Electronic rights distribution system, issuer device, user device, ticket examiner device, electronic rights distribution method and program

Abstract

To improve security in an originality assurance method for distributing electronic rights.SOLUTION: Provided is an electronic rights distribution system having an issuer device, a user device, and a ticket examiner device. In an issuance process, the issuer device transmits, to the user device, an electronic signature by a tamper-resistant certifier for a public key of the issuer device, and the user device transmits, to the issuer device, an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device. In an execution process, the ticket examiner device transmits, to the user device, an electronic signature by the ticket examiner device for a rights definition and a session number used in the execution process, and verifies that the rights definition used in the execution process has not been tampered with using the token exchange format received from the user device.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present invention relates to techniques for distributing electronic rights. [Background technology]

[0002] In the digital society, cryptographic protocols for electronic rights have been attracting attention in recent years in order to ensure that various values ​​and rights are securely digitized.

[0003] The FlexToken protocol, which is standardized by the IETF, is one of the cryptographic protocols mentioned above. In the FlexToken protocol, electronic rights are separated into two pieces of information for distribution: a rights definition that defines the content of the rights, and a token that indicates originality. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Fujimura, Ko, and D. Eastlake. Requirements and design for voucher trading system (VTS). No. rfc3506. 2003. [Non-Patent Document 2] Terada, Masayuki, and Ko Fujimura. Voucher Trading System Application Programming Interface (VTS-API). No. rfc4154. 2005. Summary of the Invention [Problem to be solved by the invention]

[0005] The FlexToken protocol is divided into three sub-protocols: issuance, transfer, and exercise, and these sub-protocols can be combined according to the situation.

[0006] However, when these subprotocols are combined or run in parallel, a safe way to use them is not self-evident from the conventional technology (i.e., the IETF / RFC specifications of the basic protocols, etc.). For example, it is possible that information may be tampered with or forged.

[0007] The FlexToken protocol may be called an "originality assurance method for distributing electronic rights." However, the "originality assurance method for distributing electronic rights" is not limited to the existing FlexToken protocol.

[0008] The present invention has been made in consideration of the above-mentioned points, and has an object to provide a technique for improving security in an originality assurance method for distributing electronic rights. [Means for solving the problem]

[0009] According to the disclosed technology, there is provided an electronic right distribution system having an issuer device, a user device, and a ticket gate device, and using a method for guaranteeing the authenticity of electronic rights, comprising: During the issuing process, The issuer device transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and the user device transmits to the issuer device an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device; In the exercise process, The ticket gate device transmits to the user device a digital signature by the ticket gate device for the rights definition and session number used in the exercise process, and verifies that the rights definition used in the exercise process has not been tampered with by using a token exchange format received from the user device. An electronic rights distribution system is provided. Effect of the Invention

[0010] According to the disclosed technology, a technology for enhancing security in an originality assurance method for distributing electronic rights is provided. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram for explaining FlexToken. [Diagram 2] FIG. 1 is a diagram for explaining FlexToken. [Diagram 3] FIG. 1 is a diagram illustrating an example of the configuration of an electronic rights distribution system. [Figure 4] FIG. 2 illustrates an example of a functional configuration of an issuer device 100. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a user device 200. [Figure 6] FIG. 2 is a diagram illustrating an example of the functional configuration of a ticket examiner device 300. [Figure 7] FIG. 11 is a diagram for explaining an issuing process. [Figure 8] FIG. 13 is a diagram for explaining a transfer process. [Figure 9] FIG. 13 is a diagram for explaining an exercise process. [Figure 10] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0013] (Outline of the originality assurance method) First, an outline of an originality assurance method for distributing electronic rights will be described. In this embodiment, it is assumed that FlexToken is used as the originality assurance method, so an outline of FlexToken will be described here.

[0014] FlexToken itself is a conventional technology. In the specification and drawings of this application, the description of the conventional technology, "General-purpose originality assurance system for electronic rights distribution infrastructure, Transactions of Information Processing Society of Japan Aug. 2001," which describes the conventional technology, is used as appropriate for the explanation and drawings of the conventional technology.

