Terminal, information processing method, and program

Abstract

To provide a technique effective for tracking the utilization of mobility by a user while ensuring security.SOLUTION: In a terminal related to a first target that is one of mobility and a user, a control section provides electronic information to the other terminal related to a second target which is the other of the mobility and the user. The control section acquires from the other terminal, an electronic signature of the second target, an electronic certificate of the second target and an identifier of the second target. The control section executes verification of the validity of the electronic certificate of the second target by using a public key of an authentication station, and verification of the validity of the electronic signature of the second target by using a public key of the second target included in the electronic certificate of the second target. In accordance with success of verification of the validity of the electronic certificate and the electronic signature, the control section transmits, to a management server, a setting request of a correspondence relation between an identifier of the first target and the identifier of the second target.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a terminal, an information processing method, and a program. [Background technology]

[0002] Patent Document 1 proposes a toll collection system for collecting fees for services from vehicle users using a medium such as a card. Specifically, the toll collection system proposed in Patent Document 1 is configured to allocate the billing of expressway usage fees for a target rental car to a target user based on the ID of an ETC (Electronic Toll Collection System) card, the rental car company, the date and time of rental car use, and the correspondence between the rental car user (billing information, registration information, payment information, and usage information). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-140747 A Summary of the Invention [Problem to be solved by the invention]

[0004] An object of the present disclosure is to provide a technique that is effective in tracking a user's mobility usage while ensuring security. [Means for solving the problem]

[0005] A terminal according to a first aspect of the present disclosure includes: A terminal associated with a first object, which is one of a mobility object and a user object, providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; verifying the validity of the obtained digital signature using the second target public key included in the digital certificate; transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; The control unit is configured to:

[0006] An information processing method according to a second aspect of the present disclosure includes: A terminal associated with a first object, which is one of a mobility object and a user, providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; The electronic signature obtained using the public key of the second target included in the electronic certificate. To verify the effectiveness of transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; It is an information processing method for performing the above.

[0007] The program according to the third aspect of the present disclosure comprises: providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; verifying the validity of the obtained digital signature using the second target public key included in the digital certificate; transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; This is a program for executing the above.

[0008] Another aspect of the present disclosure may be a non-transitory storage medium that stores the above program. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide a technique that is effective in tracking a user's mobility usage while ensuring security. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a situation to which the present disclosure is applied. [Diagram 2] FIG. 1 is a diagram illustrating an example of a situation to which the present disclosure is applied; [Diagram 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of a management server according to an embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a hardware configuration of a first server in an embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of a hardware configuration of a second server in an embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a hardware configuration of a first terminal in an embodiment. [Figure 7]FIG. 2 is a diagram illustrating an example of a hardware configuration of a second terminal in an embodiment. [Figure 8] FIG. 2 is a diagram illustrating an example of a software configuration of each device according to the embodiment. [Figure 9] FIG. 4 is a diagram illustrating an example of linking information according to an embodiment. [Figure 10] FIG. 4 is a diagram illustrating an example of first target information according to an embodiment. [Figure 11] FIG. 4 is a diagram illustrating an example of second target information in the embodiment. [Figure 12] FIG. 11 is a sequence diagram illustrating an example of a processing procedure for linking settings according to the embodiment. [Figure 13] FIG. 13 is a diagram illustrating a first modified example of a situation to which the present disclosure is applied. [Figure 14] FIG. 13 is a diagram illustrating an example of a hardware configuration of a third terminal in a modified example. [Figure 15] FIG. 10 is a diagram illustrating an example of a software configuration of each device according to a modified example. [Figure 16] FIG. 10 is a diagram illustrating an example of second target information in a modified example. [Figure 17] FIG. 10 is a diagram illustrating an example of linking information in a modified example. [Figure 18] FIG. 13 is a diagram illustrating a second modified example of a situation to which the present disclosure is applied. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] According to the system proposed in Patent Document 1, a user can pay highway tolls by ETC even if he or she does not have an ETC card. However, the inventors of the present invention found that the conventional system has the following problems.

[0012] That is, with the diversification of MaaS (Mobility as a Service), it is considered that there will be a demand to track the use of a moving body (mobility) by a user while ensuring security from the viewpoint of convenience such as efficient payment. In contrast, in a conventional system, it is possible to hold the correspondence between the use date and time and the user as usage information according to the rental car contract or reservation, but since this usage date and time depends on the contract or reservation, the usage information does not necessarily match the actual use of the rental car by the user. In addition, for vehicles used without a contract or reservation (e.g., private cars, company cars, etc.), the generation of usage information is not assumed in the first place. Therefore, according to the conventional system, it is difficult to track the use of mobility by a user while ensuring security. It should be noted that this problem does not occur only in situations where a vehicle is used. The same problem may occur in situations where mobility other than a vehicle (e.g., aircraft, ships, etc.) is used and in situations where multiple types of mobility are used. Furthermore, the same problem may occur in all usage situations other than mobility.

[0013] Therefore, a terminal according to a first aspect of the present disclosure is a terminal associated with a first target, which is one of mobility and a user, and is equipped with a control unit configured to perform the following operations: providing electronic information to another terminal associated with a second target, which is the other of the mobility and the user; obtaining from the other terminal an electronic signature generated using the electronic information, an electronic certificate of the second target issued by a certification authority, and an identifier of the second target; verifying the validity of the obtained electronic certificate using the public key of the certification authority; verifying the validity of the obtained electronic signature using the public key of the second target included in the electronic certificate; and, in response to successful verification of the validity of the electronic certificate and the electronic signature, sending a request to an administration server to set a correspondence (linking) relationship between the identifier of the first target and the identifier of the second target.

[0014] In one example, electronic information may be provided from a terminal related to a first target (hereinafter sometimes referred to as a "first terminal") to another terminal related to a second target (hereinafter sometimes referred to as a "second terminal") in response to the occurrence of a usage relationship between the mobility and the user. The occurrence of a usage relationship between the mobility and the user means that the user starts using the mobility. The user starts using the mobility when, for example, the user gets into the mobility, when the user starts renting the mobility, when the user passes through a ticket gate for the mobility, etc. The electronic information may be a random number generated by the control unit of the first terminal, or may be a timestamp, etc.

[0015] In the second terminal that receives the electronic information provided from the first terminal, a digital signature corresponding to the second object is generated using the electronic information. In this case, the digital signature of the second object may be generated, for example, by encrypting predetermined information including the electronic information and an identifier of the second object using a private key corresponding to the public key of the second object. The digital signature of the second object generated by the second terminal is provided to the first terminal together with the digital certificate of the second object issued by a certification authority and the identifier of the second object.

[0016] The data exchange between the first terminal and the second terminal may be performed by wireless or wired data communication, or may be performed by a method other than data communication, such as reading a two-dimensional code.

