Program, information processing apparatus and information processing method

Abstract

To provide a program, an information processing apparatus and an information processing method that can improve risk coping associated with the creation of identification information on a device or program.SOLUTION: There is provided a program that causes a computer to function to: acquire entity attribute information representing an attribute of an entity which is a device or program; accept creation from a user or the entity a creation request for entity identification information for identifying the entity; confirm the entity attribute information and / or the acquisition source of the entity attribute information or the request source of the creation request; create the entity identification information based upon a result of the confirmation; and inform the request source of the creation request of the entity attribute information.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a program, an information processing device, and an information processing method. [Background technology]

[0002] Conventionally, there is known a technology that generates identification information (so-called ID) for identifying a device or a program, and uses the generated identification information for authentication, etc. Patent Document 1 describes a server device that receives camera-specific information from a camera and generates identification information for identifying the camera. It also describes that the camera transmits an image to the server device using the generated identification information. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-151609 A Summary of the Invention [Problem to be solved by the invention]

[0004] Here, for example, when the entity to be identified by the identification information (hereinafter, simply referred to as "entity") is a device, there is a risk that the device-specific information provided for generating the device's identification information has been tampered with. There is also a risk that the device providing the device-specific information is a counterfeit device. Thus, the above-mentioned Patent Document 1 has room for improvement in terms of dealing with such risks related to the generation of identification information.

[0005] In view of the above, an object of the present invention is to provide a program, an information processing apparatus, and an information processing method that can improve risk management regarding the generation of identification information for a device or program. [Means for solving the problem]

[0006] A program according to one embodiment of the present invention provides a computer with an acquisition function for acquiring entity attribute information indicating attributes of an entity which is a device or a program, a generation reception function for receiving a request from a user or entity to generate entity identification information for identifying the entity, a confirmation function for confirming the entity attribute information and / or the source from which the entity attribute information was acquired or the source of the generation request, a generation function for generating entity identification information based on the results of the confirmation, and a notification function for notifying the source of the generation request of the entity identification information.

[0007] An information processing device according to one embodiment of the present invention includes an acquisition unit that acquires entity attribute information indicating attributes of an entity which is a device or a program, a generation receiving unit that receives a request to generate entity identification information for identifying the entity, a confirmation unit that confirms the entity attribute information and / or the source of the acquisition or generation request of the entity attribute information, a generation unit that generates entity identification information based on a result of the confirmation, an authentication receiving unit that accepts an authentication request for the entity which includes the entity identification information, and an authentication unit that authenticates the entity based on the authentication request.

[0008] An information processing method according to one embodiment of the present invention includes a computer acquiring entity attribute information indicating attributes of an entity that is a device or a program, accepting a request to generate entity identification information for identifying the entity, verifying the entity attribute information and / or the source of the entity attribute information acquisition or generation request, generating entity identification information based on the verification results, accepting an authentication request for the entity that includes the entity identification information, and authenticating the entity based on the authentication request. Effect of the Invention

[0009] According to the present invention, risk management regarding the generation of identity information of a device or program can be improved. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining an example of a system configuration of an authentication system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram for explaining an overview of an authentication system according to an embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram for explaining an overview of an authentication system according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a server device according to the present embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of the operation of the authentication system according to the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of the operation of the authentication system according to the present embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a hardware configuration of a server device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] A preferred embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described with reference to the accompanying drawings. In each drawing, the same reference numerals denote the same or similar configurations.

[0012] In the present invention, "part", "means", "apparatus" or "system" does not simply mean physical means, but also includes cases where the functions of the "part", "means", "apparatus" or "system" are realized by software. In addition, the functions of one "part", "means", "apparatus" or "system" may be realized by a combination of two or more physical means, devices or software modules, and the functions of two or more "parts", "means", "apparatus" or "systems" may be realized by one physical means, device or software module.

[0013] <1. System configuration> An example of the system configuration of an authentication system 1 according to this embodiment will be described with reference to Fig. 1. As shown in Fig. 1, the authentication system 1 generates identification information for identifying an entity, which is a device or a program (hereinafter also referred to as "entity identification information" or "entity ID"), and authenticates the entity using the generated identification information. In addition, when generating this entity identification information, the authentication system 1 confirms that the entity is genuine, for example, confirms the existence of the entity and / or the authenticity of the requester of the request for generation of the identification information (corresponding to identity proofing). Then, the authentication system 1 generates the entity identification information based on the result of this confirmation.

[0014] For example, there may be cases where the attributes of an entity do not include information that can uniquely identify the entity (such as a serial number) because the entity is a mass-produced product, making it difficult to uniquely identify the entity. In such cases, the authentication system 1 can confirm the existence of the entity and ensure its identity by combining the entity with a person responsible for the entity and uniquely identifying this combination.

[0015] For example, the authentication system 1 may provide a function for authenticating an entity when the entity uses a service that cooperates with the authentication system 1 (hereinafter, also referred to as an "integrated service").

[0016] The entity identification information may be, for example, any character string combining letters, numbers, symbols, etc., rather than content that is inseparably linked to the entity 200 to be identified. In other words, the entity identification information may be separable from the entity 200 to be identified. In addition, the entity identification information does not have to be information such as a character string that can be recognized by a user, as long as it can be used as an identifier.

[0017] The authentication system 1 includes a server device 100, a first entity 200a, a first manager device 300a of a person in charge of the first entity (hereinafter also referred to as the "first manager"), a second entity 200b, a second manager device 300b of a person in charge of the second entity (hereinafter also referred to as the "second manager"), and a third entity 200c. The first entity 200a, the second entity 200b, and the third entity 200c are collectively referred to as the "entity 200". The first manager device 300a and the second manager device 300b are collectively referred to as the "manager device 300". The server device 100, the entity 200, and the manager device 300 are connected to each other via a network N.

