Management device and management method

Abstract

To simplify the verification of transactions while securing reliability in data transactions using a block chain in a mobile communication system.SOLUTION: Each of a plurality of management devices 1 for configuring a P2P network NW and provided with a UDR device 11 comprises: a first acquisition unit 130 for acquiring the transaction generated by a communication terminal 3 having been authenticated by AKA authentication using SIM from another management device 1 via the P2P network NW; and a block chain management unit 13 which, by taking the fact that the communication terminal 3 has been authenticated by AKA authentication as the proof of identify of the sender of a digital asset included in a transaction, generates a block including the transaction, performs consensus building in the P2P network NW regarding the adoption of the block, and adds the consensus-agreed block to the block chain.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a management device and a management method, and in particular to a management technique for a blockchain in a mobile communication system. [Background technology]

[0002] Conventionally, electronic signatures using public key cryptography have been used in blockchain technology. FIG. 8 is a diagram for explaining the public key cryptography using conventional blockchain technology. As shown in FIG. 8, data sender A obtains the public key of destination B that is made public by destination B, and transmits data encrypted with destination B's public key. Destination B decrypts the transmitted data with its own private key to obtain the transmitted data.

[0003] Digital signatures are also used to identify and prove who created the data. Specifically, the authenticity of the transmitted data, i.e., the transaction, is verified by encrypting the hash value of the data with sender A's private key and combining it with a signature. If the signature portion cannot be decrypted with sender A's public key, it may be someone else's signature. Also, when compared with the hash value of the received data, if the hash values ​​are different, the content has been tampered with.

[0004] As shown in Figure 8, in a transaction based on a conventional UTXO (Unspent Transaction Output), the fields indicating the transaction input store the public key of sender A and the digital signature of sender A. In addition, the field indicating the transaction output stores the public key of destination B. The identity of sender A is verified using the public key and digital signature of sender A stored in the transaction. Verifying such a transaction requires a high computational load.

[0005] In a mobile communication system, SIM authentication is performed between a SIM card of a communication terminal UE and a core network as shown in Fig. 7. For example, in the 5G AKA (Authentication and Key Agreement) protocol defined in 3GPP TS 33.501 6.1.3.2 Authentication procedure for 5G AKA, a common secret key is shared between a communication terminal UE equipped with a SIM and a UDR (Unified Data Repository).

[0006] Authentication is performed in the AMF (Access and Mobility Management Function) of the core network. If the common secret keys of the communication terminal UE and the UDR match, authentication of the communication terminal is successful, and then the communication terminal UE transmits a location registration signal to the core network, and starts communication when the location registration process is completed.

[0007] In a mobile communication system, the network from the communication terminal UE to the AMF on the core network side and even the UDR is a closed network, so the shared secret key required for AKA authentication by SIM is not leaked to the outside, and security is highly reliable.

[0008] In a mobile communication system, before starting data communication, a communication terminal UE is authenticated by AKA authentication using a SIM in advance. In particular, when data is exchanged using blockchain in a mobile communication system, even if the communication terminal UE already has AKA authentication established, the identity of the creator of the transaction is confirmed using a digital signature, making the authentication process redundant.

[0009] For example, in Patent Document 1, in a communication system in which communication between a server and a client is performed using a public key infrastructure, the client confirms the security of the server's public key via a blockchain. After that, the client decrypts data encrypted with the server's private key using the server's public key, the client encrypts the data using the server's public key and transmits it to the server, and the server decrypts the encrypted data using the server's private key.

[0010] In this way, the technology disclosed in Patent Document 1 makes it possible to perform key authentication by a public key infrastructure using blockchain technology. However, in the technology disclosed in Patent Document 1, when data is exchanged using blockchain in a mobile communication system, AKA authentication by SIM is still performed, and the identity of the data creator is further confirmed when verifying the transaction. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] Patent No. 6340107 Summary of the Invention [Problem to be solved by the invention]

[0012] As such, with conventional technologies, it has been difficult to simplify transaction verification while ensuring reliability in data exchanges using blockchain in mobile communication systems.

[0013] The present invention has been made to solve the above-mentioned problems, and aims to simplify transaction verification while ensuring reliability in data exchanges using blockchain in mobile communication systems. [Means for solving the problem]

[0014] In order to solve the above-mentioned problems, the management device of the present invention is a plurality of management devices that constitute a peer-to-peer network, each of which has an integrated data repository, and includes a first acquisition unit that acquires a first transaction generated by a first communications terminal that has been authenticated by AKA authentication using a SIM from other management devices via the peer-to-peer network, and a blockchain management unit that uses the fact that the first communications terminal has been authenticated by AKA authentication as proof of the identity of the sender of the digital asset included in the first transaction, generates a first block including the first transaction, forms a consensus in the peer-to-peer network on the adoption of the first block, and adds the first block on which the consensus has been formed to a blockchain.