[0017] In the first terminal that receives the electronic signature, electronic certificate, and identifier of the second target, the control unit verifies the validity of the electronic certificate of the second target using the public key of the certification authority. In one example, verifying the validity of the electronic certificate of the second target may include decrypting the electronic signature of the certification authority included in the electronic certificate using the public key of the certification authority, verifying the validity of the information obtained by decrypting the electronic signature of the certification authority using the owner identification information of the second target included in the electronic certificate and the public key of the second target, and determining whether the electronic certificate has expired. The validity of the electronic certificate of the second target may be verified by an external server that holds the public key of the certification authority. In one example, the certification authority is a third-party organization that performs authentication-related tasks such as issuing electronic certificates for the second target.

[0018] Also, the control unit of the first terminal verifies the validity of the signature of the second target using the public key of the second target included in the electronic certificate of the second target. In one example, verifying the validity of the signature of the second target may include decrypting the signature of the second target using the public key of the second target included in the electronic certificate of the second target, and comparing the information obtained by decrypting the electronic signature of the second target with the above-mentioned predetermined information. If the comparison of the information obtained by decrypting the electronic signature of the second target with the above-mentioned predetermined information is successful, it is proven that the electronic signature of the second target was generated using the private key of the second target (the private key corresponding to the public key of the second target included in the electronic certificate of the second target) and the electronic information provided by the first terminal. This makes it possible to consider that the provider of the electronic signature of the second target holds the private key of the second target, and that the destination of the electronic information and the provider of the electronic signature of the second target are consistent. In other words, the consistency between the provider of the electronic signature of the second target and the second target identified by the certification authority is guaranteed. Therefore, if the comparison of the information obtained by decrypting the electronic signature of the second target with the above-mentioned predetermined information is successful, the control unit of the first terminal determines that the electronic signature of the second target is valid.

[0019] The order in which the validity of the second target electronic certificate and the second target electronic signature are verified may be arbitrary. In one example, the validity of the second target electronic certificate may be verified before the validity of the second target electronic signature is verified. In another example, the validity of the second target electronic signature may be verified before the validity of the second target electronic certificate is verified. In yet another example, the validity of the second target electronic certificate and the second target electronic signature may be verified at least partially in parallel.

[0020] If the verification of the validity of the electronic certificate and electronic signature of the second target is successful, it can be determined that the authenticity of the second target is guaranteed. Therefore, if the verification of the validity of the electronic certificate and electronic signature of the second target is successful, the control unit of the first terminal sends a request to the management server to set (link) a correspondence relationship between the identifier of the first target and the identifier of the second target. As a result, the management server sets a correspondence relationship (link) between the identifier of the first target and the identifier of the second target. By recording this setting, it becomes possible to trace the usage relationship between the first target and the second target.

[0021] Therefore, according to the first aspect of the present disclosure, it is possible to set a correspondence (linking) between the identifier of the first object and the identifier of the second object on the condition that the authenticity of the second object is guaranteed. As a result, it is possible to track the usage relationship between the first object and the second object while ensuring security.

[0022] Another aspect of the present disclosure may be an information processing method in which a computer executes the processing of a first terminal, a program for causing a computer to execute the processing of a first terminal, or a non-transitory storage medium storing the program. The non-transitory storage medium referred to here is a storage medium that can be read by a machine such as a computer, and is a medium that stores information such as a program by electrical, magnetic, optical, mechanical, or chemical action. One aspect of the present disclosure may be either a second terminal or a management server related to the first terminal according to the above aspect. Furthermore, one aspect of the present disclosure may be an information processing method related to either the second terminal or the management server, a program, or a non-transitory storage medium storing the program.

[0023] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. The configuration of the following embodiment is an example, but the embodiment described below is merely an example of the present disclosure in all respects. Various improvements or modifications may be made without departing from the scope of the present disclosure. In implementing the present disclosure, a specific configuration according to the embodiment may be appropriately adopted. Note that, although the data appearing in this embodiment is described in natural language, more specifically, it is specified in pseudo-language, commands, parameters, machine language, etc. that can be recognized by a computer.

[0024] <Embodiment> FIG. 1 is a schematic diagram showing an example of a scene to which the present disclosure is applied. The management system 100 according to the present embodiment includes a management server 1, a first server 2, a second server 3, a first terminal 4, and a second terminal 5. The management server 1 is one or more computers configured to record the correspondence (linking) between the first target and the second target. The first server 2 is one or more computers configured to authenticate the first target. The second server 3 is one or more computers configured to authenticate the second target. The first server 2 and the second server 3 may each be referred to as an authentication server, an ID (identification) server, or the like. At least one of the first server 2 and the second server 3 may be deployed by a third party organization such as a certification authority, a public organization, a neutral organization, or a business operator (such as a manufacturer or a service operator). The first terminal 4 is a computer corresponding to the first target, and corresponds to the "terminal" according to the present disclosure. The second terminal 5 is a computer corresponding to the second target, and corresponds to the "other terminal" according to the present disclosure.

[0025] In this embodiment, when a usage relationship occurs between the first target and the second target, data exchange is performed between the first terminal 4 of the first target and the second terminal 5 of the second target (steps SA101-SA102). In the application example shown in FIG. 1, first, the first terminal 4 provides electronic information to the second terminal 5 (step SA101). The second terminal 5, which receives the electronic information provided from the first terminal 4, generates a digital signature of the second target using the private key of the second target from predetermined information including the electronic information and an identifier of the second target (hereinafter, sometimes referred to as the "second identifier"). The second terminal 5 provides the generated digital signature of the second target, the second identifier of the second target, and the digital certificate of the second target to the first terminal 4 (step SA102).

[0026] The first terminal 4, which has received the electronic signature, second identifier, and electronic certificate of the second target provided by the second terminal 5, requests the second server 3 to verify the validity of the second identifier and electronic certificate of the second target by transmitting the second identifier and electronic certificate of the second target to the second server 3 (step SA103). The second server 3, which has received the request, verifies the validity of the electronic certificate and second identifier of the second target, and transmits the verification result to the first terminal 4 (step SA104).

[0027] The first terminal 4 also verifies the validity of the electronic signature of the second target received from the second terminal 5 (step SA105). The validity of the electronic signature of the second target is verified using the public key of the second target included in the electronic certificate of the second target, the identifier of the second target provided by the second target, and the electronic information provided from the first terminal 4 to the second terminal 5 in step SA101.

[0028] In the example shown in Figure 1, the validity of the electronic certificate of the second target is verified and then the validity of the electronic signature of the second target is verified, but the order in which the validity of the electronic certificate of the second target and the validity of the electronic signature of the second target are verified may be arbitrary.

