specifically, f=a (k-1) x (k-1) +a (k-2) x (k-2) +...+a1x+s. Share [s] i =(x i ,f(x i )). The generator of the function f is called a dealer. For example, the dealer is the information processing device 100.

[0169] Next, we move on to the explanation of FIG. 11 and explain how the information processing device 100 uses the function f to express an OR requirement. Here, let us consider a workflow A→{B1, B2, ..., B n}→C. The information processing device 100 randomly generates secret information s and a coefficient a (k-1) , ..., a2, a1. The information processing device 100 determines s, a (k-1) ,…,a2,a1, then generate a function f.

[0170] In the following explanation, random numbers r1, r2, …, r n But B1, B2, …, B n Each data B1 ,h B2 ,…,h Bn It is used as a random number to be added to the data h B1 ,h B2 ,…,h Bn Each is given random numbers r1, r2, …, r n The value obtained by adding is the input value of the function f (h B1 +r1),(h B2 +r2),…,(h Bn +r n ) is used as a combination of each input value and the output value of the function f according to the input value (h B1 +r1,f(h B1 +r1)),(h B2 +r2,f(h B2 +r2)),…,(h Bn +r n ,f(h Bn +r n )) has a share[s] i The information processing device 100 uses k or more shares [s] in the verification device 201. i When the secret information s is obtained, it becomes possible to recover the secret information s.

[0171] The information processing device 100 stores data h A Get the data h B1 ,h B2 ,…,h Bn k pieces of data h B1,h B2 ,…,h Bk Get the data h C Assume that the information processing device 100 acquires data h B1 ,h B2 ,…,h Bk Random numbers r1, r2, …, r to be added to n The information processing device 100 generates data h B1 ,h B2 ,…,h Bk Random numbers r1, r2, …, r n The input value of the function f according to the input value added with h B1 +r1),(h B2 +r2),…,(h Bk +r k ) is calculated.

[0172] The information processing device 100 calculates H(s||r1||r2||...||r k ||f(h B1 +r1)||f(h B2 +r2)||…||f(h Bn +r k )) is used as data representing an OR requirement. A and data corresponding to OR requirements and data h C A hash chain is formed for the data string in which the above and the following are arranged in order, and the final hash value l is calculated.

[0173] The information processing device 100 receives a workflow, an initial value r of a hash chain, a final hash value l, and received data h A ,h B1 ,h B2 ,…,h Bk ,h C The information processing device 100 generates workflow information to be provided to the providing device, which includes a list of B1, B2, ..., B k The corresponding random numbers r1, r2, …, r k and the output value f(h B1 +r1),f(h B2 +r2),…,f(h Bk +r k) is added to the workflow information. The information processing device 100 transmits the workflow information to the verification side device 201.

[0174] The verification side device 201 verifies the data of the list based on the workflow information. B1 ,h B2 ,…,h Bk The verification side device 201 acquires the data h from among the additional information based on the workflow information. B1 ,h B2 ,…,h Bk The corresponding random numbers r1, r2, …, r k and the output value f(h B1 +r1),f(h B2 +r2),…,f(h Bk +r k The verification side device 201 obtains the data h B1 ,h B2 ,…,h Bk And random numbers r1, r2, …, r k and the output value f(h B1 +r1),f(h B2 +r2),…,f(h Bk +r k ) and based on k shares [s] i Restore.

[0175] The verification device 201 recovers the k shares [s] i Based on this, the verification side device 201 restores the secret information s. B1 ,h B2 ,…,h Bn Even if not all of them exist, it is possible to recover the secret information s and gather the information used to calculate the final hash value of the hash chain.

[0176] Based on the restored private information s, the verification side device 201 calculates H(s||r1||r2||...||r k ||f(h B1 +r1)||f(h B2 +r2)||…||f(h Bk +r kThe verification side device 201 generates data h representing the OR requirement. A and data corresponding to OR requirements and data h C A hash chain is formed for the data string in which the above are arranged in order, and the final hash value l' is calculated.

[0177] The verification side device 201 judges whether or not the final hash value l=the final hash value l'. If the final hash value l=the final hash value l', the verification side device 201 judges that the combination of the list and the workflow is valid. On the other hand, if the final hash value l=the final hash value l' is not true, the verification side device 201 judges that the combination of the list and the workflow is invalid. This enables the verification side device 201 to verify the combination of the list and the workflow.

[0178] If either the list or the workflow is tampered with, the verification side device 201 i Therefore, when either the list or the workflow is tampered with, the verification side device 201 can determine that the combination of the list and the workflow is invalid, thereby improving security. i By using the data B1 ,h B2 ,…,h Bk Even if the same data exists in the secret information s, the verification side device 201 can restore the secret information s.