[0015] In addition, in the management device of the present invention, the integrated data repository may include a first memory unit that stores subscriber identification information of a second communication terminal and identification information of an access and mobility management device that performed the AKA authentication of the second communication terminal, and further includes a second acquisition unit that acquires a second transaction generated by the second communication terminal that has been authenticated by the AKA authentication from the second communication terminal via a core network connecting to the device itself, and the integrated data repository may include a second memory unit that stores the second transaction acquired by the second acquisition unit in association with the subscriber identification information and the identification information of the access and mobility management device, and further includes a sending unit that reads out the second transaction stored in the second memory unit and sends it to multiple other management devices via the peer-to-peer network.

[0016] In addition, in the management device of the present invention, the second acquisition unit may acquire the second transaction from the second communications terminal when the identification information of the access and mobility management device that performed the AKA authentication of the second communications terminal is stored in the first memory unit.

[0017] In addition, in the management device of the present invention, the destination of the digital assets included in each of the first transaction and the second transaction may be a communications terminal identified by subscriber identification information stored in the first memory unit of an integrated data repository provided in the management device itself, or in the first memory unit of an integrated data repository provided in any of the other multiple management devices.

[0018] In addition, in the management device of the present invention, each of the first transaction and the second transaction may have an input field and an output field for managing the digital asset with input and output, the input field may store a reference to an unused transaction output, and the output field may store the transfer amount of the digital asset and the transfer destination address.

[0019] In order to solve the above-mentioned problems, the management method of the present invention is a management method that is executed by each of multiple management devices that constitute a peer-to-peer network, each of which has an integrated data repository, and includes a first acquisition step of acquiring a first transaction generated by a first communications terminal that has been authenticated by AKA authentication using a SIM from other management devices via the peer-to-peer network, and a blockchain management step of using the fact that the first communications terminal has been authenticated by AKA authentication as proof of the identity of the sender of the digital asset included in the first transaction, generating a first block including the first transaction, forming a consensus in the peer-to-peer network on the adoption of the first block, and adding the first block on which the consensus has been formed to a blockchain.

[0020] In addition, the management method of the present invention may further include a first storage step in which the integrated data repository stores subscriber identification information of a second communication terminal and identification information of an access and mobility management device that performed the AKA authentication of the second communication terminal in a first memory unit; a second acquisition step in which the integrated data repository acquires a second transaction generated by the second communication terminal that has been authenticated by the AKA authentication from the second communication terminal via a core network connecting to the device itself; a second storage step in which the integrated data repository stores the second transaction acquired in the second acquisition step in a second memory unit in association with the subscriber identification information and the identification information of the access and mobility management device; and a sending step in which the integrated data repository reads out the second transaction stored in the second storage unit and sends it to multiple other management devices via the peer-to-peer network.

[0021] In addition, in the management method of the present invention, the second acquisition step may acquire the second transaction from the second communications terminal when the identification information of the access and mobility management device that performed the AKA authentication of the second communications terminal is stored in the first memory unit.

[0022] In addition, in the management method of the present invention, the destination of the digital assets included in each of the first transaction and the second transaction may be a communications terminal identified by subscriber identification information stored in the first memory unit of an integrated data repository provided in the device itself, or in the first memory unit of an integrated data repository provided in any of the other multiple management devices. Effect of the Invention

[0023] According to the present invention, the fact that the first communications terminal has been authenticated by AKA authentication is used as proof of the identity of the sender of the digital assets included in the first transaction, a first block including the first transaction is generated, a consensus is reached in the peer-to-peer network regarding the adoption of the first block, and the first block on which consensus has been reached is added to the blockchain. This makes it possible to simplify transaction verification while ensuring the reliability of data exchanges using the blockchain in a mobile communications system. [Brief description of the drawings]

[0024] [Figure 1] FIG. 1 is a block diagram showing a configuration of a management system including a management device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing a configuration of a management device according to the present embodiment. [Diagram 3] FIG. 3 is a block diagram showing a hardware configuration of the management device according to the present embodiment. [Figure 4] FIG. 4 is a block diagram showing a data structure of a transaction stored in the management device according to the present embodiment. [Diagram 5] FIG. 5 shows an operation sequence of the management system according to the present embodiment. [Figure 6] FIG. 6 is a flowchart showing a block generation process in the management device according to the present embodiment. [Figure 7] FIG. 7 is a diagram for explaining the transmission of digital assets using blockchain technology according to a conventional example. [Figure 8] FIG. 8 is a diagram for explaining the transmission of digital assets using blockchain technology according to a conventional example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] BEST MODE FOR CARRYING OUT THE PRESENT DISCLOSURE Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. [Management system configuration] First, an overview of a management system including management devices 1a, 1b, ..., 1n according to an embodiment of the present invention will be described. The management system according to the present embodiment manages transactions of digital assets using blockchain in a mobile communication system.