[0029] If the validity of the electronic certificate, second identifier, and electronic signature of the second target is successfully verified, the first terminal 4 requests the management server 1 to set up a correspondence (linking) relationship between the first identifier and the second identifier by sending the identifier of the first target (hereinafter sometimes referred to as the "first identifier") and the second identifier to the management server 1 (step SA106).

[0030] The management server 1 that has received the request to set the correspondence between the first identifier and the second identifier sets the correspondence between the first identifier and the second identifier (step SA107). In one example, the management server 1 generates association information indicating the setting of the correspondence between the first identifier and the second identifier, and records the generated association information. The management server 1 may return the result of this association process to at least one of the first terminal 4 and the second terminal 5. Note that a series of processes from data exchange between the first terminal 4 and the second terminal to setting the association may be executed in real time in response to the occurrence of a usage relationship. The set association (correspondence) may be appropriately released in response to the disappearance of the usage relationship between the first target and the second target. Setting the correspondence between the first identifier and the second identifier may be treated as setting the correspondence between the first target and the second target.

[0031] In addition, when the management server 1 receives a request to set the correspondence relationship between the first identifier and the second identifier, it may authenticate the first target through the first server 2, and set the correspondence relationship between the first identifier and the second identifier if the authentication is successful.

[0032] As described above, in this embodiment, in response to the occurrence of a usage relationship between the first object and the second object, the authenticity of the second object is verified (steps SA101 to SA105). This is expected to ensure security. Furthermore, if the authenticity of the second object is successfully verified, a correspondence (linking) between the first identifier and the second identifier is set (steps SA106 to SA107). By recording this linking setting, the usage relationship between the first object and the second object can be traced. Therefore, according to this embodiment, the usage relationship between the first object and the second object can be traced while ensuring security.

[0033] (subject) The first object and the second object may be any object that can have a relationship of use with each other, and may be selected appropriately according to the embodiment. The first object and the second object may be any object, such as an object, a human being, or another living being. Any object may include a virtual object. The establishment of a relationship of use may be, for example, the occurrence of a real or virtual relationship between at least two objects, such as one object using the other, one object possessing the other, one object being combined with the other, or one object being connected to the other. The management system 100 of the present disclosure may be used in any situation where a correspondence relationship between two or more objects is tracked.

[0034] (Terminal) The first terminal 4 and the second terminal are associated with the first target and the second target, respectively. The relationship between the first terminal 4 and the first target, and the relationship between the second terminal and the second target are not particularly limited and may be appropriately determined according to the embodiment. In one example, either the first terminal 4 or the second terminal 5 may be held by the corresponding target. In another example, either the first terminal 4 or the second terminal 5 may be loaded on the corresponding target. Loading may include being placed on the target at all times, as well as being placed on the target at least temporarily when the target is used. Loading may include being held by a user of the target. Also, either the first terminal 4 or the second terminal 5 may be the target itself.

[0035] (identifier) The first identifier and the second identifier are data used to identify the respective objects. As long as the first identifier and the second identifier can identify the respective objects, the data format and configuration thereof are not particularly limited and may be appropriately selected depending on the embodiment. Each of the first identifier and the second identifier may be composed of a symbol string including numbers, letters, and the like.

[0036] The first identifier and the second identifier may be acquired appropriately. In one example, at least one of the first identifier and the second identifier may be held in advance in the corresponding terminal. In another example, at least one of the first identifier and the second identifier may be acquired by any device such as an input device or a sensor. For example, at least one of the first identifier and the second identifier may be obtained by input via the input device. Also, for example, at least one of the first identifier and the second identifier may be converted into a code, and at least one of the first identifier and the second identifier may be obtained by reading (decoding) the code.

[0037] (First server and second server) The first server 2 and the second server 3 may each be configured with one or more server devices. The first server 2 and the second server 3 may each be configured to manage target information related to each target and perform authentication of each target upon request. The target information related to each target may be held in one or more storage devices arranged at least either inside or outside the first server 2 and the second server 3.

[0038] The target information managed by the first server 2 and the second server 3 may include information specific to each target. In this embodiment, the target information managed by the second server 3 includes information used to authenticate the second target. The information used to authenticate the second target may be registered in advance, for example, at any timing before a linking request (for example, at the timing of creating an account for the second target, etc.).

[0039] The success or failure of the authentication of the second target is determined by verifying the validity of the electronic certificate of the second target received from the first terminal 4, and by comparing the registered information linked to the second identifier received from the first terminal 4 with the information included in the electronic certificate of the second target. The method of comparison may be appropriately selected according to the embodiment. In a simple example, the success or failure of the authentication may be determined according to whether the registered information linked to the second identifier matches the information included in the electronic certificate of the second target. In another example, the success or failure of the authentication may be determined according to the degree of match between the registered information linked to the second identifier and the information included in the electronic certificate of the second target. A trained model generated by machine learning may be used for the comparison. In the comparison, the registered information associated with the second identifier and the information included in the electronic certificate of the second target may be directly compared, or may be indirectly compared after being converted into a feature or the like.

[0040] The unit of information managed by the first server 2 and the second server 3 is not particularly limited and may be appropriately determined according to the embodiment. That is, the information managed by the first server 2 and the second server 3 may be managed in a centralized (collectively) manner, or may be managed in a decentralized manner (separately) for each arbitrary group. Furthermore, the server devices constituting the first server 2 and the second server 3 may be deployed by one or more operating organizations (subjects). At least one of the first server 2 and the second server 3 may be deployed by multiple operating organizations. When deployed by multiple operating organizations, the information to be managed may be shared (i.e., may be managed in a centralized manner), or may be managed in a decentralized manner for each operating organization.

[0041] (Management Server) The management server 1 may be configured with one or more server devices. The management server 1 of the present disclosure is configured to record information regarding the occurrence and disappearance of a correspondence relationship between a first object and a second object as association information. The association information may be held in one or more storage devices arranged at least either inside or outside the management server 1.

[0042] The linking information recorded by the management server 1 may be used in various situations. In one example, the linking information may be used to track the usage relationship between the first object and the second object. As a specific example, the linking information may be used to enable the authority linked to either the first object or the second object to be exercised from the other object while the corresponding relationship between the first object and the second object is set. In other words, the linking information may be used to enable the authority of either the first object or the second object to be exercised from the other object in accordance with the linking between the first object and the second object (FIG. 2 to be described later).

[0043] (Confirmation of continued use) The management server 1 may transmit a notification indicating the result of the association process to at least one of the first terminal 4 and the second terminal 5. The transmission path of the notification is not particularly limited and may be determined appropriately depending on the embodiment. In one example, the management server 1 may directly notify at least one of the first terminal 4 and the second terminal 5. In another example, the management server 1 may indirectly notify at least one of the first terminal 4 and the second terminal 5 via an external computer such as the first server 2 or the second server 3.