[0179] In the example of FIG. 11, the workflow is {A→{three of B1, B2, B3, and B4}→C}. The information processing device 100 randomly determines the secret information s and the coefficients a2 and a1. The information processing device 100 calculates a function f=a2x based on s, a2, and a1. 2 +a1x+s. The function f corresponds to, for example, a curve 1101 in a coordinate space 1100.

[0180] The information processing device 100 stores data h A Get the data h B1 ,h B2 ,…,h B4 3 of the data B1 ,h B2 ,h B3 Get the data h C Assume that the information processing device 100 acquires data h B1 ,h B2 ,h B3 The information processing device 100 generates random numbers r1, r2, and r3 to be added to the data h B1 ,h B2 ,h B3 The output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3).

[0181] The information processing device 100 calculates H(s||f(h B1 +r1)||r1||f(h B2 +r2)||r2||f(h B3 +r3)||r3) is used as data representing an OR requirement. A and data corresponding to OR requirements and data h C A hash chain is formed for the data string in which the above and the following are arranged in order, and the final hash value l is calculated.

[0182] The information processing device 100 receives a workflow, an initial value r of a hash chain, a final hash value l, and received data h A ,h B1 ,h B2 ,h B3 ,h C The information processing device 100 generates workflow information to be provided to the providing device, including a list of random numbers r1, r2, and r3 and an output value f(h B1 +r1),f(h B2 +r2),f(h B3+r3) to the workflow information. The information processing device 100 transmits the workflow information to the verification side device 201.

[0183] The verification side device 201 verifies the data of the list based on the workflow information. B1 ,h B2 ,h B3 The verification side device 201 acquires the data h from among the additional information based on the workflow information. B1 ,h B2 ,h B3 The corresponding random numbers r1, r2, and r3 and the output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3). The verification side device 201 obtains the data h B1 ,h B2 ,h B3 And the random numbers r1, r2, r3 and the output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3) and based on 3 shares [s] i Restore.

[0184] The verification device 201 recovers the three shares [s] i Based on this, the verification side device 201 restores the secret information s. B1 ,h B2 ,…,h B4 Even if not all of them exist, it is possible to recover the secret information s and gather the information used to calculate the final hash value of the hash chain.

[0185] The verification side device 201 calculates H(s||f(h B1 +r1)||r1||f(h B2 +r2)||r2||f(h B3 +r3)||r3) as data representing an OR requirement. A and data corresponding to OR requirements and data h CA hash chain is formed for the data string in which the above are arranged in order, and the final hash value l' is calculated.

[0186] The verification side device 201 judges whether or not the final hash value l=the final hash value l'. If the final hash value l=the final hash value l', the verification side device 201 judges that the combination of the list and the workflow is valid. On the other hand, if the final hash value l=the final hash value l' is not true, the verification side device 201 judges that the combination of the list and the workflow is invalid. This enables the verification side device 201 to verify the combination of the list and the workflow.

[0187] Here, the information processing device 100 stores data h A Obtain three pieces of data h B1 ,h B2 ,h B3 Get the data h C In the above description, the hash chain is formed after the data is acquired, but the present invention is not limited to this. For example, the information processing device 100 may re-form the hash chain every time the data is acquired.

[0188] Here, the information processing device 100 stores data h B1 ,h B2 ,…,h B4 Of these, data h B1 ,h B2 ,h B3 Although the case where the information processing device 100 acquires data h B1 ,h B2 ,…,h B4 Of these, data h B1 ,h B2 ,h B4 For example, the information processing device 100 may acquire data h B1 ,h B2 ,…,h B4 Of these, data h B2 ,h B3 ,h B4 may be obtained.

[0189] Next, moving to the description of FIG. 12, an example in which the information processing device 100 generates a function f when k=1 will be described. In the example of FIG. 12, it is assumed that the workflow is {A→{one of B1, B2, B3, B4}→C} and k=1. Here, if the information processing device 100 sets the function f=s based on k=1, the secret information s becomes reconstructable based on the additional information. The function f=s corresponds to a straight line 1201 in the coordinate space 1200.

[0190] For this reason, the information processing device 100 prepares a dummy point (x, f(x)). The information processing device 100 randomly determines secret information s and a coefficient a1. The information processing device 100 generates a function f=a1x+s that passes through the dummy point based on s and a1. The function f=a1x+s corresponds to, for example, a straight line 1211 in the coordinate space 1210. The information processing device 100 further adds the dummy point (x, f(x)) to the workflow information as additional information. The information processing device 100 transmits the workflow information to the verification side device 201.

[0191] The verification side device 201 acquires the data of the list based on the workflow information. The verification side device 201 acquires random numbers and output values ​​corresponding to each data of the list from among the additional information based on the workflow information. The verification side device 201 calculates a share [s] based on each data of the list, each acquired random number, and each acquired output value. i Restore.