[0015] In FlexToken, the process of electronic rights circulation is modeled as three types of circulation processes: issuance, transfer, and exercise, among three types of participants: issuer, user, and ticket gate.

[0016] In FlexToken, in order to enable efficient handling of various types of electronic rights, electronic rights are divided into two pieces of information, a rights definition and a token, and only the token is managed using a tamper-resistant device such as an IC card, as shown in Figure 1. The rights definition is information that defines the content of the right and the conditions for its exercise, and is stored in a normal storage medium such as a hard disk.

[0017] On the other hand, the token is information that represents the originality of the electronic right, and is protected from unauthorized duplication by utilizing the tamper-resistance of the IC card.

[0018] As shown in Fig. 2, a token is composed of two pieces of information: a manifest, which is a hash value of the rights definition, and issuer information, which is a hash value of the issuer's public key. An electronic right is considered valid only when the rights definition can be matched with the corresponding token, i.e., when the originality of the electronic right is confirmed.

[0019] The distribution of electronic rights is performed by copying the rights definition and transferring the token. In order to prevent tampering and copying during distribution, the token is authenticated using an electronic signature when it is transferred. Here, in order to enable safe distribution of electronic rights by any issuer, the electronic signature is verified using credential information, which is information specifying an IC card issuing institution trusted by each issuer, and a tamper-resistant certificate, which is information by which the IC card issuing institution guarantees the tamper resistance of the IC card. Multiple IC card issuing institutions can be specified in the credential information, and each issuer can describe any IC card issuing institution in the credential information. This verification method ensures that the distribution of tokens is performed only via IC cards that each issuer can trust. The IC card is an example of a user device.

[0020] (About the assignment) As mentioned above, the FlexToken protocol is divided into three sub-protocols: issuance, transfer, and exercise, and can be combined according to the situation. However, in the existing FlexToken protocol, it is not self-evident how to use these sub-protocols safely when they are combined or executed in parallel, and it is expected that information may be tampered with or forged.

[0021] The following describes in detail a technique for enhancing security in an originality assurance method for distributing electronic rights.

[0022] (System configuration example) An example of the configuration of an electronic right distribution system in this embodiment is shown in Fig. 3. As shown in Fig. 3, the electronic right distribution system in this embodiment includes an issuer device 100, a user device 200-1, a user device 200-2, and a ticket gate device 300.

[0023] Issuer device 100, user device 200-1, user device 200-2, and ticket examiner device 300 can all be realized by having a computer execute a program. User device 200-1 and user device 200-2 each include a storage unit (e.g., an IC card) having a tamper-resistant area. User device 200-1 / user device 200-2 may itself be an IC card. An IC card is an example of a computer. When describing the user device without distinguishing between user device 200-1 and user device 200-2, the user device will be referred to as "user device 200."

[0024] Also, either or both of the issuer device 100 and the ticket examiner device 300 may be made tamper-resistant, similar to the user device 200.

[0025] Any two devices constituting the electronic rights distribution system can communicate with each other via a network as required for processing. The issuer device 100, the user device 200, and the ticket examiner device 300 correspond to the issuer, user, and ticket examiner described above, respectively. The issuer device 100, the user device 200, and the ticket examiner device 300 may also be called the issuer, user, and ticket examiner, respectively.

[0026] (Example of device configuration) 4 shows an example of a functional configuration of issuer device 100. As shown in FIG. 4, issuer device 100 includes a communication unit 110, an issuance processing unit 120, and a storage unit .

[0027] The communication unit 110 communicates with other devices. The issuance processing unit 120 executes the issuance process. Note that the issuance processing unit 120 may include the communication unit 110. The storage unit 130 stores information used in the issuance process.

[0028] 5 shows an example of a functional configuration of the user device 200. As shown in FIG. 5, the user device 200 includes a communication unit 210, an issuance processing unit 220, a transfer processing unit 230, an exercise processing unit 240, and a storage unit 250.