[0026] 1, in the management system, a plurality of management devices 1a, 1b, . . . , 1n (n is a positive integer) are connected to a peer-to-peer (P2P) network NW as pre-authorized participating nodes. Each of the management devices 1a, 1b, 1n includes a Unified Data Repository (UDR) device 11a, 11b, 11n.

[0027] Moreover, each of the management devices 1a, 1b, 1n included in the management system according to this embodiment is connected to AMFs 2a, 2b, 2n, which are functions of a core network on the C-plane for subscriber authentication, security, and location information management, via a network L. The networks between each of the communication terminals 3a, 3b, 3n, the AMFs 2a, 2b, 2n, and the management devices 1a, 1b, 1n including the UDR devices 11a, 11b, 11n are each configured as a closed network.

[0028] In this embodiment, each of the management devices 1a, 1b, and 1n is provided in a mobile communication system that complies with the 5G communication standard. Also, the management devices 1a, 1b, and 1n exist for each of the UDR devices 11a, 11b, and 11n provided in the mobile communication system. The management devices 1a, 1b, and 1n may be owned by different telecommunications carriers, and each telecommunications carrier may own some of the multiple management devices 1a, 1b, and 1n.

[0029] The UDR devices 11a, 11b, and 11n are C-plane devices that centrally manage data related to the subscribers of the communication terminals 3a, 3b, and 3n in the mobile communication system. Although the details of the configuration will be described later, the UDR devices 11a, 11b, and 11n manage profile information, service settings, and security information of users who are subscribers. Furthermore, the UDR devices 11a, 11b, and 11n according to this embodiment store transactions associated with the subscriber profiles.

[0030] The communication terminals 3a, 3b, and 3n each include a SIM 30 and are realized as a mobile communication terminal such as a smartphone, a PDA (Personal Digital Assistant), a tablet computer, a laptop computer (a so-called notebook computer), etc. The communication terminals 3a, 3b, and 3n have the same configuration and may be collectively referred to as "communication terminal 3."

[0031] The communication terminals 3a, 3b, and 3n can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output I / O device connected via a bus, and a program that controls these hardware resources. The main memory device stores in advance programs that allow the processor to perform various controls and calculations. The processor and the main memory device can execute various processes such as AKA authentication, location registration request processing, and transaction generation.

[0032] For example, the SIM 30 installed in the communication terminal 3a stores a contract profile of a user A who has a contract with a communication carrier. The contract profile of the SIM 30 stores subscriber identification information of the user, and includes individual identifier information such as a subscriber identification number (IMSI: International Mobile Subscriber Identity) assigned to a mobile phone line contract, a telephone number of the user who is a subscriber (MSISDN: Mobile Subscriber International Subscriber Directory Number), a SIM card number (ICCID: Integrated Circuit Card Identifier), and a common secret key / shared key encryption for AKA authentication. Similarly, the SIM 30 of the communication terminals 3b and 3n stores subscriber identification information of users B and N, respectively.

[0033] Each of the communication terminals 3a, 3b, 3n performs AKA authentication of the communication terminals 3a, 3b, 3n on the C-plane between the AMFs 2a, 2b, 2n of the core network and the URD devices 11a, 11b, 11n via a wireless access network not shown, for example, in accordance with the 5G AKA protocol via a closed network L.

[0034] Furthermore, each of the communication terminals 3a, 3b, 3n authenticated by AKA authentication using the SIM 30 performs location registration processing on the C-plane between the AMFs 2a, 2b, 2n of the core network and the URD devices 11a, 11b, 11n via the closed network L. The AKA authentication ensures the legitimacy of the users A, B, N of the communication terminals 3a, 3b, 3n and the legitimacy of the network, and also ensures the confidentiality and security of the communication contents.

[0035] In this embodiment, when a transaction is created at an AKA authenticated communication terminal 3a, 3b, 3n using a SIM 30, the creator of the transaction is authenticated to be each of the communication terminals 3a, 3b, 3n, i.e., users A, B, N of the communication terminals 3a, 3b, 3n. In this embodiment, the fact that the communication terminal 3 has been authenticated by AKA authentication is used as proof of the identity of the sender of the digital asset included in the transaction.