[0192] The verification side device 201 recovers the share [s] i and the dummy point (x, f(x)), the confidential information s is restored. In this way, even when k=1, the verification side device 201 can properly restore the confidential information s, and can prepare information to be used when calculating the final hash value of the hash chain.

[0193] Here, it is possible that the additional information may be tampered with. As described above, the information processing device 100 can add a hash value of the additional information to data corresponding to the OR requirement. This allows the information processing device 100 to appropriately determine whether or not a combination of a list and a workflow is valid, even if the additional information is tampered with.

[0194] Next, an example in which the information processing device 100 forms a hash chain 1310 for a workflow 1300 including an OR requirement will be described with reference to FIG.

[0195] Fig. 13 is an explanatory diagram showing an example of forming a hash chain 1310 for a workflow 1300 including an OR requirement. In the example of Fig. 13, the workflow 1300 represents an individual requirement 1301, an OR requirement 1302, and an individual requirement 1303 arranged in this order.

[0196] The individual requirement 1301 is data h representing the approval of the approver A. A This indicates that the data h A is a hash value of an electronic signature. In the example of FIG. 13, the OR requirement 1302 indicates that data representing the approval of k or more of four approvers B1, B2, ..., B4 is to be accepted. Here, k=3. The individual requirement 1303 indicates that data h representing the approval of approver C is to be accepted. C The information processing device 100 generates an initial value r of the hash chain 1310 in advance.

[0197] The information processing device 100 stores data h A The information processing device 100 receives the data h A is set as data corresponding to the individual requirement 1301. The information processing device 100 sets the data h A When you accept r and h A Combined with r||h A The hash value H(r||h A ) is calculated as the provisional final hash value.

[0198] The information processing device 100 processes data h of B1, B2, ..., B4. B1 ,h B2 ,h B3 The information processing device 100 receives the received data h B1 ,h B2 ,h B3 The information processing device 100 generates random numbers r1, r2, and r3 to be added to the data h B1 ,h B2 ,h B3 The random numbers r1, r2, and r3 are added to each other and used as the input value of the function f (h B1 +r1),(h B2 +r2),(h B3 +r3).

[0199] The information processing device 100 receives an input value (h B1 +r1),(h B2 +r2),(h B3 +r3) The output value f(h B1 +r1),f(h B2 +r2),f(h B3 The information processing device 100 calculates a combination (h B1 +r1,f(h B1 +r1)),(h B2 +r2,f(h B2 +r2)),(h B3 +r3,f(h B3 +r3)) to share [s] i Use as.

[0200] The information processing device 100 calculates H(s||f(h B1 +r1)||r1||f(h B2 +r2)||r2||f(h B3 +r3)||r3) is used as data representing the OR requirement 1302. The information processing device 100 combines the provisional final hash value calculated immediately before with the data representing the OR requirement 1302. The information processing device 100 uses the hash value H(H(r||h A )||H(s||f(h B1 +r1)||r1||f(hB2 +r2)||r2||f(h B3 +r3)||r3)) is calculated as the provisional final hash value.

[0201] The information processing device 100 stores data h C The information processing device 100 receives the data h C is set as data corresponding to the individual requirement 1303. The information processing device 100 sets the data h C When receiving, the temporary final hash value calculated just before and h C The information processing device 100 combines the hash value H(H(H(r||h A )||H(s||f(h B1 +r1)||r1||f(h B2 +r2)||r2||f(h B3 +r3)||r3))||h C ) is calculated as the final hash value l.

[0202] The information processing device 100 receives a workflow, an initial value r of a hash chain, a final hash value l, and received data h A ,h B1 ,h B2 ,h B3 ,h C The information processing device 100 generates workflow information to be provided to the providing device, including a list of random numbers r1, r2, and r3 and an output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3) to the workflow information. When k=1, the information processing device 100 further adds a dummy point to the workflow information as additional information. The information processing device 100 transmits the workflow information to the verification side device 201.

[0203] The verification side device 201 verifies the data of the list based on the workflow information. B1 ,h B2 ,h B3 The verification side device 201 acquires the data h from among the additional information based on the workflow information.B1 ,h B2 ,h B3 The corresponding random numbers r1, r2, and r3 and the output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3). The verification side device 201 obtains the data h B1 ,h B2 ,h B3 And the random numbers r1, r2, r3 and the output value f(h B1 +r1),f(h B2 +r2),f(h B3 +r3) and based on 3 shares [s] i Restore.

[0204] The verification device 201 recovers the three shares [s] i Based on this, the verification side device 201 restores the secret information s. B1 ,h B2 ,…,h B4 Even if not all of them exist, it is possible to recover the secret information s and gather the information used to calculate the final hash value of the hash chain.