[0018] The first responsible person and the second responsible person are collectively referred to simply as the "responsible person." The responsible person may be an individual or a specific organization such as a corporation. The responsible person may also be a person entrusted by the person for whom the entity is at fault.

[0019] Authentication of an entity (hereinafter also referred to as "entity authentication") may be, for example, authentication for verifying the authenticity, real existence, integrity, and / or validity of an entity (hereinafter, these characteristics are collectively referred to as "legitimacy"). Entity authentication may be performed once or multiple times. Performing entity authentication multiple times may mean, for example, performing multi-factor authentication such as two-factor authentication using multiple authentication factors, or performing multi-stage authentication such as two-stage authentication performing authentication in stages. As another example, performing entity authentication multiple times may mean performing two or more authentications with different authentication levels.

[0020] The authentication level may represent, for example, the strength of an authentication means. The authentication level may represent, for example, whether or not the authentication is multi-factor authentication. The authentication level may represent, for example, whether or not the authentication is multi-stage authentication. The authentication level may represent, for example, whether or not the authentication is multi-path authentication.

[0021] When the entity is a device, for example, the following attributes may be considered as equivalent to the three elements of authentication (knowledge, possession, and biometrics) in entity authentication (in other words, device authentication): The device attribute information may include information indicating the following attributes. Record (knowledge): Information stored in the device's memory (e.g. variable information such as IP addresses) Possession: Hardware physically connected to the device (e.g., input / output devices such as earphones or a mouse) or data securely stored on such hardware Individual (biological) data: Unique information that allows the individual identification of a device and / or components installed in the device, information on the device manufacturer / seller, the date of device manufacture, device performance, device component configuration, and / or data characteristics of each component

[0022] The unique information of the device and the part may be, for example, a vehicle identification number of an automobile, a serial number of a device, a MAC address of a device, or characteristic information unique to a device such as an IC chip.

[0023] When the entity is a program, for example, the following attributes may be considered as equivalent to the three elements of authentication in entity authentication: The attribute information of the program may include information indicating the following attributes. Records (knowledge): Programmatic authentication information (variable information), information recorded in the memory of the device referenced by the entity (e.g., variable information such as configuration files) Possession: Other programs that work with the entity · Individual (biological organism): Data configuration and data characteristics recorded in the program as information that cannot be tampered with or erased, program version information (including the release date of each version), update date, download size and / or installation size, target OS information, program provider information, program deep link information, hash value generated using a message digest or similar from at least a portion of the program information, and information encrypted with an encryption key for at least a portion of the program information

[0024] The authentication information (in other words, credential information) used for entity authentication may be, for example, information relating to the above three elements, namely, record information relating to the above record, possession information relating to the above possession, and / or individual information relating to the above individual.

[0025] When the entity authentication uses at least one of a plurality of authentication means (e.g., when multi-factor authentication or multi-stage authentication is used), the authentication information may include, for example, authentication information for each of the plurality of authentication means. The authentication means may be, for example, a means for entity authentication based on record information, individual information, or possession information.

[0026] [Server device] The server device 100 is an information processing device capable of communicating with the entity 200 and the manager device 300. The server device 100 provides a generation function for generating an entity ID and an authentication function for authenticating the entity by executing a predetermined program.

[0027] [entity] The entity 200 is a device or a program that is the target of identification and authentication by the authentication system 1. The entity 200 may transmit, for example, information indicating the attributes of the entity (hereinafter also referred to as "entity attribute information") and / or an authentication request for entity authentication when logging in to a linked service to the server device 100 by executing a predetermined program. The entity attribute information is specifically device attribute information or program attribute information.

[0028] In addition to the above device attribute information and program attribute information, the entity attribute information may include, for example, image data of a warranty card for a device (particularly one containing information specific to the entity, such as a serial number) when the entity is a device, image data of a document such as a contract describing the entity's usage agreement, and / or image data of a receipt for the purchase of the entity, etc. Furthermore, the entity attribute information may include, for example, an electronic certificate (including an electronic signature) indicating the validity of the attributes indicated by the entity attribute information.

[0029] When the entity 200 is a device, the entity 200 may be any device, for example, a mobile device such as a smartphone, a laptop, or a tablet, a drone, a vehicle, an in-vehicle device, a home appliance, an XR headset (including a head-mounted display), or a wearable device. The entity 200 may also include, for example, an authenticator conforming to the FIDO (Fast IDentity Online) standard. The entity 200 may also include a locator function, for example, a GPS (GNSS) receiver and an inertial sensor such as a gyro sensor.

[0030] When entity 200 is a program, entity 200 may be any kind of program, and specifically may be a group of files or individual files that constitute a program, such as an executable file (e.g., an exe file or a bat file) and / or a configuration file referenced by the executable file (e.g., a config file, an INI file, an XML file, etc.).

[0031] [Responsible person device] The manager device 300 is an information processing device used by the manager, and is, for example, a mobile device such as a smartphone, a laptop, or a tablet. The manager device 300 executes a predetermined program to receive various requests from the manager, and to transmit information indicating the attributes of the manager (also called "manager attribute information") to the server device 100 in cooperation with the server device 100 and / or the entity 200.