[0029] The communication unit 210 communicates with other devices. The issuance processing unit 220, the transfer processing unit 230, and the exercise processing unit 240 execute the issuance processing, the transfer processing, and the exercise processing, respectively. Note that the issuance processing unit 220, the transfer processing unit 230, and the exercise processing unit 240 may each include the communication unit 210. The storage unit 250 stores information used in the issuance processing, the transfer processing, or the exercise processing.

[0030] 6 shows an example of the functional configuration of the ticket examiner device 300. As shown in FIG. 6, the ticket examiner device 300 has a communication unit 310, an exercise processing unit 320, and a storage unit 330.

[0031] The communication unit 310 communicates with other devices. The exercise processing unit 320 executes the exercise processing. The exercise processing unit 320 may include the communication unit 310. The storage unit 330 stores information used in the exercise processing.

[0032] (Information composition) In explaining the operation of the electronic right distribution system according to the present embodiment, first, an outline of the information configuration used in the operation will be explained. In the following explanation, the devices participating in the distribution of electronic rights, such as the issuer device 100, the user device 200-1, the user device 200-2, and the ticket gate device 300, may be collectively called participant devices.

[0033] In this embodiment, it is assumed that each participant device X holds a public key PkX and a private key SkX.

[0034] In this embodiment, the private key SkX is used to generate a digital signature. In the following, the digital signature by SkX for a message m is called S PkX (m) Electronic Signature S PkX (m) is the verification function V using the corresponding public key PkX. PkX It can be verified using (·,·). For example, V PkX (m,s) is s=S PkX If (m), return true, and s ≠ S PkX If (m), return false.

[0035] Moreover, H(·) is a one-way hash function. The hash value H(PkX) of the public key obtained by this function is used as an identifier for each participant device X. This H(PkX) may be called a fingerprint. The following is an overview of the configuration of information used to realize the distribution process in this embodiment.

[0036] Rights Definition: This is information that defines the "contents" of a right, such as the compensation obtained by exercising it and the conditions for its exercise. Hereafter, the right definition will be denoted as m.

[0037] token: It is information that represents the originality of the right, and is configured as two pairs (t1, t2) = (H(m), H(PkI)). Here, PkI is the public key of the right issuer. When a user device 200 (e.g., an IC card) trusted by the issuer holds a token (H(m), H(PkI)), the user is considered to own a right whose value is guaranteed by I (issuer) and whose content is defined by right definition m.

[0038] Token exchange format: It is a set of six (e1,...,e6) used when transferring tokens in connection with rights distribution, and is constructed by attaching the sender's signature to the set of token and challenge. Hereafter, the token exchange format is abbreviated as TEF (Token Exchange Format).

[0039] Challenge: In order to prevent duplication of rights due to reuse of TEF, two pairs (c1, c2) are generated by the recipient of the token when the token is distributed. Here, c1 is the fingerprint of the recipient, and c2 is a session number that is uniquely generated by each recipient. The session number can be, for example, a random number with sufficient length or a sequential number that increases monotonically with each distribution.

[0040] Tamper proof: This is a certificate in which a third party (guarantor, tamper-resistant certifier) ​​guarantees the tamper-resistance of the user device 200 (e.g., IC card), and is configured as two pairs (g1, g2). g1 is an electronic signature by the guarantor for the public key of the user device 200 (e.g., IC card), and g2 is the public key of the guarantor. Each user device 200 (e.g., IC card) is assumed to hold an appropriate tamper-resistance certificate in advance.

[0041] Credentials: A triplet (a1, a2, a3) used by an issuer to specify guarantors that the issuer can "trust." a1 is a set of guarantor fingerprints, and each user device 200 (e.g., IC card) is considered trusted by the issuer if the guarantor of its tamper-resistant certificate is included in a1. a1 is protected from forgery and tampering by the issuer's digital signature a2 on a1 and the issuer's public key a3.