[0036] The management system according to the present embodiment deals with a permission-based consortium blockchain in which only specific management devices 1a, 1b, and 1n are participating nodes. The number of participating nodes is not limited to three. In addition, through the P2P network NW provided in the mobile communication system having the above-mentioned configuration, users A, B, and N of communication terminals 3a, 3b, and 3n can send and receive digital assets such as virtual currency, or can trade and transfer ownership by tokenizing digital assets.

[0037] Hereinafter, the management devices 1a, 1b, and 1n each have the same configuration and may be collectively referred to as the management device 1. Similarly, the UDR devices 11a, 11b, and 11n each have the same configuration and may be collectively referred to as the UDR device 11. The AMFs 2a, 2b, and 2n each have the same configuration and may be collectively referred to as the AMF 2.

[0038] [Management device function block] Next, the configuration of the management device 1 included in the management system according to the present embodiment will be described with reference to the block diagram of FIG.

[0039] The management device 1 includes a UDR device 11, a transaction management unit 12, a blockchain management unit 13, and a blockchain storage unit 14.

[0040] The UDR device 11 includes a first management unit 110, a first storage unit 111, and a second storage unit 112. As shown in Fig. 2, the UDR device 11 is connected to an AMF 2 of a core network via a network L constituting a closed network. Furthermore, the AMF 2 is connected to a Security Edge Access Function (SEAF) 4 of the core network via the network L. The UDR device 11 is also connected to an Authentication Server Function (AUSF) 5 of the core network via the network L.

[0041] The AMF 2 executes the authentication process for the communication terminal 3, including access management, mobility management, and AKA authentication processing.

[0042] SEAF4 is a network function that works in cooperation with AMF2 to ensure the security and privacy of communications by, for example, allowing access to the mobile communications network, applying security policies, and encrypting and decrypting data by the communications terminal 3, and supports AKA authentication of the communications terminal 3 at the security edge.

[0043] The AUSF 5 is a network function that cooperates with the UDR device 11 to perform authentication processing of the communication terminal 3, including generation and distribution of a common secret key in AKA authentication.

[0044] The first management unit 110 manages AKA authentication using the SIM 30 of the communication terminal 3. Specifically, the first management unit 110 provides subscriber profile information of the communication terminal 3 and returns a response to an AKA authentication request from the AUSF 5. In addition, the first management unit 110 manages the subscriber profile and authentication information of the communication terminal 3.

[0045] The first storage unit 111 stores subscriber identification information of the communication terminal 3 (second communication terminal) and identification information of the AMF (access and mobility management device) 2 that performed AKA authentication of the communication terminal 3. Fig. 4 is a block diagram showing the data structure of the first storage unit 111. The subscriber profile table t1 in Fig. 4 is stored in the first storage unit 111, and each item of the subscriber profile of the communication terminal 3 is stored in each field. As an example, the subscriber profile table t1 has fields for a subscriber identification number, a telephone number, a service type, and location information.

[0046] The subscriber identification number field stores the IMSI of the communication terminal 3. The telephone number field stores the MSISDN of the user of the communication terminal 3. The service type field stores items related to the type of service for which the user of the communication terminal 3 has a contract with the communication carrier, such as data communication, emergency call, voice call, and SMS. The subscriber profiles stored in these fields are registered in advance by entering a service order, for example, when the user of the communication terminal 3 has a contract with the communication carrier.

[0047] Furthermore, the subscriber profile table t1 is provided with a field for location information, in which is stored the identification information "AMF#1" of the AMF2 that performed mobility management and AKA authentication of the communication terminal 3. The identification information of the AMF2 stored in the field for location information indicates that the communication terminal 3 has been authenticated by AKA authentication. The information stored in the field for location information is updated when the communication terminal 3 moves to a different communication area, when the communication terminal 3 starts communication, etc.

[0048] For example, the communication terminal 3a is linked to the subscriber A, who is the subscriber, by the subscriber identification information in the subscriber profile table t1. This allows the communication terminal 3a to be regarded as user A. Furthermore, the presence information in the subscriber profile table t1 allows confirmation that the communication terminal 3a has been AKA authenticated. Furthermore, because the communication terminal 3a has been AKA authenticated, the legitimacy of the communication terminal 3a linked to user A is proven. Furthermore, because the communication terminal 3a has been AKA authenticated, it is ensured that the communication of the communication terminal 3a is performed with a reliable network. Furthermore, because the communication terminal 3a has been AKA authenticated, the confidentiality and security of the communication contents of the communication terminal 3a are ensured.

[0049] 1, the transaction manager 12 includes a second acquirer 120, a generator 121, and a sender 122. The transaction manager 12 manages transactions sent from the communication terminal 3 via a core network connected to the transaction manager 12.