[0044] After setting the correspondence between the first target and the second target, the management server 1 may further execute a process (confirmation process) for confirming whether the correspondence is continuing or not. The method of confirming the continuation of use may be appropriately selected depending on the embodiment.

[0045] In one example, when at least one of the first target and the second target is a user (for example, the case of FIG. 2 described later), the management server 1 may directly or indirectly send a confirmation notification including an operator to at least one of the first terminal 4 and the second terminal 5. The operator may be configured to be, for example, a confirmation button, a reply button, a link, or the like. The destination of the confirmation notification does not necessarily correspond to the user. In the case of FIG. 2 described later, the management server 1 may send a confirmation notification to at least one of the first terminal 4 and the second terminal 5. The destination of the confirmation notification may overlap with or be different from the destination of the notification indicating the result of the association process. The confirmation notification may be configured to return a response directly or indirectly to the management server 1 in response to the operation of the operator by the user. When the management server 1 receives a response to the operation of the operator within a predetermined period, it may determine that the correspondence relationship continues, and when it does not receive a response, it may determine that the correspondence relationship does not continue.

[0046] In another example, when tracking the correspondence between the first object and the second object in the real world, the first terminal 4 and the second terminal 5 may include a positioning module such as a Global Positioning Satellite (GPS) module or a Global Navigation Satellite System (GNSS) module. The first terminal 4 may measure the current position of the first object (the first terminal 4) using the positioning module, and the second terminal 5 may measure the current position of the second object (the second terminal 5) using the positioning module. The first terminal 4 and the second terminal 5 may transmit the obtained current positions of each object to the management server 1 directly or indirectly via an external computer (e.g., the first server 2, the second server 3). The management server 1 may determine whether the correspondence continues depending on whether the received current positions of each object are close enough to satisfy a predetermined condition of the usage relationship (e.g., the user is riding in the mobility). That is, the management server 1 may determine that the correspondence relationship continues when the current positions of the objects are close enough to satisfy a predetermined condition, and may determine that the correspondence relationship does not continue when the current positions of the objects are not close enough. When this form is adopted, the management server 1 may store the obtained information on the current positions of the objects in association with the linking information. This enables the management server 1 to track the movement history of each object as well as the correspondence relationship of each object. At least a part of the above processing may be executed by a computer other than the management server 1.

[0047] When it is determined that the correspondence relationship continues, the management server 1 may maintain the setting of the correspondence relationship. On the other hand, when it is determined that the correspondence relationship does not continue, the management server 1 may cancel the correspondence relationship. After the correspondence relationship is set, the management server 1 may be configured to update the status of the correspondence relationship by repeatedly executing the confirmation process periodically or irregularly until the correspondence relationship is canceled.

[0048] (Unlink) In an operation example of this embodiment, the management server 1 may be configured to cancel the correspondence relationship upon receiving a cancellation request from at least one of the first terminal 4 and the second terminal 5 or upon the establishment of a specified cancellation condition.

[0049] (I) Cancellation request In one example, the linking release request (request) includes at least one of the first identifier and the second identifier. Simply, the first terminal 4 may send the management server 1 a release request that includes the first identifier and does not include the second identifier. Similarly, the second terminal 5 may send the management server 1 a release request that includes the second identifier and does not include the first identifier. When overlapping of the correspondence setting is permitted (when the first target or the second target is linked to multiple other targets), the release request may include both the first identifier and the second identifier. In one example, the first terminal 4 or the second terminal 5 may send the management server 1 a release request that includes the first identifier and the second identifier. In another example, the first terminal 4 may send a release request that includes one of the first identifier and the second identifier, and the second terminal 5 may send a release request that includes the other. In yet another example, the management server 1 may assign an identifier to the set correspondence, and may notify at least one of the first terminal 4 and the second terminal 5 of the assigned identifier at any timing, such as a notification indicating the result of the linking process. At least one of the first terminal 4 and the second terminal 5 may specify the relationship to be released by transmitting a release request including this identifier to the management server 1, and cause the management server 1 to release the specified relationship. According to one example of this embodiment, the first identifier and the second identifier can be omitted from the information included in the release request. This is expected to improve the efficiency of data communication in the release request.

[0050] The cancellation request from at least one of the first terminal 4 and the second terminal 5 may be sent directly from the requesting terminal to the management server 1, or may be sent indirectly to the management server 1 via an external computer (for example, the first server 2 or the second server 3). Also, the cancellation request from at least one of the first terminal 4 and the second terminal 5 may be sent to the management server 1 via the other of the first terminal 4 and the second terminal 5.

[0051] After receiving the cancellation request, the management server 1 refers to the association information and cancels the correspondence specified by the identifier included in the cancellation request. After this cancellation process, the management server 1 may transmit a notification indicating the result of the cancellation process to at least one of the first terminal 4 and the second terminal 5, in the same manner as when the association was set.

[0052] The process of the release request may include an authentication process of the second target. The authentication process of the second target may be the same as the authentication process in the above-mentioned binding setting process. However, when making the release request, the authentication process of the second target does not necessarily have to be executed. In another example, the process of the release request may be simplified by omitting the authentication process.

[0053] The trigger for the cancellation request may be set appropriately depending on the embodiment. In one example, when at least one of the first target and the second target is a user, the cancellation request may be sent from at least one of the first terminal 4 and the second terminal 5 by the user operating at least one of the first terminal 4 and the second terminal 5. In other words, the trigger for the cancellation request may be an operation by the user. In another example, when at least one of the first terminal 4 and the second terminal 5 is disconnected due to the termination of the usage relationship, An arbitrary information process may be executed in the terminal 4. A release request may be sent from at least one of the first terminal 4 and the second terminal 5, triggered by this arbitrary information process. For example, the arbitrary information process may be data exchange between the first terminal 4 and the second terminal 5. The method of data exchange when requesting release may be the same as the data exchange when setting the linkage. Data exchange when setting the linkage or data exchange when requesting release may be appropriately distinguished. For example, the first terminal 4 may be provided with separate sensor devices at the entrance and exit, such as at a bus entrance or a railway ticket gate. In this case, a distinction may be made between when setting the linkage or when requesting release, depending on the sensor device used for data exchange. Also, for example, when data exchange is executed by an application of the terminal, the application may be configured to be switchable between a linkage setting mode and a release request mode. In this case, a distinction may be made between when setting the linkage or when requesting release, depending on the mode of the application.

[0054] In addition, any internal process may be executed in the first terminal 4 and the second terminal 5 in association with the process of the release request. In one example, when the current association information is created in at least one of the first terminal 4 and the second terminal 5, at least one of the terminals may update the current association information to past association information in association with the process of the release request. The update process may be set appropriately according to the embodiment. For example, the update process may be to delete the current association information. In this case, the current association information may be completely deleted or may be saved as a past association history. Also, for example, the update process may be to invalidate the current association information by adding invalidation information such as an end time and an end flag setting to the current association information. When adopting a form in which one of the first terminal 4 and the second terminal 5 transmits the release request, the one terminal may transmit a notification to the other terminal to notify the other terminal of the release of the association in association with the transmission of the release request or the establishment of the release. When the current association information is created in the other terminal, the other terminal may execute the above update process in response to the notification.