[0042] Receipt: A pair (r1,r2) generated by the recipient of a token to indicate acceptance of the TEF, where r1 is the recipient's digital signature in response to the challenge (of the accepted TEF), and r2 is the recipient's public key.

[0043] In addition to this information, each of the user terminal 200 and the ticket examiner terminal 300 manages a valid session set S and an issuer list L.

[0044] The valid session set S is a set of session numbers for identifying valid challenges. The initial state of the valid session set S is an empty set, and each session number is added to S when a challenge is generated, and is deleted from S when the corresponding TEF is accepted. Here, S belonging to a user is managed by the user device 200 (e.g., an IC card), and the user is not permitted to add a value to S illegally (by means other than challenge generation).

[0045] The issuer list L is a list of issuers that each user or ticket gate trusts, and is constructed as a collection of issuer fingerprints. Only rights backed by issuers included in the issuer list L are considered to be rights that are "valuable" to each user or ticket gate. L can be updated by each user or ticket gate at any time.

[0046] The following describes the operation of the electronic right distribution system in this embodiment, including the issuing protocol (issuing process), the transfer protocol (transfer process), and the exercise protocol (exercising process). In the following description, I represents the issuer device 100, U represents the user device 200, and C represents the ticket gate device 300.

[0047] (Issuance Protocol) First, the procedure of the process of issuing a right from the issuer device 100 to the user device 200 will be described with reference to the sequence diagram of Fig. 7. Issuance is a process of generating a token (H(m), H(PkI)) corresponding to the right definition m and the issuer device 100(I) and transferring this information from the issuer device 100 to the user device 200.

[0048] <S1(ステップ1)> The issuer device 100 receives the credential information A I :(a1,a2,a3), where A I is constructed as follows:

[0049] a1:=H(PkG1),H(PkG2),...,H(PkG n ) a2:=S PkI (H(PkG1)||H(PkG2)||...,||H(PkG n )) a3:=PkI Credential information A I is not used for validation at the time of issuance, but is used for subsequent transfers and exercise.

[0050] <s2> The issuer device 100 receives the rights definition m and A I is transmitted to the user device 200(U).

[0051] <s3> The issuer device 100 uses the tamper-resistant certificate (tamper-resistant information) I =(S PkG (PkI), PkG) = (j1, j2) is transmitted to the user device 200. PkG (PkI) is a digital signature by the tamper-resistant certifier on PkI (the issuer's public key), and PkG is the public key of the tamper-resistant certifier.

[0052] <s4> The user device 200 receives a challenge C U :(c1,c2):=(H(PkU),s), where s is a session number generated by the user device 200. After the challenge is generated, s is added to the valid session set S U will be added.

[0053] <s5> The user device 200 receives a challenge C U is transmitted to the issuer device 100.

[0054] <s6> The user device 200 (S PkU (m∥s), PkU) to the issuer device 100. PkU (m||s) is the digital signature by the user for the received rights definition m and session number s, and PkU is the user's public key.

[0055] <s7> The issuer device 100 is a TEF E I :(e1,...,e6). The TEF is constructed as follows:

[0056] e1:=H(m) e2:=H(PkI) e3:=c1 e4:=c2 e5:=S PkI (e1||e2||e3||e4) e6:=PkI The issuer device 100 is I A copy of the receipt is stored in the storage unit 130. This copy is held until the issuer device 100 receives the corresponding receipt.

[0057] <s8> The issuer device 100 is a TEF E I is transmitted to the user device 200.

[0058] <s9> The user device 200 is I This verification is successful if all of the following expressions are satisfied:

[0059] e3=H(PkU) (1) e4∈S U (2) V e6 (e1||e2||e3||e4,e5)=true (3) V j2 (e6,j1)=true (4) H(j2)∈a1(5) V a3 (a1, a2)=true (6) H(e6)=e2(7) e2∈L (8) e1 = H(m) (9) Equations (1) and (2) are for verifying the validity of the challenge, and equation (3) is for E I was generated by the issuer device 100. Equation (4) verifies that the guarantor j2 vouches for the issuer e6. Equations (5), (6), and (7) verify that the guarantor j2 is trusted by the issuer e2. Equation (8) verifies the validity of the right.