[0050] The second acquisition unit 120 acquires a transaction (second transaction) generated by the communication terminal 3 that has been authenticated by AKA authentication from the communication terminal 3 via a core network connecting to the communication terminal 3. In addition, the second acquisition unit 120 can acquire the transaction from the communication terminal 3 when the first storage unit 111 stores identification information of the AMF 2 that performed the AKA authentication of the communication terminal 3.

[0051] The second acquisition unit 120 can acquire transactions entered by an AKA authenticated communication terminal 3 by performing HTTP communication or the like and accessing the subscriber profile of the communication terminal 3 on the C-plane through customer control.

[0052] The generation unit 121 associates the transaction acquired by the second acquisition unit 120 with the subscriber identification information stored in the first memory unit 111 and the identification information of the AMF2 that performed AKA authentication, and stores it in the second memory unit 112.

[0053] As shown in FIG. 4, the second storage unit 112 stores a transaction table t2 associated with the subscriber profile table t1. The transaction table t2 is provided with an input field and an output field for managing transactions by input and output. The transaction may have a data structure based on the UTXO type. Specifically, the transaction table t2 may be provided with the fields of "version information", "number of inputs", "input", "number of outputs", "output", and "transaction lock time".

[0054] The input field stores a reference to an unspent transaction output and a sequence number. The reference to an unspent transaction output is reference information of a previous UTXO. In this embodiment, the identity of the sender of the digital asset transacted in the transaction is verified by the communication terminal 3 that generated the transaction being AKA authenticated. Therefore, in the input field, it is possible to omit storing the electronic signature of the communication terminal 3 for verifying the identity of the transaction. Also, in the input field, it is possible to omit the public key of the communication terminal 3.

[0055] The output field stores the remittance amount of the digital asset and the remittance destination address. The remittance destination address, which is the destination of the digital asset included in the transaction, is the communication terminal 3 specified by the subscriber identification information stored in the first storage unit 111 of the UDR device 11 included in the own device or in the first storage unit 111 of the UDR device 11 included in any of the other multiple management devices 1 on the P2P network NW.

[0056] That is, information on the communication terminal 3 specified by the subscriber identification information stored in the first storage unit 111 of the UDR device 11 of any one of the management devices 1 on the P2P network NW is stored in the remittance destination address. For example, the public key of the remittance destination communication terminal 3 or other identification information of the communication terminal 3 can be stored as the remittance destination address.

[0057] In this way, when a transaction that has occurred and been generated in the communications terminal 3 is acquired by the second acquisition unit 120, the generation unit 121 adds a transaction table t2 to the subscriber profile table t1. The transaction table t2 is associated with the subscriber identification information and location information of the subscriber profile table t1, thereby proving that the creator of the transaction is the communications terminal 3a, that is, the user A linked to the communications terminal 3a.

[0058] The sending unit 122 reads out the transaction (second transaction) stored in the second storage unit 112, and sends it via the P2P network NW to a plurality of other management devices 1. The sending unit 122 broadcasts the transaction to the P2P network NW.

[0059] The blockchain management unit 13 includes a first acquisition unit 130, a verification unit 131, and a second management unit 132. The blockchain management unit 13 generates a block including a transaction broadcast via the P2P network NW, forms a consensus, and adds the block for which the consensus has been formed to the blockchain.

[0060] The first acquisition unit 130 acquires a transaction (first transaction) generated by a communication terminal 3 (first communication terminal) that has been authenticated by AKA authentication using a SIM from another management device 1 via the P2P network NW. The first acquisition unit 130 acquires the transaction broadcast on the P2P network NW.

[0061] The verification unit 131 uses the fact that the communication terminal 3 has been authenticated by AKA authentication as proof of the identity of the sender of the digital assets included in the transaction, and verifies the transaction. Specifically, the verification unit 131 performs verification other than proof of the identity of the transaction, for example, verifying whether the input of the transaction has already been paid in the past. Furthermore, the verification unit 131 verifies that the total amount of the inputs of the transaction is not greater than the total amount of the outputs. The verification unit 131 performs verification based on the output reference stored in the input field of the transaction, the sequence number, the remittance amount stored in the output field, and the like.

[0062] The second management unit 132 generates a block (first block) including the transaction verified by the verification unit 131, forms a consensus in the P2P network NW regarding the adoption of the block, and adds the block for which the consensus has been formed to the blockchain. When generating a block, the second management unit 132 hashes the hash value of the immediately preceding block together with transactions that occurred within a certain period of time, and performs calculations until the output hash value and nonce value meet a predetermined condition. In practice, the participating node that first finds a nonce value that meets the predetermined condition will generate a new block.

[0063] The second management unit 132 can form a consensus using, for example, the well-known PoW (Proof of Work) or PoS (Proof of Stake). Note that the second management unit 132 does not generate a block of a transaction that has failed to be verified by the verification unit 131.