[0205] The verification side device 201 calculates H(s||f(h B1 +r1)||r1||f(h B2 +r2)||r2||f(h B3 +r3)||r3) as data representing an OR requirement. A and data corresponding to OR requirements and data h C A hash chain is formed for the data string in which the above are arranged in order, and the final hash value l' is calculated.

[0206] The verification side device 201 judges whether or not the final hash value l=the final hash value l'. If the final hash value l=the final hash value l', the verification side device 201 judges that the combination of the list and the workflow is valid. On the other hand, if the final hash value l=the final hash value l' is not true, the verification side device 201 judges that the combination of the list and the workflow is invalid. This enables the verification side device 201 to verify the combination of the list and the workflow.

[0207] Next, an example of an effect achieved by the information processing device 100 will be described with reference to FIG.

[0208] Fig. 14 is an explanatory diagram showing an example of the effect. In Fig. 14, the workflow is {A → {Group 1400 = 3 people among B1, B2, B3, B4, B5} → C}. Here, for example, if only approvers B1 and B5 approve, it is preferable that the workflow is rejected.

[0209] However, in a conventional management server, if the workflow is tampered with to {A → {group 1411 = two of B1, B3, B5} → C} while the approval request is being forwarded, the approval request may be forwarded to the approval side device 203 of approver C. Group 1411 is a group obtained by removing group 1412 from group 1400.

[0210] Furthermore, in the conventional management server, if the workflow is tampered with to {{group 1420=3 members of A, B1, B2, B3, B4, B5}→C} while the approval request is being forwarded, the approval request may be forwarded to the approval side device 203 of approver C. Therefore, the conventional management server cannot prevent the verification side device 201 from erroneously determining that the tampered workflow is a legitimate workflow.

[0211] In response to this, the information processing device 100 first calculates a function f=a2x 2+a1x+s. Therefore, the information processing device 100 can approve only the approvers B1 and B5 and generate the data h B1 ,h B5 If only the secret information s is acquired, even if data expressing an OR requirement is generated, the approval side device 203 or the verification side device 201 can leave the secret information s unrecoverable.

[0212] Therefore, even if the workflow is tampered with from {A to {two of B1, B3, B5} to C}, the information processing device 100 can enable the approval side device 203 or the verification side device 201 to detect that the workflow is not legitimate. The approval side device 203 or the verification side device 201 attempts to restore the incorrect function f=a1x+s according to the tampered workflow from {A to {two of B1, B3, B5} to C}, and is therefore unable to restore the secret information s.

[0213] Furthermore, the information processing device 100 can enable the approval side device 203 or the verification side device 201 to detect that the workflow is not legitimate even if the workflow is tampered with to {{three of A, B1, B2, B3, B4, B5} → C}. The approval side device 203 or the verification side device 201 can detect that the workflow is not legitimate based on the absence of additional information regarding the approver A, contrary to the tampered workflow {{three of A, B1, B2, B3, B4, B5} → C}. Furthermore, the approval side device 203 or the verification side device 201 can detect that the workflow is not legitimate even if the additional information regarding the approver A is forged, because the secret information s cannot be correctly restored.

[0214] In this way, the information processing device 100 can form a hash chain corresponding to a workflow including an AND requirement and an OR requirement. The information processing device 100 can include information on an AND requirement or an OR requirement in the hash chain. Therefore, the information processing device 100 can make it possible for the approval side device 203 or the verification side device 201 to verify that a workflow includes an AND requirement or an OR requirement based on the hash chain. The information processing device 100 can make it easy to detect that a workflow has been tampered with in the approval side device 203 or the verification side device 201. The information processing device 100 can also handle cases where data of multiple approvers is requested with an OR requirement.

[0215] (First generation process procedure) Next, an example of a first generation process procedure executed by the information processing device 100 will be described with reference to Fig. 15. The first generation process is realized by, for example, the CPU 301, storage areas such as the memory 302 and the recording medium 305, and the network I / F 303 shown in Fig. 3.

[0216] 15 is a flowchart illustrating an example of a procedure of the first generation process, in which the information processing device 100 generates a function f and secret information s in response to acquiring a workflow (step S1501).

[0217] The information processing device 100 receives data representing the user's approval in response to forwarding the approval request to each of one or more users based on the workflow (step S1502). The information processing device 100 generates additional information corresponding to the received data based on the function f (step S1503).

[0218] The information processing device 100 determines whether the number of approvals is greater than or equal to the required number (step S1504). If the number of approvals is not greater than or equal to the required number (step S1504: No), the information processing device 100 returns to the process of step S1502. On the other hand, if the number of approvals is greater than or equal to the required number (step S1504: Yes), the information processing device 100 proceeds to the process of step S1505.

[0219] In step S1505, the information processing device 100 sets an initial value of the hash chain, forms a hash chain based on each of the received data, and calculates a final hash value of the hash chain (step S1505).