[0032] The responsible person attribute information may include, for example, personal information of the responsible person if he / she is an individual (e.g., name, date of birth, sex, address, telephone number, and / or personal number, etc.), corporate information if the responsible person is a corporation (e.g., corporate name, location / address, contact information, etc.), knowledge information of the responsible person (password or PIN code, etc.), biometric information of the responsible person (fingerprint or facial image characteristic information, etc.), and / or possession information of the responsible person (information on the terminal device or storage medium of the responsible person device 300 possessed by the responsible person). In addition, the responsible person attribute information may include, for example, image data of a personal number card (My Number card), driver's license, passport, basic resident register card (with a user's face photo), etc. (so-called identity verification document, etc.) from which the personal information of the responsible person can be confirmed. In addition, the responsible person attribute information may include, for example, registration data from which the corporate information of the responsible person can be confirmed.

[0033] [network] The network N is composed of a wireless network or a wired network. Examples of the network N include a mobile phone network, a PHS (Personal Handy-phone System) network, a wireless LAN (Local Area Network, including communication conforming to IEEE802.11 (so-called WI / Fi (registered trademark))), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation), WiMax (registered trademark), infrared communication, visible light communication, Bluetooth (registered trademark), a wired LAN, a telephone line, a power line communication, a power line network, a network conforming to IEEE1394, etc.

[0034] The authentication system 1 may be communicably connected to, for example, a provider device (not shown) of a system that provides an integrated service (hereinafter also referred to as an "integrated system"). The provider device is an information processing device used by a provider of an integrated service and capable of communicating with a server device 100 and an entity 200. The provider device may execute a predetermined program to realize a server function that provides an integrated service to an entity.

[0035] <2. Overview> An overview of an example of the authentication system 1 will be described with reference to Figs. 2-3. As shown in Figs. 2-3, functions realized by the authentication system 1 are classified into, for example, the following four categories. In the authentication system 1, the classified functions cooperate with each other (including information cooperation and / or function cooperation; the same applies below). Entity verification function: Verifies the identity of the entity, the entity's manager, and the entity's superiors -Identifier assignment function: Generates an entity ID and assigns (associates) it to an entity Entity authentication function: Executes the authentication process for entity authentication. · Identification / authentication DB function: Generates entity IDs and manages various information related to entity authentication

[0036] In this embodiment, an example in which the server device 100 realizes the above four functions will be described, but the arrangement of these functions is not limited to this. For example, at least a part of the entity authentication function and the identification / authentication DB function may be realized by the provider device or other external devices.

[0037] With reference to Fig. 2, an example of processing when a request to generate an entity ID in the authentication system 1 is accepted will be described. In this example, an example will be described in which device A is the first entity 200a, program B is the second entity 200b, and device C is the third entity 200c. Note that in this example, an example will be described in which device A and program B are checked in combination with a responsible person, and device C is checked alone without being combined with a responsible person, but the method of checking the devices and programs is not limited to this. For example, the program may be checked alone without being combined with a responsible person.

[0038] <Generation request / information provision> (1) As shown in Fig. 2, administrator A, who is the first person in charge of device A, transmits a generation request to generate an entity ID of device A from the first person in charge device 300a to the server device 100. This generation request is assumed to include person in charge attribute information of administrator A. In addition, device A transmits its own entity attribute information to the server device 100 synchronously or asynchronously with this generation request.

[0039] The second person in charge device 300b used by the second person in charge of program B transmits a generation request to the server device 100 to generate an entity ID for program B. In this example, the second person in charge device 300b is the upper device of program B. This generation request includes the entity attribute information of program B, the person in charge attribute information of the second person in charge, and the entity attribute information of the second person in charge device 300b.

[0040] Device C transmits a generation request for generating an entity ID of its own device to server device 100. It is assumed that this generation request includes entity attribute information of device C.

[0041] The generation reception unit 111a of the server device 100 receives each of the transmitted generation requests. Furthermore, the acquisition unit 112 of the server device 100 acquires each of the transmitted entity attribute information and responsible person attribute information, and registers them in the storage unit 130. It is assumed that the acquired entity attribute information includes authentication information required for an authentication means for entity authentication, which will be described later.

[0042] <Entity verification> (2) The confirmation unit 114 of the server device 100 confirms at least one of the following (a) to (c) with respect to the entity for which an entity ID is to be generated. (A) Entity attribute information (a) Source of entity attribute information (c) Source of the generation request

[0043] In the case of device A, the confirmation unit 114 verifies the validity of the entity attribute information of (A) above, and confirms whether device A actually exists with the attributes indicated by the entity attribute information, etc. Furthermore, the confirmation unit 114 may, for example, in combination with the above (A), verify the validity of administrator A, who is the request source of (C) above, and perform identity confirmation, such as whether administrator A is an actual person.

[0044] In the case of program B, the confirmation unit 114 verifies the validity of the entity attribute information in (A) above, and confirms whether program B actually exists with the attributes indicated by the entity attribute information. In addition, the confirmation unit 114 may, for example, in combination with the above (A), verify the validity of administrator B, who is the source of acquisition of (B) above and the source of request of (C) above, and perform identity verification of administrator B. In addition, the confirmation unit 114 verifies the validity of the entity attribute information of the second person in charge device 300b, which is a higher device, and confirms whether the second person in charge device 300b actually exists with the attributes indicated by the entity attribute information.

[0045] In the case of device C, the confirmation unit 114 verifies the validity of the entity attribute information of (a) above, and confirms whether device C actually exists with the attributes indicated by the entity attribute information.

[0046] <Identifier assignment> (3) When the confirmation unit 114 of the server apparatus 100 has successfully confirmed each of the device A, the program B, and the device C, the generation unit 115 generates an entity ID for each of the device A, the program B, and the device C based on the confirmation result. The generation unit 115 registers the generated entity ID in the storage unit 130 in association with the acquired entity attribute information and / or responsible person attribute information for each entity.