[0064] The blockchain storage unit 14 adds and stores the block for which consensus has been reached to the blockchain. The blockchain storage unit 14 stores the same data in all management devices 1a, 1b, and 1n included in the management system, and a new block is added every time a block is generated and consensus is reached.

[0065] [Hardware configuration of management device] Next, an example of a hardware configuration for realizing the management device 1 having the above-mentioned functions will be described with reference to FIG.

[0066] As shown in FIG. 3, the management device 1 can be realized, for example, by a computer having a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program that controls these hardware resources.

[0067] The main memory device 103 stores in advance programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 realize the various functions of the management device 1, such as the UDR device 11, the transaction management unit 12, and the blockchain management unit 13 shown in FIG.

[0068] The communication interface 104 is an interface circuit for connecting the management device 1 to various external electronic devices via a network. The communication interface 104 realizes the first acquisition unit 130, the second acquisition unit 120, and the sending unit 122 shown in FIG.

[0069] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or a flash memory as the storage medium.

[0070] The auxiliary storage device 105 has a program storage area for storing the management program executed by the management device 1. The auxiliary storage device 105 also has an area for storing a consensus building program for managing the blockchain and a transaction generation program. The first storage unit 111, the second storage unit 112, and the blockchain storage unit 14 described in FIG. 2 are realized by the auxiliary storage device 105. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data and programs.

[0071] The input / output I / O 106 is an input / output device that inputs signals from an external device and outputs signals to an external device.

[0072] [Operation sequence of the management system] Next, the operation of a management system including a management device 1 having the above-mentioned configuration will be described with reference to the sequence diagram of Fig. 4 and the flowchart of Fig. 5. Fig. 4 is a sequence diagram showing transaction management and block generation processing performed by the management system in a mobile communication system. Fig. 5 is a flowchart explaining the consensus formation and addition processing to the blockchain performed by each of the management devices 1a, 1b, and 1n in step S21 of Fig. 4.

[0073] 4, first, the communication terminal 3a transmits a request to start AKA authentication to the AMF 2a of the core network via the wireless access network (step S1). The authentication request transmitted by the communication terminal 3a includes identification information stored in the SIM 30 of the communication terminal 3a. The AMF 2a further transmits a request to start AKA authentication to the UDR device 11a of the management device 1a (step S2).

[0074] The UDR device 11a of the management device 1a generates a common secret key and generates an authentication vector (step S3). Specifically, the first management unit 110 of the UDR device 11a generates a common secret key and provides it to the AUSF5a (AUSF5). The AUSF5a generates an authentication vector and transmits it to the AMF 2a (step S4). Next, the AUSF5a transmits a random challenge (RAND) to the communication terminal 3a to request the authentication vector (step S5).

[0075] The communication terminal 3a generates a response to the received random challenge using its own common secret key and transmits it to the AMF 2a (step S6). The AMF 2a, which has received the response, cooperates with the SEAF 4a (SEAF 4) and performs authentication based on the response received from the communication terminal 3a (step S7). Specifically, if the predicted response value (HXRES) to the random challenge generated in step S3 matches the response value (RES) calculated by the communication terminal 3a, the authentication is successful.

[0076] The AMF 2a notifies the communication terminal 3a that the authentication has been successful (step S8). Through the above processing, the communication terminal 3a is AKA authenticated, and a session key is distributed to the communication terminal 3a.

[0077] Next, the communication terminal 3a transmits a location registration request to the AMF 2a via the wireless access network (step S9). Then, the AMF 2a inquires of the UDR device 11a of the management device 1a about the user information of the communication terminal 3a (step S10). The UDR device 11a provides the AMF 2a with the user information such as the subscriber profile and authentication information of the communication terminal 3a (step S11).

[0078] Next, the AMF 2a performs a location registration process using the user information (step S12). Specifically, the AMF 2a updates the location information of the communication terminal 3a. After that, the location information of the subscriber profile of the communication terminal 3a is registered in the UDR device 11a (step S13). Specifically, the first management unit 110 registers the location information of the subscriber profile table t1 of the first storage unit 111 of the UDR device 11a.

[0079] Furthermore, the AMF 2a transmits a location registration completion notification to the communications terminal 3a (step S14). Through the above processing, the location registration processing of the AKA authenticated communications terminal 3a is completed.

[0080] Next, a digital asset transaction occurs with user A, a subscriber of communication terminal 3a, as the sender and user B, a subscriber of communication terminal 3b, as the destination. Specifically, a transaction occurs in which virtual currency is transferred from communication terminal 3a linked to user A to communication terminal 3b linked to user B.