[0060] Moreover, formula (9) is a verification that the rights definition m has not been tampered with. That is, the user device 200 verifies that the rights definition m has not been tampered with by verifying that the hash value of m received in S2 is equal to e1 in the TEF.

[0061] <s10> If the above verification is successful, the user device 200 U and stores the token T:(t1, t2):=(e1, e2) in the storage unit 250.

[0062] <s11> The user device 200 receives the receipt R U :(r1,r2):=(S PkU (c1∥c2), PkU) is transmitted to the issuer device 100.

[0063] <s12> The issuer device 200 is U This verification is successful if all of the following expressions are satisfied:

[0064] V r2 (e3||e4,r1)=true (10) H(r2)=e3(11) Equation (10) verifies that the received receipt corresponds to the sent TEF and that the creator of the receipt is r2, and equation (11) verifies that the creator (r2) of the receipt is the same as the recipient (c1) of the TEF. If the above verification is successful, the issuer device 100 reads the E I Delete the duplicate.

[0065] Through the above procedure, the user device 200 holds the rights definition m and the token (H(m), H(PkI)).

[0066] <Comparison with conventional FlexToken protocol> The above-mentioned issuance process differs from the conventional FlexToken protocol in that S3 and S6 are added, and that formulas (4) to (6) and formula (9) are added to S9.

[0067] As in S3, the issuer device 100 passes tamper-resistant information to the user device 200 and verifies the trusted information in formulas (4) to (6), thereby preventing the trusted information from being forged during issuance. Also, it is possible to prevent the user device 200 from having incorrect trusted information in the exercise protocol in "issue → exercise", the transfer protocol in "issue → transfer → exercise", and between the user and the ticket gate in "issue → transfer → exercise".

[0068] Also, as in S6, when the user device 200 (S PkU By transmitting (m∥s), PkU) to the issuer device 100, it is possible to prevent tampering of the rights definition and manifest, and to prevent counterfeiting of trust information and issuer information in the "issue → transfer → exercise" exercise protocol, and to prevent user impersonation, etc. Furthermore, by adding formula (9), it is possible to prevent rewriting of the rights definition.

[0069] (Transfer Protocol) Next, the procedure of the process of transferring (assigning) rights from user device 200-1 (U1) to user device 200-2 (U2) will be described with reference to the sequence diagram of Fig. 8. The transfer is a process of transferring a token (H(m), H(PkI)) corresponding to rights definition m and issuer device 100 (I) between user devices.

[0070] <s1> The user device 200-1 (U1) has a tamper-resistant certificate G U1 :(g1,g2):=(S PkG (PkU1), PkG) to A I and m to the user device 200-2 (U2).

[0071] <s2> The user device 200-2 receives challenge C. U2 :(c1,c2):=(H(PkU2),s) and define s as a valid session set S U2 Add to.

[0072] <s3> The user device 200-2 issues a challenge C to the user device 200-1. U2 Send.

[0073] <s4> The user device 200-2 (S PkU2 (m∥s), PkU2) is sent to the user device 200-1. PkU2 (m∥s) is a digital signature by user device 200-2 for the received rights definition m and session number s, and PkU2 is the public key of user device 200-2.

[0074] <s5> The user device 200-1 deletes the stored token (H(m), H(PkI)) and creates a TEF E U1 Generate.

[0075] e1:=H(m) e2:=H(PkI) e3:=c1 e4:=c2 e5:=S pkU1 (e1||e2||e3||e4) e6:=PkU1 As in the case of issuing, the user device 200-1 U1 Keep a copy of the.

[0076] <s6> The user device 200-1 sends an E U1 Send.