[0047] (4) The notification unit 117 of the server device 100 notifies the generated entity ID to each of device A, program B, and device C, and to the request source of the generation request (e.g., the first person in charge device 300a and the second person in charge device 300b).

[0048] An example of processing when an authentication request for an entity ID is received in the authentication system 1 will be described with reference to Fig. 3. The processing in this example is processing performed after the pre-processing in the example of Fig. 2 has been performed.

[0049] <Authentication request / Authentication process> (1) As shown in Fig. 3, each of device A, program B, and device C transmits an authentication request for entity authentication to server device 100 in order to access resources managed by a linked system or the like. This authentication request includes the generated entity ID and authentication information (entity attribute information) of each entity. Authentication receiving unit 111b of server device 100 receives the transmitted authentication request from each of device A, program B, and device C.

[0050] (2) The authentication unit 116 of the server device 100 authenticates each of the device A, the program B, and the device C based on the received authentication request. The authentication unit 116 refers to each authentication information (entity attribute information) registered in advance in the storage unit 130, and verifies whether or not it matches the information included in the authentication request. In the authentication by the authentication unit 116, which of the elements corresponding to each of the three elements of authentication (record (knowledge), individual (biome), possession) is to be used may be specified by (a) a designation from a user such as a responsible person or the entity 200, (b) an automatic determination by the authentication unit 116 based on the information included in the authentication request and the information stored in the storage unit 130, or the like. When the entity authentication is successful, the authentication unit 116 may issue an ID token to link to the linked system, and allow the successfully authenticated entity 200 to log in to the linked system.

[0051] With the above configuration, the authentication system 1 can generate an entity ID after ensuring the legitimacy of the entity attribute information or the source of acquisition of the information. This makes it possible to deal with the risk of, for example, being requested to generate identification information of an entity having an attribute indicated by tampered attribute information or being requested to generate by an unauthorized third party. This makes it possible to improve risk management regarding the generation of identification information of the entity 200, which is device A, C, or program B.

[0052] With the above configuration, the authentication system 1 can use the entity ID generated as described above to authenticate each entity 200. This ensures the binding between the entity 200 (device A, C or program B) and the authentication means for entity authentication using the entity ID.

[0053] <3. Functional configuration> The functional configuration of the server device 100 according to the present embodiment will be described with reference to Fig. 4. As shown in Fig. 4, the server device 100 includes a control unit 110, a communication unit 120, and a storage unit .

[0054] The control unit 110 includes a reception unit 111, an acquisition unit 112, a confirmation unit 114, a generation unit 115, an authentication unit 116, and a notification unit 117. The control unit 110 may also include a determination unit 113, for example.

[0055] [Reception] The reception unit 111 receives various information and / or various requests from the entity 200 and / or the responsible person device 300, etc. The reception unit 111 may receive various information and the like in any manner. For example, the reception unit 111 may receive a message indicating an authentication request including an entity ID and authentication information from these devices. Furthermore, the reception unit 111 may receive various information and the like by having these devices use, for example, an API implemented by the server device 100 or a library of an SDK corresponding to the authentication system 1.

[0056] The reception unit 111 includes a generation reception unit 111a. The generation reception unit 111a receives a generation request for entity identification information for identifying an entity from a user (e.g., a user who uses the entity 200 or a person in charge of the entity 200) or the entity 200. When the entity identification information to be generated is the above (a) information designated by the user or the entity 200 (e.g., an arbitrary character string designated by the user), the generation request may include this designated information.

[0057] The reception unit 111 includes an authentication reception unit 111b. The authentication reception unit 111b receives an authentication request including entity identification information from the entity 200. The authentication reception unit 111b may receive the authentication request from the entity 200 via, for example, a federated system (for example, by redirection by the federated system).

[0058] The reception unit 111 may include, for example, a regeneration reception unit 111c. The regeneration reception unit 111c receives a request for regeneration of entity identification information from a user or the entity 200. When the entity identification information to be regenerated is the above (a) information designated by the user or the entity 200, the request for regeneration may include this designated information.

[0059] [Acquisition Department] The acquisition unit 112 acquires various information from the entity 200 and / or the manager device 300, etc. For example, when the manager inputs entity attribute information or manager attribute information on a screen displayed by the authentication system 1, the acquisition unit 112 may receive a message indicating the input attribute information at any time. As another example, the acquisition unit 112 may receive a data file of entity attribute information from the entity 200 in a cyclic or event-driven manner. As another example, the acquisition unit 112 may instruct an API implemented by an external system (not shown), such as a cloud file system, to refer to entity attribute information, and acquire the entity attribute information as a result.

[0060] The acquisition unit 112 may transmit a request for providing various kinds of information to the entity 200 and / or the responsible person device 300, etc., and acquire various kinds of information in response to the request for providing the various kinds of information.

[0061] The acquisition unit 112 acquires entity attribute information indicating attributes of the entity from the entity 200 which is a device or program, the responsible person's device 300 of the responsible person of the entity, the storage unit 130, or an external system.

[0062] For example, when the result of the determination by the determination unit 113 indicates that the entity cannot be uniquely identified, the acquisition unit 112 may acquire responsible person attribute information indicating the attributes of the responsible person of this entity from the responsible person device 300 or the storage unit 130.

[0063] For example, when the result of the determination by the determination unit 113 indicates that the entity cannot be uniquely identified, the acquisition unit 112 may acquire higher-level attribute information indicating attributes of a higher-level device or a higher-level program for the entity from the entity 200, the responsible person device 300, the storage unit 130, or the like. This higher-level device or higher-level program may be, for example, (A) a device or program designated by the entity 200 or the responsible person, (B) a device or program automatically determined as an entity that controls the entity 200, or the like.