[0055] (II) Termination Conditions The cancellation condition indicates a condition for canceling the correspondence relationship of the target, and may be defined appropriately depending on the embodiment.

[0056] In one example, the release condition may be defined so that the correspondence relationship is released at an arbitrarily set release time. The release time may be given, for example, by a user or another application (such as a scheduler). In this case, the management server 1 may release the target correspondence relationship upon arrival of the release time. The release time may be set as the expiration date of the above-mentioned association information. If the release time is set as the expiration date, the management server 1 may treat the target correspondence relationship as having been released upon arrival of the release time.

[0057] In another example, the cancellation condition may be defined such that the correspondence relationship is cancelled when the current location of each target no longer satisfies a predetermined condition for the usage relationship. In other words, the cancellation condition may be defined such that the correspondence relationship is cancelled when it is determined that the correspondence relationship is not continuing in a process of confirming continued use according to the current location of each target.

[0058] As described above, the management server 1 may cancel the correspondence relationship upon receiving a cancellation request from at least one of the first terminal 4 and the second terminal 5 or upon the establishment of a predetermined cancellation condition. According to one example of the present embodiment, it is possible to track the disappearance of the usage relationship between the first object and the second object. Note that the association information after the correspondence relationship is cancelled may be saved as history.

[0059] (Simplified pegging settings) In one example, when a usage relationship between the same combination of a first target and a second target is repeatedly created and terminated, the management system 100 may execute authentication processing for the second target each time, and repeatedly set and cancel the correspondence relationship. However, depending on the frequency with which the usage relationship is repeatedly created and terminated, In a case where the degree of authentication is high, it may be troublesome to perform authentication processing of the same second object each time. In particular, in a case where one of the first object and the second object is a user and the other is a mobility such as a private car that is used all the time, it may be troublesome to perform authentication of the second object each time.

[0060] Therefore, in another example, the management system 100 may be configured to set a correspondence relationship for the same combination of a first target and a second target by omitting authentication processing for the second target in the next and subsequent linking setting processes. That is, the management system 100 may be configured to accept a request to set a correspondence relationship for a combination of a first target and a second target for which a correspondence relationship has been set in the past by omitting authentication processing for the second target. For ease of explanation, the process of setting a correspondence relationship by omitting authentication processing for the second target is also referred to as "simplified linking setting process", and the process of the normal route in which authentication processing is not omitted is also referred to as "normal linking setting process".

[0061] The relationship between the operating organizations of the management server 1, the first server 2, and the second server 3 may be arbitrary. In one example, the operating organization of the management server 1 may overlap with the operating organization of at least one of the first server 2 and the second server 3. In another example, the operating organization of the management server 1 may be different from the operating organizations of the first server 2 and the second server 3. The management system 100 of the present disclosure may be produced by connecting the management server 1 to the first server 2, the second server 3, the first terminal 4, and the second terminal 5 via a network, and deploying each of them in a state capable of executing the above information processing according to the intention of the operating organization of the management server 1.

[0062] [Operation example] In one example, one of the first object and the second object may be a user. One of the first terminal 4 and the second terminal 5 corresponding to the user may be a user terminal related to the user. The other of the first object and the second object may be a moving body (mobility) used by the user. One of the first terminal 4 and the second terminal 5 corresponding to the mobility may be a loaded terminal loaded on the mobility. According to one example of the present embodiment, it is possible to track the usage relationship between the user and the mobility while ensuring security.

[0063] The type of mobility is not particularly limited as long as it can be used by a user, and may be appropriately selected according to the embodiment. The type of mobility may be appropriately selected. The mobility may be, for example, a vehicle, a railroad vehicle, an aircraft (aircraft, drone, etc.), a ship, etc. The mobility may be at least one of a manually controlled manned aircraft and an automatically controlled unmanned aircraft. When the mobility is a vehicle, the type of the vehicle may be arbitrarily selected. The type of the vehicle may be, for example, selected from a two-wheeled vehicle, a three-wheeled vehicle, a four-wheeled vehicle, etc. The vehicle may include a private car, a rental car, a shared car, a taxi, a bus, etc. The vehicle may be at least one of an automatic driving vehicle and a manually driving vehicle. The loaded terminal may be referred to as a mobility terminal. According to an example of the present embodiment, the usage relationship between the user and the mobility can be tracked.

[0064] 2 is a diagram showing an example of a situation in which the management system 100 of the present disclosure is applied. In the example shown in FIG. 2, a first object is mobility and a second object is a user. In the following description of the example of FIG. 2, for convenience, the "first" refers to the vehicle and the "second" refers to the user.

[0065] When the first object is a mobility, an example of the first terminal 4 is a mobility terminal (loading terminal). The mobility terminal may be, for example, a terminal attached inside or outside the mobility, a terminal carried by a person involved in the operation of the mobility (e.g., a driver, a conductor, etc.), a device installed in a mobility facility (e.g., a ticket gate, etc.), etc. If so, the mobility terminal may be referred to as a vehicle-mounted terminal.

[0066] An example of the first identifier is a mobility identifier (mobility ID, car ID). The mobility identifier may be, for example, an ID of a mobility account, identification information uniquely assigned to a target mobility (for example, a vehicle registration number, vehicle identification information (VIN: Vehicle Identification Number), etc.), or identification information of a mobility terminal, etc.

[0067] Mobility is an example of a use. The embodiment of FIG. 2 may be applied to any case in which the user (occupant) of the use changes dynamically. The use may be, for example, a rental object, an accommodation facility, etc., in addition to mobility. The rental object may include a rental office, a rental space, etc.

[0068] When the second object is a user, an example of the second terminal 5 is a user terminal. The user terminal may be any computer, such as a mobile terminal (such as a smartphone), a dedicated device (such as an electronic key device), or other computer device. Typically, the user terminal may be owned by a user who is the object to be linked (the second object). The user's account may be shared among multiple computers, and accordingly, each computer sharing the account may be used as a user terminal (the second terminal 5) of the same user.

[0069] An example of the second identifier is a user identifier (user ID, my ID). The user identifier may be, for example, a user account ID, a personal number, or identification information of a user terminal (for example, a MAC address or terminal identification information).