[0081] First, a transaction is generated in the communication terminal 3a (step S15). More specifically, the communication terminal 3a performs HTTP communication to access the subscriber profile of the communication terminal 3a stored in the UDR device 11 of the management device 1a, and inputs the transaction (step S16).

[0082] Next, the second acquisition unit 120 of the management device 1a acquires the transaction from the communication terminal 3a (step S17). In step S17, the second acquisition unit 120 acquires the transaction from the communication terminal 3a when the identification information of the AMF 2a that performed the AKA authentication of the communication terminal 3a is stored in the location information of the subscriber profile in the first storage unit 111.

[0083] Next, the generation unit 121 of the management device 1a generates a transaction table (step S18). Specifically, the generation unit 121 generates the transaction table t2 shown in FIG. 4. The generated transaction table t2 is stored in the second storage unit 112 (step S19). That is, the transaction management unit 12 stores the transaction in the second storage unit 112 in association with the subscriber identification information of the communication terminal 3a stored in the first storage unit 111 of the UDR device 11a.

[0084] Next, the sending unit 122 of the management device 1a reads out the transaction stored in the second storage unit 112 and broadcasts it to the P2P network NW (step S20). The transaction broadcast in step S20 was generated by the AKA-authenticated communication terminal 3a, and therefore the identity of the sender of the digital asset included in the transaction is authenticated.

[0085] Next, the blockchain management unit 13 of the management devices 1a, 1b, and 1n uses the fact that the communication terminal 3a has been authenticated by AKA authentication as proof of the identity of the sender of the digital assets included in the transaction, generates a block including the transaction, reaches a consensus in the P2P network NW regarding the adoption of the block, and adds the agreed-upon block to the blockchain (step S21).

[0086] Here, the processing of step S21, including block generation by the blockchain management unit 13, will be described with reference to the flowchart of FIG. 5. First, the first acquisition unit 130 acquires a transaction broadcast via the P2P network NW (step S210). Next, the verification unit 131 performs verification other than the identity of the sender of the digital assets included in the transaction (step S211). For example, the verification unit 131 verifies whether the input of the transaction has already been paid in the past. Furthermore, the verification unit 131 verifies that the total amount of the inputs of the transaction is not greater than or equal to the total amount of the outputs.

[0087] Next, the second management unit 132 generates a block including the transaction whose transaction content was verified in step S211 (step S212). When generating the block in step S212, the second management unit 132 hashes the hash value of the immediately preceding block together with transactions that occurred within a certain period of time, and performs calculations until the output hash value and nonce value meet a predetermined condition.

[0088] Next, the second management unit 132 performs consensus formation in the P2P network NW regarding the adoption of the generated block (step S213). The second management unit 132 can perform consensus formation using, for example, the well-known PoW. The block for which consensus has been formed in step S213 is added to the blockchain and stored in the blockchain storage unit 14 (step S214).

[0089] When a block is added to the blockchain in step S214, the communication terminal 3b, which is the destination of the digital assets, can receive the digital assets of the remittance amount stored in the output field of the transaction. For example, the remittance destination address can be confirmed by accessing a wallet or wallet application provided in the communication terminal 3b. When the communication terminal 3b receives the digital assets, it can do so through secure communication that has undergone AKA authentication.

[0090] As described above, according to the management device 1 of this embodiment, the fact that the communication terminal 3 has been authenticated by AKA authentication is used as proof of the identity of the sender of the digital assets included in the transaction, a block including the transaction is generated, a consensus is reached in the P2P network NW regarding the adoption of the block, and the block on which the consensus has been reached is added to the blockchain. Therefore, in data exchange using the blockchain in a mobile communication system, it is possible to simplify the verification of transactions while ensuring reliability.

[0091] In the embodiment described above, the management system complies with the 5G communication system, but the communication standard may be 6G or LTE.

[0092] In the embodiment described above, a case has been exemplified in which a node among the management devices 1a, 1b, and 1n constituting the P2P network NW generates a block is determined using a nonce value. However, other mechanisms may be adopted for the process of generating blocks and forming consensus. For example, the management devices 1a, 1b, and 1n that satisfy certain conditions based on time information may generate blocks. Alternatively, any one of the management devices 1a, 1b, and 1n may be designated as a participating node of a preset leader, or another mining device may be used to generate blocks.

[0093] In the embodiment described above, the case where the blockchain is stored in the blockchain storage unit 14 has been described, but the management device 1 may further include a storage unit that stores unspent transaction outputs (UTXOs). In this case, the verification unit 131 can refer to the storage unit that stores UTXOs to verify transaction contents other than the identity of the sender of the transaction.