[0064] In the case of (A) above and the entity 200 is an unmanned device such as a drone, the acquisition unit 112 may determine that an app that controls the operating device or a terminal device (e.g., a smartphone) that has the app installed and accepts an operation instruction for the app from a user is a higher-level device. The acquisition unit 112 may acquire attribute information of the higher-level device based on the result of this determination.

[0065] The acquisition unit 112 may acquire risk information indicating risks related to the entity identification information from, for example, an external system such as a linked system or the storage unit 130.

[0066] The risk information may include, for example, authentication history information by entity ID. The authentication history information may include, for example, a history of authentication failures in a predetermined period of time. The risk information may also include, for example, a track record of suspicious access to the federated system by entity ID (for example, ).

[0067] The risk information may be, for example, transaction history information performed in a linked system logged in using an entity ID. The transaction history information may include, for example, at least one of the following pieces of information as negative information: History information showing the history of failed authentications for entities (e.g., authentications in linked systems and payment services that are further linked) - History information showing a history of transactions where scheduled withdrawals from your account were not made due to insufficient funds or a history of delayed payments

[0068] The risk information may indicate, for example, that information such as entity attribute information and / or responsible person attribute information referenced when generating the entity identification information has not been updated for a specified period of time, i.e., that such information has not been properly updated.

[0069] For example, when the entity identification information is invalidated or cyclically, the acquisition unit 112 may acquire entity attribute information newer than the previously acquired entity attribute information (for example, the latest entity attribute information at the time of acquisition).

[0070] [Judgment section] The determination unit 113 determines whether or not the entity 200 can be uniquely identified by the entity attribute information. The determination unit 113 may determine whether or not each of the entities 200 can be identified based on, for example, one or more attributes of the entity 200 indicated by the entity attribute information. If the determination unit 113 determines that each of the entities 200 can be identified as a result of this determination, the determination unit 113 may determine that the entity 200 can be uniquely identified by the entity attribute information.

[0071] [Verification section] When the generation reception unit 111a receives a generation request, the confirmation unit 114 confirms the entity attribute information and / or the source of the entity attribute information or the source of the generation request as identity verification of the entity. For example, when the source of the information or the source of the request is the person in charge device 300, the confirmation unit 114 may confirm the attribute information of the person in charge device 300, or may confirm the attribute information of the person in charge, that is, the identity of the person in charge (in other words, the identity of the person in charge).

[0072] The verification unit 114 may, for example, verify the validity of one attribute among one or more attributes indicated by the entity attribute information and / or the responsible person attribute information, or may verify the validity of each of multiple attributes, or may verify the validity of a combination of multiple attributes.

[0073] For example, when the entity is a device and the serial number of the device is used as the entity attribute information (authentication information), the confirmation unit 114 may send a message to the device manufacturer's system to inquire about the authenticity of the serial number (e.g., whether or not the number is real). The confirmation unit 114 may then receive a response message to the inquiry from the manufacturer's system and confirm the authenticity using the message. Alternatively, or in addition to this inquiry, the confirmation unit 114 may perform image analysis of image data of the device's warranty (containing the device's serial number) included in the entity attribute information and compare it with the serial number identified by this analysis. If the serial numbers match as a result of the comparison, the confirmation unit 114 may determine that the device is authentic and the confirmation is successful.

[0074] For example, when the entity is a program and the entity attribute information uses information of a portion of the program encrypted with the private key of the provider or a legitimate user, the verification unit 114 may verify the validity of the entity attribute information by verifying the information with a public key that pairs with the private key.

[0075] The verification unit 114 may verify the authenticity of the entity based on, for example, a digital certificate that certifies the entity. This digital certificate may be, for example, a digital signature or e-seal of the manufacturer or developer of the entity.

[0076] For example, when the generation receiving unit 111a receives a generation request, the confirmation unit 114 may confirm the identity of the responsible person in addition to the confirmation of the entity. Specifically, the confirmation unit 114 may confirm the responsible person attribute information and / or the acquisition source of the responsible person attribute information.

[0077] For example, when the generation receiving unit 111a receives a generation request, the confirmation unit 114 may confirm the higher-level attribute information and / or the source of the higher-level attribute information in addition to the confirmation for the entity. For example, when the source is the responsible person device 300, the confirmation unit 114 may confirm the attribute information of the responsible person device 300 or may perform identity verification of the responsible person.

[0078] The checking unit 114 may, for example, check entity attribute information that is newer than the previous one (eg, entity attribute information already stored in the storage unit 130) and / or the acquisition source of the new entity attribute information.

[0079] The confirmation unit 114 may, for example, cyclically or event-drivenly reconfirm the entity attribute information and / or the source of the entity attribute information acquisition or generation request. For this reconfirmation, the confirmation unit 114 may, for example, cause the acquisition unit 112 to acquire information such as the entity attribute information required for the reconfirmation.

[0080] [Generation part] The generating unit 115 generates entity identification information (entity ID) for identifying an entity based on a result of the confirmation by the confirming unit 114. The generating unit 115 may register this generated entity identification information in the storage unit 130 as an account of the entity 200 in association with attribute information of the corresponding entity. The generating unit 115 may generate the entity identification information, for example, when the confirmation unit 114 has successfully confirmed the entity or the like. The generating unit 115 may generate the entity identification information from scratch, for example, by numbering, or may generate the entity identification information by employing a character string (for example, a combination of alphanumeric characters, etc.) designated by the entity or a responsible person.