[0070] When the second object is a user, the information managed by the second server 3 includes information specific to the second object (e.g., the user's name, the user's biometric information, the user's personal number, etc.) and information used to authenticate the second object, as well as information on the authority of the corresponding user. The information on the user's authority may be associated with various information E10 for exercising the authority. The various information E10 may include, for example, information on public personal authentication, payment information, other service-related information, etc. The information on public personal authentication may include, for example, a personal number, etc. The payment information may include, for example, credit card information, Internet banking information, electronic payment information, etc. The other service-related information may include, for example, information on electronic prescriptions (insurer number, prescription information, etc.). The various information E10 may be managed by an external system or may be managed within the management system 100. The second server 3 may be deployed by a certification authority or an affiliated organization of the certification authority. The affiliated organization of the certification authority may be a public organization, a neutral organization, each business (vehicle manufacturer, service management company, etc.), etc. The second server 3 may be called a user ID server or a my ID server, etc.

[0071] The management system 100 may be configured to set a link between the first identifier and the second identifier in response to the start of use of the mobility, and to release the link in response to the end of use. Then, in response to the setting of the link between the first identifier and the second identifier, the management system 100 may enable (activate) the exercise of at least a part of the authority of the various information E10 associated with the user corresponding to the second identifier by the mobility corresponding to the first identifier. Furthermore, in response to the release of the link between the first identifier and the second identifier, the management system 100 may disable (inactivate) the authority enabled above.

[0072] The start and end of the use of the mobility may be detected by any method, for example, at the timing of getting on and off the mobility, renting and returning the mobility, etc. In one example, at least one of the start and end of the use may be detected in response to the execution of data exchange between the first terminal 4 and the second terminal 5.

[0073] In addition, the application of the management system 100 of the present disclosure may not be limited to a situation where a relationship between a user and mobility is tracked. In another example, both the first object and the second object may be robotic devices configured to operate autonomously by automatic control. The robotic device may include mobility such as an autonomous vehicle or a drone. In a situation where two or more robotic devices autonomously interact with each other, the management system 100 of the present disclosure may be used to track the emergence and extinction of a relationship between the robotic devices.

[0074] As a specific example, one of the first target and the second target may be a large autonomous vehicle, and the other may be a small autonomous vehicle. The large autonomous vehicle may be configured to accommodate a plurality of small autonomous vehicles. The large autonomous vehicle may collect, transport, and release each small autonomous vehicle as appropriate. Each small autonomous vehicle may be operated as appropriate at the release destination. In this case, the management system 100 of the present disclosure may be configured to track whether or not a large autonomous vehicle is being transported (collected) by setting and canceling a correspondence relationship between the large autonomous vehicle and the small autonomous vehicle.

[0075] (Data exchange in operational cases) In an operation example of this embodiment, a series of processes related to the association setting may be started with a trigger of data exchange (step SA101-step SA102 in FIG. 2) between the first terminal 4 and the second terminal 5. The method of data exchange is not particularly limited and may be appropriately selected depending on the embodiment.

[0076] In one example, data exchange between the first terminal 4 and the second terminal 5 may be performed by wireless or wired data communication. Wireless communication may be performed by, for example, Near Field Communication (NFC), Bluetooth (registered trademark), Wi-fi (registered trademark), etc. Wired communication may be performed by, for example, a wired Local Area Network (LAN), Universal Serial Bus (USB), etc. Data communication may be performed directly between the first terminal 4 and the second terminal 5, or indirectly via another computer. In another example, data exchange may be performed by a method other than data communication, such as reading a two-dimensional code.

[0077] In this embodiment, data exchange between the first terminal 4 and the second terminal starts with data provision (provision of electronic information) from the first terminal 4 to the second terminal 5. Then, in response to this, data is provided from the second terminal 5 to the first terminal 4 (provision of an electronic certificate of the second target, a second identifier of the second target, and an electronic signature of the second target).

[0078] (Second target electronic certificate in operational example) In an operation example of this embodiment, the electronic certificate of the second target is used to verify the authenticity of the second target. Such an electronic certificate is generated by a certification authority. The certification authority is a third-party organization that performs authentication-related tasks such as issuing an electronic certificate to the second target. The certification authority generates an electronic certificate for the second target in response to a request for issuance of an electronic certificate from a user who is the second target. Here, if the second server 3 is a server device deployed by the certification authority, the user who is the second target may request issuance of an electronic certificate through the second server 3. Also, if the second server 3 is a server device deployed by an organization or business other than the certification authority, the user who is the second target may directly request issuance of an electronic certificate to the certification authority.

[0079] Upon receiving a request for issuance of an electronic certificate, the certification authority performs identity verification of the second subject based on information for officially authenticating the second subject (e.g., a driver's license, driving history certificate, passport, personal identification card (My Number card, various welfare handbooks with a face photo affixed by a government agency, etc.)). If identity verification is successful, the certification authority creates owner identification information for the second subject. The certification authority calculates a hash value of plain text including the created owner identification information and the public key of the second subject. The generation of the owner identification information and the configuration of the plain text may be changed as desired. The certification authority: The calculated hash value is encrypted with the private key of the certification authority to generate a digital signature of the certification authority. The certification authority generates a digital certificate including information for reconstructing plaintext (in the above example, the owner identification information of the second target), the public key of the second target, and the digital signature of the certification authority. The certification authority registers the generated digital certificate in a repository. Note that the private key and public key of the second target may be generated by the user who is the second target, or may be generated by the certification authority.

[0080] The electronic certificate generated by the certification authority is passed to the user, who is the second subject, and stored in the second terminal 5. The electronic certificate or the owner identification information contained in the electronic certificate may be passed from the second subject to the second server 3 as information used to authenticate the second subject, and may be stored in the second server 3. The information used to authenticate the second subject may include the public key of the certification authority used to create the electronic certificate of the second subject, in addition to the owner identification information. The information used to authenticate the second subject may be stored in the second server 3 in a form linked to the second identifier when an account is created for the user, who is the second subject.

[0081] (Second Subject Electronic Signature in Operational Examples) In an operation example of this embodiment, the electronic signature of the second target is generated using predetermined information including electronic information and the second identifier provided from the first terminal 4 to the second terminal 5. In one example, the electronic signature of the second target may be generated by encrypting predetermined information using the private key of the second target generated when the electronic certificate of the second target is issued. The electronic information used to generate the electronic signature of the second target may be a random number generated by the first terminal 4, or may be a timestamp, etc. Note that the electronic information is not limited to a random number or a timestamp, etc., and can be arbitrarily selected depending on the embodiment.

[0082] In the operation example in this disclosure, the private key and public key of the user, which is the second subject, are referred to as "private key A" and "public key A," respectively, and the private key and public key of the certification authority are referred to as "private key B" and "public key B," respectively. Also, the electronic signature of the second subject is referred to as "electronic signature A," and the electronic signature of the certification authority is referred to as "electronic signature B."

[0083] (Authentication of the second subject in the operational example) In an operation example of this embodiment, authentication of the second target is achieved by verifying the authenticity of the second target. The verification of the authenticity of the second target in this embodiment includes verifying the validity of the digital certificate of the second target issued by the certification authority, verifying the validity of the second identifier of the second target, and verifying the validity of the digital signature A of the second target.