[0077] <s7> The user device 200-2 is U1 This verification is successful if all of the following expressions are satisfied:

[0078] e3=H(PkU2) (12) e4∈S U2 (13) V e6 ((e1||e2||e3||e4),e5)=true (14) V g2 (e6,g1)=true (15) H(g2)∈a1(16) V a3 (a1, a2)=true (17) H(a3)=e2(18) e2∈L (19) e1 = H(m) (20) Equations (12), (13), and (14) are similar to equations (1), (2), and (3) in issuance. Equation (15) verifies that the guarantor g2 guarantees the right transfer side user device (e.g., IC card) e6. Equations (16), (17), and (18) verify that the guarantor g2 is trusted by the issuer e2. Moreover, equation (19) verifies the validity of the right.

[0079] Moreover, formula (20) is a verification that the rights definition m has not been tampered with. That is, the user device 200-2 verifies that the rights definition m has not been tampered with by verifying that the hash value of m received in S1 is equal to e1 in the TEF.

[0080] <s8> If the above verification is successful, the user device 200-2 U2 e4 is deleted from the token T, and the token T is stored in the storage unit 250.

[0081] <s9> The user device 200-2 is R U2 Send.

[0082] <s10> As in the case of issuing, the user device 200-1 U2 Verify and E U1 Delete the duplicate.

[0083] Through the above procedure, the token (H(m), H(PkI)) is lost from the user device 200-1, and the token is transferred to the user device 200-2.

[0084] <Comparison with conventional FlexToken protocol> The above-described transfer process differs from the conventional FlexToken protocol in that S4 is added and that equation (20) is added to S7.

[0085] As in S4, the user device 200-2 PkU2 By transmitting (m∥s), PkU2) to the user device 200-1, it is possible to prevent tampering of the rights definition and manifest, and to prevent counterfeiting of trust information and issuer information in the "issue → transfer → exercise" exercise protocol, and it is possible to prevent impersonation of a user. Also, by adding formula (20), it is possible to prevent rewriting of the rights definition.

[0086] (Exercise Protocol) Next, with reference to the sequence diagram of FIG. 9, a process procedure for exercising a right from the user device 200(U) to the ticket examiner device 300 will be described.

[0087] <s1> The user device 200(U) has a tamper-resistant certificate G U :(g1,g2):=(S PkG (PkU), PkG) to A I and m to the ticket examiner device 300.

[0088] <s2> The ticket examiner device 300 is Challenge C C :(c1,c2):=(H(PkC),s) and define s as a valid session set S C Add to Challenge C C Include information indicating whether "consumption" or "presentation" is desired. For example, in the following, if c2 is negative, it is considered as presentation. Only if "consumption" is desired (e.g., if c2 is positive), will the token be deleted when generating TEF.

[0089] <s3> The ticket examiner device 300 issues a challenge C to the user device 200. C Send.

[0090] <s4> The ticket examiner device 300 (S PkC (m∥s), PkC) is transmitted to the user device 200. PkC (m∥s) is the electronic signature by the ticket examiner device 300 for the received rights definition m and session number s, and PkC is the public key of the ticket examiner device 300 .

[0091] <s5> In this case, it is assumed that “consumption” is requested, and the user device 200 deletes the stored token (H(m), H(PkI)) and creates a TEF E U Generate.

[0092] e1:=H(m) e2:=H(PkI) e3:=c1 e4:=c2 e5:=S pkU (e1||e2||e3||e4) e6:=PkU As in the case of issuing, the user device 200 U Keep a copy of the.

[0093] <s6> The user device 200 transmits the E U Send.

[0094] <s7> The ticket examiner device 300 is U This verification is successful if all of the following expressions are satisfied:

[0095] e3=H(PkC) (21) e4∈S C (twenty two) V e6 ((e1||e2||e3||e4),e5)=true (23) V g2 (e6,g1)=true (24) H(g2)∈a1(25) V a3 (a1, a2)=true (26) H(a3)=e2(27) e2∈L (28) e1 = H(m) (29) Equations (21), (22), and (23) are similar to equations (1), (2), and (3) in issuance. Equation (24) verifies that the guarantor g2 guarantees the right transfer side user device (e.g., IC card) e6. Equations (25), (26), and (27) verify that the guarantor g2 is trusted by the issuer e2. Moreover, equation (28) verifies the validity of the right.