[0081] According to the above configuration, it is possible to generate entity identification information after ensuring the legitimacy of the entity attribute information or the acquisition source of the information by the confirmation unit 114. This makes it possible to deal with the risk that entity identification information is requested to be generated based on tampered attribute information or by an unauthorized third party. This makes it possible to improve risk management regarding the generation of identification information of a device or program that is the entity 200.

[0082] The generating unit 115 may generate the entity identification information, for example, further based on the result of the confirmation by the confirming unit 114 with respect to the responsible person.

[0083] When an entity is a mass-produced product, etc., there may be cases where the entity attributes do not contain information that can uniquely identify the entity, making it difficult to uniquely identify the entity. Even in such cases, the above configuration can ensure the legitimacy of the identity of the entity 200 that is the subject of the entity ID by combining it with identity verification by the person in charge of the entity.

[0084] The generating unit 115 may generate the entity identification information, for example, further based on the result of the check by the checking unit 114 on the upper device or upper program.

[0085] Even if it is difficult to uniquely identify an entity, the above configuration makes it possible to ensure the validity of the identity of the entity 200 that is the subject of the entity ID by combining it with confirmation of a higher-level device or program.

[0086] The generating unit 115 may, for example, set a validity period for the entity identification information to be generated. The generating unit 115 may determine the length of the validity period, for example, according to the attribute of the target entity and / or the result of confirmation by the confirming unit 114. The generating unit 115 may, for example, relatively lengthen the validity period in a case where the confirming unit 114 confirms not only the entity attribute information but also the identity of the responsible person who is the source of the entity attribute information, compared to a case where the confirming unit 114 confirms only the entity attribute information.

[0087] For example, the generating unit 115 may invalidate the existing entity identification information of the entity and generate new entity identification information based on a regeneration request received by the regeneration receiving unit 111c. With this configuration, the user or entity can generate new entity identification information according to their own convenience. For example, even if a situation occurs in which the entity identification information may have been leaked to a third party or has been forgotten, the entity identification information can be regenerated, making it possible to flexibly deal with such situations.

[0088] The generating unit 115 may include, for example, an invalidating unit 115a. When the entity identification information or information related thereto satisfies a predetermined condition, the invalidating unit 115a invalidates the entity identification information temporarily or permanently. For example, the invalidating unit 115a may determine whether the validity period of the entity identification information has expired, and invalidate the entity identification information when the result of the determination indicates that the validity period has expired.

[0089] If unlimited use of entity identification information once generated were permitted, the entity identification information would be usable even if the entity itself or the circumstances surrounding the entity change over time, making it impossible to ensure the legitimacy of entity 200. This situation is undesirable from the viewpoint of security. With the above configuration, it is possible to respond to changes over time in the entity itself or circumstances, etc., and ensure security.

[0090] For example, the invalidation unit 115a may invalidate the entity identification information based on the risk information acquired by the acquisition unit 112. For example, when a statistical value of authentication failures indicated in the risk information (for example, a total value or an average value in a predetermined period of time, etc.) exceeds a predetermined threshold, the invalidation unit 115a may invalidate the entity identification information corresponding to this risk information.

[0091] If unlimited use of entity identification information once generated were permitted, for example, entity identification information could be used even in a state where security risks are high. Such a situation is undesirable from the viewpoint of security. According to the above configuration, it is possible to respond when security risks increase, and security can be ensured.

[0092] The generating unit 115 may include, for example, a validating unit 115b. When the invalidated entity identification information or information related thereto satisfies a predetermined condition, the validating unit 115b validates the entity identification information. For example, the validating unit 115b validates the invalidated entity identification information based on a result of confirmation of new entity attribute information, etc. by the confirming unit 114. At this time, the validating unit 115b may set a new validity period for the entity identification information.

[0093] According to the above configuration, even if the validity period of the entity identification information generated from the entity attribute information, etc. expires or the information is not updated and is determined to pose a risk, and thus the entity identification information is invalidated, the entity identification information can be revalidated using new entity attribute information, etc. Therefore, the same entity identification information can be continuously used while ensuring a certain level of security (integrity, etc.), and therefore a user-friendly system can be provided.

[0094] [Authentication section] The authentication unit 116 authenticates an entity in response to an authentication request received by the authentication receiving unit 111b. Specifically, the authentication unit 116 may compare authentication information of the entity to be matched, included in the authentication request, with authentication information of the entity to be matched, which is registered in advance in the storage unit 130, to determine whether the entity that is the request source of the authentication request is genuine or not. If the authentication unit 116 determines that the request source entity is genuine as a result of this determination, the authentication may be deemed successful, and otherwise the authentication may be deemed unsuccessful. The authentication unit 116 may register the result of the authentication in the storage unit 130 as authentication history information.

[0095] For example, if it is determined that the authentication is successful, the authentication unit 116 may issue an ID token and transmit it to the linked system.

[0096] [Notification Department] The notification unit 117 notifies the source of the generation request (eg, a user or the entity 200) of the entity identification information generated by the generation unit 115.

[0097] [Communications Department] The communication unit 120 transmits and receives various information and / or various requests to and from the entity 200 and / or the manager device 300, etc., via the network N. The communication unit 120 may, for example, transmit the generated entity identification information and / or an ID token issued when authentication using the entity identification information is successful, to the linked system. In addition, the communication unit 120 may, for example, transmit information indicating a result of the entity authentication by the authentication unit 116 to the entity 200 that is the request source of the authentication request accepted by the authentication acceptance unit 111b.

[0098] [Storage] The storage unit 130 stores various information such as entity identification information, entity attribute information, and / or responsible person attribute information. The storage unit 130 may store various data and information by utilizing a database management system (DBMS) or may store various data and information by utilizing a file system. When using a DBMS, for example, a table may be provided for each of the above information, and each piece of information may be managed by associating the tables with each other.