[0220] The information processing device 100 transmits the workflow to the verification side device 201 (step S1506). The information processing device 100 determines whether or not new data representing the user's approval has been received (step S1507). If new data representing the user's approval has not been received (step S1507: No), the information processing device 100 proceeds to processing of step S1510. On the other hand, if new data representing the user's approval has been received (step S1507: Yes), the information processing device 100 proceeds to processing of step S1508.

[0221] In step S1508, the information processing device 100 generates additional information corresponding to the newly received data based on the function f (step S1508). The information processing device 100 re-forms a hash chain based on each of the received data, and calculates a final hash value of the hash chain (step S1509). Then, the information processing device 100 returns to the process of step S1506.

[0222] In step S1510, the information processing device 100 determines whether or not a workflow confirmation notification has been received from the verification side device 201 (step S1510). If the workflow confirmation notification has not been received (step S1510: No), the information processing device 100 returns to the process of step S1506. On the other hand, if the workflow confirmation notification has been received (step S1510: Yes), the information processing device 100 proceeds to the process of step S1511.

[0223] In step S1511, the information processing device 100 transmits workflow information including each of the accepted data, the initial value and final hash value of the hash chain, and each of the additional information to the verification side device 201 (step S1511). The information processing device 100 ends the first generation process.

[0224] (First verification process) Next, an example of a first verification process procedure executed by the verification side device 201 will be described with reference to Fig. 16. The first verification process is realized by, for example, the CPU 401, storage areas such as the memory 402 and the recording medium 405, and the network I / F 403 shown in Fig. 3.

[0225] 16 is a flowchart showing an example of a procedure of the first verification process. In FIG. 16, the verification side apparatus 201 acquires workflow information (step S1601). The verification side apparatus 201 restores the secret information s based on the workflow information (step S1602).

[0226] The verification side device 201 forms a hash chain based on the restored secret information s and the workflow information, and calculates a final hash value of the hash chain (step S1603). The verification side device 201 compares the calculated final hash value with the final hash value of the workflow information (step S1604).

[0227] The verification side device 201 judges whether the final hash values ​​match (step S1605). If the final hash values ​​match (step S1605: Yes), the verification side device 201 proceeds to step S1606. On the other hand, if the final hash values ​​do not match (step S1605: No), the verification side device 201 proceeds to step S1607.

[0228] In step S1606, the verification side apparatus 201 outputs a result of the verification being successful (step S1606), and the verification side apparatus 201 ends the first verification process.

[0229] In step S1607, the verification side apparatus 201 outputs a verification failure (step S1607), and ends the first verification process.

[0230] (Second generation process procedure) Next, an example of a procedure of the second generation process executed by the information processing device 100 will be described with reference to Fig. 17. The second generation process is realized by, for example, the CPU 301, storage areas such as the memory 302 and the recording medium 305, and the network I / F 303 shown in Fig. 3.

[0231] Fig. 17 is a flowchart showing an example of a procedure of the second generation process, in which the information processing device 100 receives data representing user approval in response to forwarding an approval request to each of one or more users based on a workflow (step S1701).

[0232] The information processing device 100 generates data by combining each of the received data (step S1702). The information processing device 100 sets an initial value of the hash chain, forms a hash chain based on the generated data, and calculates a final hash value of the hash chain (step S1703).

[0233] The information processing device 100 transmits workflow information including each piece of accepted data and the initial value and final hash value of the hash chain to the verification side device 201 (step S1704). The information processing device 100 ends the second generation process.

[0234] (Second verification process procedure) Next, an example of a procedure of the second verification process executed by the verification side device 201 will be described with reference to Fig. 18. The second verification process is realized by, for example, the CPU 401, storage areas such as the memory 402 and the recording medium 405, and the network I / F 403 shown in Fig. 3.

[0235] Fig. 18 is a flowchart showing an example of the procedure of the second verification process. In Fig. 18, the verification side device 201 acquires workflow information (step S1801). The verification side device 201 generates data by combining each piece of user data in the workflow information (step S1802).

[0236] The verification side device 201 forms a hash chain based on the generated data and calculates a final hash value of the hash chain (step S1803). The verification side device 201 compares the calculated final hash value with the final hash value of the workflow information (step S1804).

[0237] The verification side device 201 judges whether the final hash values ​​match (step S1805). If the final hash values ​​match (step S1805: Yes), the verification side device 201 proceeds to the process of step S1806. On the other hand, if the final hash values ​​do not match (step S1805: No), the verification side device 201 proceeds to the process of step S1807.

[0238] In step S1806, the verification side apparatus 201 outputs a result of the verification being successful (step S1806), and the verification side apparatus 201 ends the second verification process.

[0239] In step S1807, the verification side apparatus 201 outputs a verification failure (step S1807), and ends the second verification process.