[0096] Moreover, formula (29) is a verification that the rights definition m has not been tampered with. That is, the ticket examiner device 300 verifies that the rights definition m has not been tampered with by verifying that the hash value of m received in S1 is equal to e1 in the TEF.

[0097] <s8> If the above verification is successful, the ticket examiner device 300 C In addition, the ticket examiner device 300 presents to the user device 200 the compensation defined by the right definition m.

[0098] <s9> The ticket examiner device 300 transmits R C Send.

[0099] <s10> As in the case of issuing, the user device 200 C Verify and E U Delete the duplicate.

[0100] <Comparison with conventional FlexToken protocol> The above-described transfer process differs from the conventional FlexToken protocol in that S4 is added and that equation (29) is added to S7.

[0101] As in S4, the ticket examiner device 300 PkC By transmitting (m∥s), PkC) to the user device 200, it is possible to prevent tampering of the rights definition and manifest, and to prevent counterfeiting of trust information and issuer information in the "issue → transfer → exercise" exercise protocol, and to prevent impersonation of a user, etc. Also, by adding formula (29), it is possible to prevent rewriting of the rights definition.

[0102] (Hardware configuration example) Any of the devices described in this embodiment (the issuer device 100, the user device 200, and the ticket examiner device 300) can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0103] That is, the device can be realized by executing a program corresponding to the processing performed by the device, using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0104] Fig. 10 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 10 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are connected to each other via a bus BS. The computer may further include a GPU.

[0105] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0106] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0107] (Summary of the embodiment, effects, etc.) As described above, the technology described in this embodiment makes it possible to improve security in an originality assurance method for distributing electronic rights.

[0108] In other words, in an originality assurance method for circulating electronic rights, if the three sub-protocols of issuance, transfer, and exercise are combined or executed in parallel, a secure usage method can be established, making it possible to express more complex usage scenarios of electronic rights in the real world.

[0109] The following supplementary notes are further disclosed regarding the above embodiment.

[0110] <Additional Notes> (Additional note 1) An electronic right distribution system having an issuer device, a user device, and a ticket gate device, and using a method for guaranteeing the originality of electronic rights, During the issuing process, The issuer device transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and the user device transmits to the issuer device an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device; In the exercise process, The ticket gate device transmits to the user device a digital signature by the ticket gate device for the rights definition and session number used in the exercise process, and verifies that the rights definition used in the exercise process has not been tampered with by using a token exchange format received from the user device. Electronic Rights Distribution System. (Additional note 2) In a transfer process from a first user device to a second user device, The second user device transmits to the first user device a digital signature by the second user device for a rights definition and a session number used in the transfer process, and verifies that the rights definition used in the transfer process has not been tampered with, using a token exchange format received from the first user device. 2. An electronic rights distribution system according to claim 1. (Additional note 3) An issuer device for use in an electronic right distribution system using an originality assurance method for electronic rights, the issuer device having an issuer device, a user device, and a ticket gate device, the issuer device comprising: an issuance processing unit that transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and receives from the user device an electronic signature by the user device for a rights definition and a session number; An issuer device comprising: (Additional note 4) The user device has an issuer device, a user device, and a ticket gate device, and is used in an electronic right distribution system using an originality assurance method for electronic rights, a transfer processing unit that transmits to another user device an electronic signature by the user device for the rights definition and the session number, and verifies that the rights definition has not been tampered with by using a token exchange format received from the other user device; A user device comprising: (Additional note 5) An electronic right distribution system using an originality assurance method for electronic rights, the electronic right distribution system having an issuer device, a user device, and a ticket gate device, the ticket gate device comprising: an exercise processing unit that transmits to the user device an electronic signature by the ticket gate device for a rights definition and a session number, and verifies that the rights definition has not been tampered with by using a token exchange format received from the user device; A ticket gate device comprising: (Additional note 6) An electronic right distribution method in an electronic right distribution system having an issuer device, a user device, and a ticket gate device, and using a method for guaranteeing the originality of electronic rights, comprising: During the issuing process, The issuer device transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and the user device transmits to the issuer device an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device; In the exercise process, The ticket gate device transmits to the user device a digital signature by the ticket gate device for the rights definition and session number used in the exercise process, and verifies that the rights definition used in the exercise process has not been tampered with by using a token exchange format received from the user device. Electronic rights distribution methods. (Additional note 7) A non-transitory storage medium storing a program for causing a computer to function as the issuance processing unit in the issuer device described in Appendix 3, the transfer processing unit in the user device described in Appendix 4, or the exercise processing unit in the ticket gate device described in Appendix 5.