[0099] <5. Example of operation> An example of the operation of the authentication system 1 will be described with reference to Figs. 5 and 6. Fig. 5 is a sequence diagram showing an example of the interaction and processing flow when an entity is registered in the authentication system 1. Fig. 6 is a sequence diagram showing an example of the interaction and processing flow when an entity is authenticated by the authentication system 1. Note that the order of processing and the processing units shown in Figs. 5 and 6 are merely examples and may be changed as appropriate.

[0100] 5, in order to utilize the authentication function of the authentication system 1, the entity 200 transmits a registration request for its own account to the authentication system 1 as a request for generating an entity ID (S10). This registration request includes entity attribute information of the requesting entity 200. The reception unit 111 of the server device 100 receives this registration request (S11). The acquisition unit 112 of the server device 100 acquires the entity attribute information included in the registration request (S12). The determination unit 113 of the server device 100 determines whether the entity 200 can be uniquely identified by the acquired entity attribute information (S13).

[0101] When it is determined that the entity 200 cannot be uniquely identified by the acquired entity attribute information, each device of the authentication system 1 executes processing of the area indicated by the combined fragment opt1 (Option1). Specifically, the acquisition unit 112 of the server device 100 transmits a request for providing the responsible person attribute information to the manager device 300 (S15). In response to this request, the manager device 300 transmits the responsible person attribute information to the server device 100 (S16). The acquisition unit 112 of the server device 100 acquires the responsible person attribute information transmitted from the manager device 300 (S17).

[0102] The confirmation unit 114 of the server device 100 confirms the entity attribute information and, if the responsible person attribute information is acquired by the acquisition unit 112, the responsible person attribute information (S18).

[0103] When the confirmation unit 114 has successfully confirmed the attributes of the entity 200 and / or the attributes of the responsible person, each device in the authentication system 1 executes processing within the area indicated by the combined fragment alt1 (alternative1) above the dashed line. Specifically, the generation unit 115 of the server device 100 generates entity identification information for identifying the entity 200 (S19). The generation unit 115 associates the generated entity identification information with the entity attribute information as a new account for the entity 200 and registers them in the storage unit 130 (S20). The notification unit 117 of the server device 100 transmits information indicating the result of this account registration, including the entity identification information, to the entity 200 in order to notify the entity 200 of the result (S21). The entity 200 acquires the transmitted information indicating the result of the registration and outputs the result of the registration on a screen and / or by voice or the like (S22).

[0104] When the confirmation unit 114 fails to confirm the attributes of the entity or the attributes of the responsible person, each device in the authentication system 1 executes the process below the dashed line in the area indicated by the combined fragment alt1. Specifically, the confirmation unit 114 of the server device 100 transmits error information indicating the failure of the confirmation to the entity 200 (S23). The entity 200 acquires this transmitted error information and outputs an error on a screen and / or by voice or the like (S24).

[0105] 6, the entity 200 transmits an authentication request (including entity identification information) for logging in to the registered account to the server device 100 (S30). The authentication receiving unit 111b of the server device 100 receives the transmitted authentication request of the entity 200 (S31). The authentication unit 116 of the server device 100 authenticates the requesting entity 200 based on the authentication request (S32).

[0106] When the authentication of entity 200 by confirmation unit 114 is successful, each device of authentication system 1 executes the process within the area indicated by the combined fragment alt2 (alternative2) above the dashed line. Specifically, notification unit 117 of server device 100 transmits information indicating successful authentication to entity 200 to notify the result of successful authentication (S33). Entity 200 receives this transmitted information and outputs a message indicating successful authentication on a screen and / or by voice (S34).

[0107] If authentication of entity 200 by confirmation unit 114 fails, each device in authentication system 1 executes the process in the area indicated by the combined fragment alt2 above the dashed line. Specifically, notification unit 117 of server device 100 transmits information indicating authentication failure to entity 200 in order to notify the result of authentication failure (S35). Entity 200 receives this transmitted information and outputs authentication failure on screen and / or by voice (S36).

[0108] <5. Hardware configuration> 7, an example of a hardware configuration in which the above-mentioned server device 100 is realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into a plurality of devices.

[0109] As shown in FIG. 7, a computer 800 includes a processor 801, a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811, and a display device 813.

[0110] The processor 801 controls various processes in the computer 800 by executing programs stored in the memory 803. For example, each functional unit included in the control unit 110 of the server device 100 can be realized by the processor 801 executing a program temporarily stored in the memory 803.

[0111] The memory 803 is a storage medium such as a RAM (Random Access Memory), etc. The memory 803 temporarily stores the program code of the program executed by the processor 801 and data required when the program is executed.

[0112] The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system and various programs for implementing the above-mentioned configurations. In addition, the storage device 805 can also store a table for registering various information such as entity identification information and / or entity attribute information, and a DB for managing the table. Such programs and data are loaded into the memory 803 as necessary, and are referred to by the processor 801.

[0113] The input I / F unit 807 is a device for receiving input from a user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, and a wearable device. The input I / F unit 807 may be connected to the computer 800 via an interface such as a Universal Serial Bus (USB).

[0114] The data I / F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I / F unit 809 is a drive device for reading data stored in various storage media. The data I / F unit 809 may be provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as a USB.

[0115] The communication I / F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with an external device of the computer 800. The communication I / F unit 811 may be provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as a USB.

[0116] The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, and a display of a wearable device. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. In addition, when a touch panel is adopted as the input I / F unit 807, the display device 813 can be configured integrally with the input I / F unit 807.