[0240] As described above, the information processing device 100 can obtain a workflow that has as one requirement the receipt of data of any of the second or more users among the first number of users according to the secret sharing technique. The information processing device 100 can generate a function including secret information based on the first number and the second number in the workflow. When the information processing device 100 receives data of any of the second or more users among the first number of users, it can calculate an output value of the generated function according to an input value obtained by adding a random number to the received data of the second or more users. The information processing device 100 can form a hash chain for a data string according to the workflow, including data obtained by combining secret information with a hash value of data obtained by combining each of the added random numbers and each of the calculated output values. As a result, the information processing device 100 can form a hash chain that represents an OR requirement, making it easier to verify the workflow.

[0241] According to the information processing device 100, a combination of a random number added to the data of each of the second or more accepted users and a calculated output value can be added to a pair of the initial value of the formed hash chain and the final hash value of the formed hash chain, and the combination can be output. This allows the information processing device 100 to verify the workflow.

[0242] According to the information processing device 100, when the second number is 1, a function including secret information can be generated so as to pass through coordinates represented by a predetermined input value and a predetermined output value corresponding to the predetermined input value. According to the information processing device 100, when the second number is 1, a hash chain can be formed for a data string including data obtained by combining secret information with a hash value of data obtained by combining each random number, each output value, a predetermined input value, and a predetermined output value. According to the information processing device 100, a combination of each random number, each output value, a predetermined input value, and a predetermined output value can be added to a pair of the initial value and the final hash value of the formed hash chain, and the resulting pair can be output. As a result, the information processing device 100 can make it possible to appropriately verify a workflow even when the second number is 1.

[0243] According to the information processing device 100, it is possible to obtain a workflow that includes, as one requirement, accepting data of each of the third number of users. According to the information processing device 100, when data of each of the third number of users is accepted, it is possible to form a hash chain for a data string according to the workflow, including data obtained by combining the accepted data of each of the third number of users. This allows the information processing device 100 to form a hash chain that represents an AND requirement, making it easier to verify the workflow.

[0244] According to the information processing device 100, it is possible to acquire a target workflow for determining authenticity, which has as one requirement that data of any of the fifth or more users among the fourth number of users is accepted. According to the information processing device 100, it is possible to acquire data of any of the fifth or more users among the fourth number of users in the acquired target workflow. According to the information processing device 100, it is possible to acquire candidate data that is a combination of an output value of a true function including first secret information generated according to a secret sharing technique according to an input value obtained by adding a random number to the acquired data of each of the fifth or more users, and the random number. According to the information processing device 100, it is possible to acquire a candidate pair that is a pair of an initial value of a true hash chain for a data sequence along the true workflow and a final hash value of the true hash chain. According to the information processing device 100, it is possible to restore second secret information based on the acquired data of each of the fifth or more users and the acquired candidate data according to the secret sharing technique. According to the information processing device 100, it is possible to identify a data sequence along the target workflow, which includes data obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data. According to the information processing device 100, it is possible to calculate the final hash value of the target hash chain for the identified data string based on the initial value of the true hash chain represented by the acquired candidate pair. According to the information processing device 100, if the final hash value of the true hash chain represented by the acquired candidate pair matches with the calculated final hash value of the target hash chain, it is possible to determine that the target workflow is true. According to the information processing device 100, if the final hash value of the true hash chain represented by the acquired candidate pair does not match with the calculated final hash value of the target hash chain, it is possible to determine that the target workflow is false. This allows the information processing device 100 to properly verify the workflow.

[0245] According to the information processing device 100, a function can be generated that has secret information as an intercept and can be specified based on the coordinates of any of the second numbers among the coordinates of the first number in the coordinate space according to the secret sharing technique. This allows the information processing device 100 to prepare a function that can restore the secret information.

[0246] According to the information processing device 100, it is possible to generate random numbers corresponding to the data of each of the second or more users received, and to calculate the output value of the generated function according to the input value obtained by adding the generated random number to the data of each of the second or more users received. This makes it possible for the information processing device 100 to dispense with the need to prepare random numbers in advance.

[0247] According to the information processing device 100, it is possible to receive data representing the approval of a user, and thus the information processing device 100 can handle a workflow representing the flow of approval.

[0248] The information processing method described in this embodiment can be realized by executing a prepared program on a computer such as a PC or a workstation. The information processing program described in this embodiment is recorded on a computer-readable recording medium, and is executed by being read from the recording medium by the computer. The recording medium may be a hard disk, a flexible disk, a CD (Compact Disc)-ROM, an MO (Magneto Optical disc), a DVD (Digital Versatile Disc), or the like. The information processing program described in this embodiment may also be distributed via a network such as the Internet.

[0249] The following supplementary notes are further disclosed regarding the above-described embodiment.