[0094] The above describes an embodiment of the management device and management method of the present invention, but the present invention is not limited to the described embodiment, and various modifications that may be envisioned by a person skilled in the art may be made within the scope of the invention described in the claims. [Explanation of symbols]

[0095] 1, 1a, 1b, 1n...management device, 2, 2a, 2b, 2n...AMF, 3, 3a, 3b, 3n...communication terminal, 30...SIM, 4...SEAF, 5...AUSF, 11...UDR device, 110...first management unit, 111...first memory unit, 112...second memory unit, 12...transaction management unit, 120...second acquisition unit, 121...generation unit, 122...sending unit, 13...blockchain management unit, 130...first acquisition unit, 131...verification unit, 132...second management unit, 14...blockchain memory unit, 101...bus, 102...processor, 103...main memory unit, 104...communication interface, 105...auxiliary memory unit, 106...input / output I / O, NW...P2P network, L...network.

Claims

1. A plurality of management devices each comprising an integrated data repository and constituting a peer-to-peer network, a first acquisition unit that acquires a first transaction generated by a first communication terminal that has been authenticated by AKA authentication using a SIM from another management device via the peer-to-peer network; a blockchain management unit that uses the fact that the first communication terminal has been authenticated by the AKA authentication as proof of the identity of the sender of the digital asset included in the first transaction, generates a first block including the first transaction, forms a consensus in the peer-to-peer network regarding the adoption of the first block, and adds the first block on which the consensus has been formed to a blockchain; A management device comprising:

2. 2. The management device according to claim 1, the integrated data repository includes a first storage unit configured to store subscriber identification information of a second communication terminal and identification information of an access and mobility management device that performed the AKA authentication of the second communication terminal; Further, a second acquisition unit is provided that acquires a second transaction generated by the second communication terminal that has been authenticated by the AKA authentication from the second communication terminal via a core network connected to the device itself; the integrated data repository includes a second storage unit configured to store the second transaction acquired by the second acquisition unit in association with the subscriber identification information and the identification information of the access and mobility management device; The second transaction is stored in the second storage unit. The second transaction is read out from the second storage unit and transmitted to a plurality of other management devices via the peer-to-peer network. A management device comprising:

3. 3. The management device according to claim 2, The second acquisition unit acquires the second transaction from the second communication terminal when the identification information of the access and mobility management device that performed the AKA authentication of the second communication terminal is stored in the first storage unit. A management device comprising:

4. 3. The management device according to claim 2, The destination of the digital assets included in each of the first transaction and the second transaction is a communication terminal specified by subscriber identification information stored in the first storage unit of an integrated data repository included in the own device or in the first storage unit of an integrated data repository included in any of the other multiple management devices. A management device comprising:

5. 5. The management device according to claim 4, Each of the first transaction and the second transaction comprises an input field and an output field for managing the digital asset at the input and output; The input field stores a reference to an unspent transaction output; The output field stores the amount of the digital asset to be transferred and the transfer destination address. A management device comprising:

6. A management method executed by each of a plurality of management devices constituting a peer-to-peer network, each of the management devices having an integrated data repository, the method comprising: a first acquisition step of acquiring a first transaction generated by a first communication terminal that has been authenticated by AKA authentication using a SIM from another management device via the peer-to-peer network; a blockchain management step of using the fact that the first communication terminal has been authenticated by the AKA authentication as proof of the identity of the sender of the digital asset included in the first transaction, generating a first block including the first transaction, forming a consensus in the peer-to-peer network regarding the adoption of the first block, and adding the first block on which the consensus has been formed to a blockchain; A management method comprising:

7. The management method according to claim 6, a first storage step of storing, in a first storage unit, subscriber identification information of a second communication terminal and identification information of an access and mobility management device that performed the AKA authentication of the second communication terminal by the integrated data repository; a second acquisition step of acquiring a second transaction generated by the second communication terminal that has been authenticated by the AKA authentication from the second communication terminal via a core network connected to the own device; a second storage step in which the integrated data repository stores the second transaction acquired in the second acquisition step in a second storage unit in association with the subscriber identification information and the identification information of the access and mobility management device; a sending step of reading the second transaction stored in the second storage unit and sending it to a plurality of other management devices via the peer-to-peer network; A management method comprising:

8. The management method according to claim 7, The second acquiring step acquires the second transaction from the second communication terminal when the identification information of the access and mobility management device that performed the AKA authentication of the second communication terminal is stored in the first storage unit. A management method comprising:

9. The management method according to claim 7, The destination of the digital assets included in each of the first transaction and the second transaction is a communication terminal specified by subscriber identification information stored in the first storage unit of an integrated data repository included in the own device or in the first storage unit of an integrated data repository included in any of the other multiple management devices. A management method comprising:

Images