[0117] It should be noted that the present embodiment is an example for explaining the present invention, and is not intended to limit the present invention to the embodiment. In addition, the present invention can be modified in various ways without departing from the gist of the invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent, and such an embodiment is also included in the scope of the present invention.

[0118] The components of the server device described in the above embodiment are assumed to realize a predetermined process in cooperation with other hardware by the processor 801 executing a program stored in the storage device 805. In other words, these components are assumed to be software or firmware, and also corresponding hardware, and in both concepts, they are also described as "functions," "means," "parts," "processing circuits," "units," or "modules," and can be interpreted as each of these.

[0119] [Variations] Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[0120] [Variation 1] In the above embodiment, an example in which the authentication system 1 (specifically, the server device 100) performs the function of entity authentication has been described, but the entity authentication according to the present invention is not limited to this. For example, the authentication system 1 may cooperate with a third-party system or other authentication server to cause the authentication server to execute authentication information matching, which is a part of the function of entity authentication. In this case, for example, the authentication unit 116 of the server device 100 may transfer an authentication request received from the entity 200 to the authentication server as an authentication process. Next, the authentication unit 116 may receive a result of matching the authentication information from the authentication server as an authentication process and as a response to the authentication request. Then, the authentication unit 116 may determine whether the authentication is successful or unsuccessful based on the result of the matching as an authentication process. In addition, as another example, the authentication unit 116 may receive a result of matching the authentication information by a FIDO-compliant authenticator mounted on the entity 200 and determine whether the authentication is successful or unsuccessful.

[0121] [Variation 2] At least a part of each component included in the server device 100 according to the above embodiment may be included in the entity 200, the responsible person device 300, and / or devices of other systems such as a linkage system.

[0122] [Variation 3] In the above embodiment, the storage unit for storing various attribute information such as the entity attribute information and the responsible person attribute information is the storage unit of the server device 100, but the present invention is not limited to this. For example, at least a part of these storage units may be provided in devices of the linked system or other systems. [Explanation of symbols]

[0123] 1...authentication system, 100...server device, 110...control unit, 111...reception unit, 112...acquisition unit, 113...determination unit, 114...confirmation unit, 115...generation unit, 116...authentication unit, 117...notification unit, 120...communication unit, 130...storage unit, 200...entity, 300...responsible person device, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I / F unit, 809...data I / F unit, 811...communication I / F unit, 813...display unit.

Claims

1. On the computer, An acquisition function for acquiring entity attribute information indicating attributes of an entity that is a device or a program; a generation reception function for receiving a generation request for entity identification information for identifying the entity from a user or the entity; a confirmation function for confirming the entity attribute information and / or the source of the entity attribute information or the source of the generation request; a generating function for generating the entity identification information based on a result of the checking; A notification function of notifying a source of the generation request of the entity identification information. program.

2. an authentication reception function that receives an authentication request for the entity from the entity, the authentication request including the entity identification information; and an authentication function for authenticating the entity based on the authentication request. The program according to claim 1.

3. The computer further realizes a determination function of determining whether the entity can be uniquely identified by the entity attribute information, The acquisition function acquires responsible person attribute information indicating attributes of a responsible person of the entity when the result of the determination indicates that the entity cannot be uniquely identified, The verification function verifies the responsible person attribute information and / or a source of the responsible person attribute information, the generating function generating the entity identification information further based on a result of the check with the responsible party.

3. The program according to claim 1 or 2.

4. The computer further realizes a determination function of determining whether the entity can be uniquely identified by the entity attribute information, the acquiring function, when a result of the determination indicates that the entity cannot be uniquely identified, acquires higher-level attribute information indicating attributes of a higher-level device or a higher-level program for the entity; The confirmation function confirms the higher-level attribute information and / or a source from which the higher-level attribute information is obtained, The generating function generates the entity identification information further based on a result of the confirmation for the higher-level device or the higher-level program.

3. The program according to claim 1 or 2.

5. The generating function sets a validity period for the entity identity information; The computer further realizes an invalidation function of judging whether the validity period has expired, and invalidating the entity identification information when the result of the judgment indicates that the validity period has expired.

3. The program according to claim 1 or 2.

6. The obtaining function obtains risk information indicating a risk related to the entity identification information; The computer further implements a revocation function of revoking the entity identification information based on the risk information.

3. The program according to claim 1 or 2.

7. The acquisition function acquires newer entity attribute information than the previously acquired entity attribute information when the entity identification information is invalidated, the validation function validates the new entity attribute information and / or the source of the new entity attribute information; and further causing the computer to realize an enabling function for enabling the revoked entity identification information based on a result of the checking. The program according to claim 5 or 6.

8. a regeneration reception function for receiving a request for regeneration of the entity identification information from a user or the entity; the generating function invalidating an existing entity identity for the entity based on the regeneration request and generating a new entity identity for the entity; The program according to any one of claims 1 to 4.

9. An acquisition unit that acquires entity attribute information indicating attributes of an entity that is a device or a program; a generation receiving unit that receives a generation request for entity identification information for identifying the entity; a confirmation unit for confirming the entity attribute information and / or a source of the entity attribute information or a source of the generation request; A generator for generating the entity identification information based on a result of the confirmation; an authentication reception unit that receives an authentication request for the entity, the authentication request including the entity identification information; an authentication unit that authenticates the entity based on the authentication request; Information processing device.

10. The computer Obtain entity attribute information indicating attributes of an entity that is a device or a program; receiving a request for generating entity identification information for identifying the entity; confirming the entity attribute information and / or the source of the entity attribute information or the source of the generation request; generating said entity identity based on a result of said checking; accepting an authentication request for the entity, the authentication request including the entity identification information; authenticating the entity based on the authentication request; Information processing methods.

Images