[0084] In verifying the validity of the second target electronic certificate, first, the certification authority's digital signature B included in the second target electronic certificate is decrypted using the certification authority's public key B. In addition, a hash value is calculated of the owner identification information and the plaintext of the second target's public key included in the second target electronic certificate. Then, the information obtained by decrypting the certification authority's digital signature B is compared with the calculated hash value. If the comparison between the information obtained by decrypting the certification authority's digital signature B and the calculated hash value is successful, the certification authority's repository is referenced to determine whether the second target electronic certificate has been revoked. If it is determined that the electronic certificate has not been revoked, it is determined that the verification of the validity of the second target electronic certificate has been successful.

[0085] Next, the validity of the second identifier of the second target is verified using information (information used to authenticate the second target) stored in the second server 3 in a form linked to the second identifier. In one example, the information used to authenticate the second target may include owner identification information generated when creating the electronic certificate of the second target. In this case, the validity of the second identifier is verified by comparing the owner identification information included in the electronic certificate of the second target with the owner identification information registered in the second server 3 in a form linked to the second identifier. When the matching between the owner identification information and the owner identification information already registered in the second server 3 in a manner linked to the second identifier is successful, the second identifier of the second target is determined to be valid.

[0086] The validity of the second target electronic certificate and second identifier may be verified by the second server 3. In this case, the first terminal 4 may request the second server 3 to verify the validity of the second target electronic certificate and second identifier by transmitting the second identifier and electronic signature B provided from the second terminal 5 to the second server 3. The validity of the second target electronic certificate and second identifier may also be verified by the first terminal 4. In this case, the first terminal 4 may obtain the public key B and owner identification information of the certification authority through the second server 3.

[0087] Next, the electronic signature A of the second target is verified using the public key A of the second target included in the electronic certificate of the second target. In verifying the electronic signature A of the second target, first, the electronic signature A of the second target is decrypted using the public key A of the second target included in the electronic certificate of the second target. Then, the information obtained by decrypting the electronic signature A of the second target is compared with predetermined information. The predetermined information used for the comparison is generated using electronic information provided from the first terminal 4 to the second terminal 5 and the second identifier provided from the second terminal to the first terminal 4. When the information obtained by decrypting the electronic signature A of the second target is successfully compared with the predetermined information, the electronic signature A of the second target is determined to be valid.

[0088] The validation of the second target electronic signature A may be performed by the first terminal 4. In that case, the first terminal 4 may decrypt the second target electronic signature A using the public key A included in the electronic certificate provided by the second terminal 5, and generate predetermined information using the electronic information provided to the second terminal 5 and the second identifier provided by the second terminal. The validation of the second target electronic signature A may also be performed by the second server 3. In that case, the first terminal 4 may request the second server 3 to validate the validity of the second target electronic signature A by transmitting the second target electronic certificate, the second target electronic signature A, and the predetermined information to the second server 3.

[0089] If the authentication of the second object by the above-mentioned method is successful, it is proven that the electronic signature A was generated using the private key A of the second object and the electronic information provided by the first terminal 4. This makes it possible to assume that the provider of the electronic signature A holds the private key A of the second object, and that the recipient of the electronic information and the provider of the electronic signature A are consistent. In other words, the consistency between the provider of the electronic signature A and the second object whose identity has been verified by the certification authority is guaranteed. Furthermore, the consistency between the provider of the electronic certificate and the second identifier and the second object registered in the second server 3 is also guaranteed. Therefore, if the authentication of the second object is successful, it can be determined that the authenticity of the second object is guaranteed.

[0090] (Use of linking information in operational examples) As described above, the linking information may be used in various situations. In one example, the linking information may be used simply to track the occurrence and disappearance of a relationship between a first object and a second object. In another example, the linking information may be used to enable at least a part of the authority linked to either the first object or the second object to be exercised from the other object while the correspondence relationship between the first object and the second object is set. In the example of FIG. 2, the linking information may be used to enable at least a part of the authority linked to the user to be exercised from the mobility object while the correspondence relationship between the user and the mobility object is set.

[0091] The use for enabling at least a part of the authority associated with the user to be exercised from the mobility may be, for example, when the authority held by the user is related to a public service, using the first identifier of the mobility to receive the provision of the public service to which the user has authority. In addition, the use for enabling at least a part of the authority associated with the user to be exercised from the mobility may be, for example, when the authority held by the user is a payment service, using the first identifier of the mobility to receive the provision of the public service to which the user has authority. The use for enabling at least a part of the authority associated with the user to be exercised from the mobility may be, in a case where the user is concerned with an electronic prescription service, using the first identifier of the mobility to receive an electronic prescription service for which the user has authority. The electronic prescription service may be, for example, receipt of medicine prescribed by an electronic prescription.

[0092] (Data communication between devices in operation examples) Data communication between each device (management server 1, first server 2, second server 3, first terminal 4, and second terminal 5) may not be particularly limited and may be appropriately selected depending on the embodiment. The network between each device may be appropriately selected from, for example, the Internet, a wireless communication network, a mobile communication network, a telephone network, a dedicated network, a local area network, etc. Data communication between each device may be encrypted using a method such as SSL (Secure Socket Layer) or TLS (Transport Layer Security). In one example, the first terminal 4 and the second terminal 5 may be equipped with a SIM (Subscriber Identity Module), and data communication between each of the first terminal 4 and the second terminal 5 and the management server 1 may be performed by encrypted communication using the SIM.

[0093] [Hardware configuration example] (Management Server) 3 is a diagram illustrating an example of a hardware configuration of the management server 1 in an operation example of this embodiment. The management server 1 according to this embodiment is a computer to which a control unit 11, a storage unit 12, a communication interface 13, an input device 14, an output device 15, and a drive 16 are electrically connected.

[0094] The control unit 11 includes a hardware processor such as a central processing unit (CPU), a random access memory (RAM), and a read only memory (ROM), and is configured to execute any information processing based on programs and various data. The control unit 11 (CPU) is an example of a processor resource of the management server 1.

[0095] The storage unit 12 may be configured, for example, with a hard disk drive, a solid state drive, a semiconductor memory, etc. The storage unit 12 (as well as RAM and ROM) is an example of a memory resource. In this embodiment, the storage unit 12 stores various information such as a management program 81 and linking information D10. The management program 81 is a program for causing the management server 1 to execute information processing relating to setting and releasing a correspondence relationship between a first object and a second object. The management program 81 includes a series of commands for the information processing.

[0096] The communication interface 13 is configured to perform wired or wireless communication via a network. The communication interface 13 may be configured, for example, by a wired LAN (Local Area Network) module, a wireless LAN module, etc. The management server 1 may perform data communication with other computers (the first server 2, the second server 3, the first terminal 4, and the second terminal 5) via the communication interface 13.