[0250] (Supplementary Note 1) According to a secret sharing technique, a function including secret information is generated based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second number or more users among a first number of users; when receiving data of any of the first number of users for the second or more users, calculating an output value of the generated function according to an input value obtained by adding a random number to the received data of the second or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing program that causes a computer to execute a process.

[0251] (Note 2) A combination of the random number added to the data of each of the second or more users and the calculated output value is added to a pair of the initial value of the hash chain and the final hash value of the hash chain, and the pair is output. 2. The information processing program according to claim 1, characterized in that the information processing program causes the computer to execute a process.

[0252] (Additional Note 3) The generating process is When the second number is 1, generating the function including the secret information so as to pass through coordinates represented by a predetermined input value and a predetermined output value corresponding to the predetermined input value; The forming process includes: if the second number is 1, forming a hash chain for a data sequence along the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the data of each of the second or more users received, the calculated output value, the predetermined input value, and the predetermined output value; The output process includes: The information processing program described in Appendix 2, characterized in that a pair of the initial value of the formed hash chain and the final hash value of the formed hash chain is outputted along with a combination of the random number added to the data of each of the second or more users received, the calculated output value, the specified input value, and the specified output value.

[0253] (Appendix 4) The forming process includes: The information processing program described in any one of Appendices 1 to 3, characterized in that the workflow includes as one requirement accepting data for each of a third number of users, and when the data for each of the third number of users has been accepted, a hash chain is formed for a data sequence that follows the workflow, including data obtained by combining the accepted data for each of the third number of users.

[0254] (Appendix 5) Obtain a target workflow for determining the truth or falsity of a request that requires accepting data of any of the 4th number of users or more. acquiring data of each of the fifth or more users among the fourth number of users in the acquired target workflow; obtain candidate data to be a combination of an output value of a true function including first secret information generated according to the secret sharing method, the output value being obtained by adding a random number to the data of each of the five or more users obtained, and the random number; Obtaining a candidate pair of an initial value of a true hash chain for a data sequence along a true workflow and a final hash value of the true hash chain; recovering second secret information based on the acquired data of each of the fifth or more users and the acquired candidate data in accordance with the secret sharing technique; Calculate a final hash value of a target hash chain for a data sequence along the target workflow, the final hash value including data obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data based on an initial value of the true hash chain represented by the acquired candidate pair; If the final hash value of the true hash chain represented by the acquired candidate pair matches the calculated final hash value of the target hash chain, the target workflow is determined to be true, and if the final hash value of the true hash chain represented by the acquired candidate pair does not match the calculated final hash value of the target hash chain, the target workflow is determined to be false. 4. The information processing program according to any one of claims 1 to 3, which causes the computer to execute a process.

[0255] (Additional Note 6) The generating process is The information processing program according to any one of Appendices 1 to 3, characterized in that the function having the secret information as an intercept is generated, which can be identified based on the coordinates of the second number among the coordinates of the first number in the coordinate space according to the secret sharing technique.

[0256] (Appendix 7) The calculation process is An information processing program described in any one of Appendices 1 to 3, characterized in that it generates a random number corresponding to each of the received data of the second or more users, and calculates an output value of the generated function according to an input value obtained by adding the generated random number to the received data of each of the second or more users.

[0257] (Supplementary Note 8) The information processing program according to any one of Supplementary Notes 1 to 3, wherein the user data represents approval of the user.

[0258] (Supplementary Note 9) According to a secret sharing technique, a function including secret information is generated based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second number or more users among a first number of users; when receiving data of any of the first number of users for the second or more users, calculating an output value of the generated function according to an input value obtained by adding a random number to the received data of the second or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing method characterized in that the processing is executed by a computer.

[0259] (Supplementary Note 10) According to a secret sharing technique, a function including secret information is generated based on the first number and the second number in a workflow in which one requirement is to accept data of each of a second number or more users among a first number of users; when receiving data of any of the first number of users for the second or more users, calculating an output value of the generated function according to an input value obtained by adding a random number to the received data of the second or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing device comprising a control unit.

[0260] (Appendix 11) Obtain a target workflow for determining whether or not it is true, the workflow having one requirement of accepting data of each of the second or more users among the first number of users; acquiring data of each of the second or more users among the first number of users in the acquired target workflow; obtain candidate data to be a combination of an output value of a true function including first secret information generated according to a secret sharing technique, the output value being corresponding to an input value obtained by adding a random number to the data of each of the second or more users obtained, and the random number; Obtaining a candidate pair of an initial value of a true hash chain for a data sequence along a true workflow and a final hash value of the true hash chain; recovering second secret information based on the acquired data of each of the second or more users and the acquired candidate data in accordance with the secret sharing technique; Calculate a final hash value of a target hash chain for a data sequence along the target workflow, the final hash value including data obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data based on an initial value of the true hash chain represented by the acquired candidate pair; If the final hash value of the true hash chain represented by the acquired candidate pair matches the calculated final hash value of the target hash chain, the target workflow is determined to be true, and if the final hash value of the true hash chain represented by the acquired candidate pair does not match the calculated final hash value of the target hash chain, the target workflow is determined to be false. An information processing program that causes a computer to execute a process. [Explanation of symbols]