[0111] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0112] 100 Issuer Device 110 Communications Department 120 Issuance Processing Unit 130 Storage section 200 User equipment 210 Communications Department 220 Issuance Processing Unit 230 Transfer Processing Department 240 Exercise Processing Unit 250 Storage section 300 Ticket gate equipment 310 Communications Department 320 Exercise Processing Unit 330 Storage section 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device

Claims

1. An electronic right distribution system having an issuer device, a user device, and a ticket gate device, and using a method for guaranteeing the originality of electronic rights, During the issuing process, The issuer device transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and the user device transmits to the issuer device an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device; In the exercise process, The ticket gate device transmits to the user device an electronic signature by the ticket gate device for the rights definition and session number used in the exercise process, and verifies that the rights definition used in the exercise process has not been tampered with by using a token exchange format received from the user device. Electronic Rights Distribution System.

2. In a transfer process from a first user device to a second user device, The second user device transmits to the first user device a digital signature by the second user device for a rights definition and a session number used in the transfer process, and verifies that the rights definition used in the transfer process has not been tampered with, using a token exchange format received from the first user device.

2. An electronic rights distribution system according to claim 1.

3. An issuer device for use in an electronic right distribution system using an originality assurance method for electronic rights, the issuer device having an issuer device, a user device, and a ticket gate device, the issuer device comprising: an issuance processing unit that transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and receives from the user device an electronic signature by the user device for a rights definition and a session number; An issuer device comprising:

4. The user device has an issuer device, a user device, and a ticket gate device, and is used in an electronic right distribution system using an originality assurance method for electronic rights, a transfer processing unit that transmits to another user device an electronic signature by the user device for the rights definition and the session number, and verifies that the rights definition has not been tampered with by using a token exchange format received from the other user device; A user device comprising:

5. An electronic right distribution system using an originality assurance method for electronic rights, the electronic right distribution system having an issuer device, a user device, and a ticket gate device, the ticket gate device comprising: an exercise processing unit that transmits an electronic signature by the ticket gate device for a rights definition and a session number to the user device, and verifies that the rights definition has not been tampered with by using a token exchange format received from the user device; A ticket gate device comprising:

6. An electronic right distribution method in an electronic right distribution system having an issuer device, a user device, and a ticket gate device, and using a method for guaranteeing the originality of electronic rights, comprising: During the issuing process, The issuer device transmits to the user device an electronic signature by a tamper-resistant certifier for the public key of the issuer device, and the user device transmits to the issuer device an electronic signature by the user device for a rights definition and a session number, and verifies that the rights definition has not been tampered with using a token exchange format received from the issuer device; In the exercise process, The ticket gate device transmits to the user device an electronic signature by the ticket gate device for the rights definition and session number used in the exercise process, and verifies that the rights definition used in the exercise process has not been tampered with by using a token exchange format received from the user device. Electronic rights distribution methods.

7. A program for causing a computer to function as the issuance processing unit in the issuer device described in claim 3, the transfer processing unit in the user device described in claim 4, or the exercise processing unit in the ticket gate device described in claim 5.

Images