[0261] 100 Information processing device 101,800,1300 Workflow 102,810,1310 hash chain 110,1302 OR Requirements 121,122 Requirements 200 Information Processing Systems 201 Verification device 202 Creator device 203 Approval device 210 Network 300,400 Bus 301,401 CPU 302,402 Memory 303,403 Network I / F 304,404 Recording media I / F 305,405 Recording media 406 Display 407 Input Device 500 1st memory section 501 First Acquisition Department 502 Generation part 503 Calculation Department 504 1st forming part 505 First Output Section 510 2nd memory section 511 Second Acquisition Department 512,720 Restoration Department 513 Second forming part 514 Judgment section 515 Second Output Section 601 Approval Request 602 Workflow Information 610 Hash Chain Calculation Unit 620 Hash Chain Verification Unit 710 Secret sharing generator 711 Function Generator 801, 803, 1301, 1303 Individual requirements 802 AND Requirements 1001,1101 curve 1201,1211 straight line 1400,1411,1412 Group

Claims

1. generating a function including secret information based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second or more users among a first number of users according to a secret sharing technique; when data of any of the first number of users of the second number or more users is received, an output value of the generated function is calculated according to an input value obtained by adding a random number to the received data of the second number or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing program that causes a computer to execute a process.

2. a combination of the random number added to the data of each of the second or more users and the calculated output value is added to a pair of the initial value of the hash chain and the final hash value of the hash chain, and the pair is output.

2. The information processing program according to claim 1, which causes the computer to execute a process.

3. The generating process includes: If the second number is 1, generating the function including the secret information so as to pass through coordinates represented by a predetermined input value and a predetermined output value corresponding to the predetermined input value; The forming process includes: if the second number is 1, forming a hash chain for a data sequence along the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the data of each of the second or more users received, the calculated output value, the predetermined input value, and the predetermined output value; The output process includes: The information processing program according to claim 2, characterized in that a pair of the initial value of the formed hash chain and the final hash value of the formed hash chain is outputted along with a combination of the random number added to the data of each of the second or more users received, the calculated output value, the specified input value, and the specified output value.

4. The forming process includes: The information processing program of any one of claims 1 to 3, characterized in that the workflow includes as one requirement accepting data for each of a third number of users, and when the data for each of the third number of users has been accepted, a hash chain is formed for a data sequence that follows the workflow, including data obtained by combining the accepted data for each of the third number of users.

5. obtain a target workflow for determining authenticity, the workflow having one requirement of accepting data of any of the fifth or more users among the fourth number of users; acquiring data of each of the fifth or more users among the fourth number of users in the acquired target workflow; obtain candidate data to be a combination of an output value of a true function including first secret information generated according to the secret sharing technique, the output value corresponding to an input value obtained by adding a random number to the data of each of the fifth or more users obtained, and the random number; Obtaining a candidate pair of an initial value of a true hash chain for a data sequence along a true workflow and a final hash value of the true hash chain; recovering second secret information based on the acquired data of each of the fifth or more users and the acquired candidate data in accordance with the secret sharing technique; Calculate a final hash value of a target hash chain for a data sequence along the target workflow, the final hash value including data obtained by combining the restored second secret information with a hash value of data obtained by combining each of the acquired candidate data based on an initial value of the true hash chain represented by the acquired candidate pair; If the final hash value of the true hash chain represented by the acquired candidate pair matches the calculated final hash value of the target hash chain, the target workflow is determined to be true, and if the final hash value of the true hash chain represented by the acquired candidate pair does not match the calculated final hash value of the target hash chain, the target workflow is determined to be false.

4. The information processing program according to claim 1, which causes the computer to execute a process.

6. generating a function including secret information based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second or more users among a first number of users according to a secret sharing technique; when data of any of the first number of users of the second number or more users is received, an output value of the generated function is calculated according to an input value obtained by adding a random number to the received data of the second number or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing method characterized in that the processing is executed by a computer.

7. generating a function including secret information based on a first number and a second number in a workflow in which one requirement is to accept data of each of a second or more users among a first number of users according to a secret sharing technique; when data of any of the first number of users of the second number or more users is received, an output value of the generated function is calculated according to an input value obtained by adding a random number to the received data of the second number or more users; forming a hash chain for a data sequence according to the workflow, the hash chain including data obtained by combining the secret information with a hash value of data obtained by combining the random number added to the received data of each of the second or more users and the calculated output value; An information processing device comprising a control unit.

Images