[0097] The input device 14 is, for example, a device for inputting data using a mouse, keyboard, operation buttons, etc. The output device 15 is, for example, a device for outputting data using a display, speaker, etc. An operator can operate the management server 1 by using the input device 14 and the output device 15. The input device 14 and the output device 15 may be integrally configured using, for example, a touch panel display, etc. The input device 14 and the output device 15 may be connected via an external interface. The external interface may be, for example, a USB (Universal Serial Bus) port, a dedicated port, a wireless communication port, etc., for connecting to an external device in a wired or wireless manner. It may be appropriately configured to connect to the device.

[0098] The drive 16 is a device for reading various information such as a program stored in the storage medium 91. At least one of the management program 81 and the association information D10 may be stored in the storage medium 91 instead of or together with the storage unit 12. The storage medium 91 is configured to accumulate various information (stored programs, etc.) by electrical, magnetic, optical, mechanical, or chemical action so that a machine such as a computer can read the information. The management server 1 may acquire at least one of the management program 81 and the association information D10 from the storage medium 91. The storage medium 91 may be a disk-type storage medium such as a CD or DVD, or may be a non-disk-type storage medium such as a semiconductor memory (e.g., a flash memory). The type of the drive 16 may be appropriately selected according to the type of the storage medium 91. The drive 16 may be connected via an external interface.

[0099] In addition, regarding the specific hardware configuration of the management server 1, components can be omitted, replaced, and added as appropriate depending on the embodiment. For example, the control unit 11 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, a field-programmable gate array (FPGA), a digital signal processor (DSP), a graphics processing unit (GPU), or the like. At least one of the input device 14, the output device 15, and the drive 16 may be omitted. The linking information D10 may be stored in an external computer (e.g., NAS: Network Attached Storage, etc.) accessible by the management server 1, instead of the storage unit 12. The management server 1 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The management server 1 may be an information processing device designed specifically for the service provided, as well as a general-purpose server device, a general-purpose computer, etc.

[0100] (First server) 4 is a schematic diagram showing an example of a hardware configuration of the first server 2 in an operation example of this embodiment. The first server 2 according to this embodiment is a computer to which a control unit 21, a storage unit 22, a communication interface 23, an input device 24, an output device 25, and a drive 26 are electrically connected. The control unit 21, the storage unit 22, the communication interface 23, the input device 24, the output device 25, the drive 26, and the storage medium 92 of the first server 2 may be configured similarly to the control unit 11, the storage unit 12, the communication interface 13, the input device 14, the output device 15, the drive 16, and the storage medium 91 of the management server 1, respectively.

[0101] The control unit 21 (CPU) is an example of a processor resource of the first server 2, and the storage unit 22 (and RAM, ROM) is an example of a memory resource of the first server 2. In this embodiment, the storage unit 22 stores various information such as a program 82 and first target information D20. The program 82 is a program for causing the first server 2 to execute information processing targeting the first target. The program 82 includes a series of instructions for the information processing. At least one of the program 82 and the first target information D20 may be stored in a storage medium 92 instead of or together with the storage unit 22. The first server 2 may acquire at least one of the program 82 and the first target information D20 from the storage medium 92. The first server 2 may perform data communication with another computer (such as the management server 1) via the communication interface 23. The first server 2 may be operated via an input device 24 and an output device 25.

[0102] In addition, regarding the specific hardware configuration of the first server 2, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 21 may include multiple hardware processors. The hardware processors include a microprocessor, an FP It may be configured with a GA, DSP, GPU, etc. At least one of the input device 24, the output device 25, and the drive 26 may be omitted. The first target information D20 may be stored in an external computer (e.g., NAS, etc.) accessible by the first server 2, instead of the storage unit 22. The first server 2 may be configured with a plurality of computers. In this case, the hardware configurations of the computers may or may not be the same. The first server 2 may be an information processing device designed exclusively for the service provided, as well as a general-purpose server device, a general-purpose computer, etc.

[0103] (Second server) 5 is a schematic diagram showing an example of a hardware configuration of the second server 3 according to an operation example of this embodiment. The second server 3 according to this embodiment is a computer to which a control unit 31, a storage unit 32, a communication interface 33, an input device 34, an output device 35, and a drive 36 are electrically connected. The control unit 31, the storage unit 32, the communication interface 33, the input device 34, the output device 35, the drive 36, and the storage medium 93 of the second server 3 may be configured similarly to the control unit 11, the storage unit 12, the communication interface 13, the input device 14, the output device 15, the drive 16, and the storage medium 91 of the management server 1, respectively.

[0104] The control unit 31 (CPU) is an example of a processor resource of the second server 3, and the storage unit 32 (and RAM, ROM) is an example of a memory resource of the second server 3. In this embodiment, the storage unit 32 stores various information such as a program 83 and second target information D30. The program 83 is a program for causing the second server 3 to execute information processing targeting the second target. The program 83 includes a series of instructions for the information processing. At least one of the program 83 and the second target information D30 may be stored in a storage medium 93 instead of or together with the storage unit 32. The second server 3 may acquire at least one of the program 83 and the second target information D30 from the storage medium 93. The second server 3 may perform data communication with another computer (such as the management server 1) via the communication interface 33. The second server 3 may be operated via an input device 34 and an output device 35.

[0105] In addition, regarding the specific hardware configuration of the second server 3, components can be omitted, replaced, and added as appropriate depending on the embodiment. For example, the control unit 31 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, FPGA, DSP, GPU, etc. At least one of the input device 34, the output device 35, and the drive 36 may be omitted. The second target information D30 may be stored in an external computer (e.g., NAS, etc.) accessible by the second server 3, instead of the storage unit 32. The second server 3 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The second server 3 may be an information processing device designed exclusively for the service provided, as well as a general-purpose server device, a general-purpose computer, etc.

[0106] (1st terminal) 6 is a schematic diagram showing an example of a hardware configuration of the first terminal 4 in an operation example of this embodiment. The first terminal 4 according to this embodiment is a computer to which a control unit 41, a storage unit 42, a communication interface 43, an input device 44, an output device 45, and a drive 46 are electrically connected. The control unit 41, the storage unit 42, the communication interface 43, the input device 44, the output device 45, the drive 46, and the storage medium 94 of the first terminal 4 may be configured similarly to the control unit 11, the storage unit 12, the communication interface 13, the input device 14, the output device 15, the drive 16, and the storage medium 91 of the management server 1, respectively.

[0107] The control unit 41 (CPU) is an example of a processor resource of the first terminal 4, and the memory unit 4 2 (and RAM, ROM) are an example of memory resources of the first terminal 4. In this embodiment, the storage unit 42 stores various information such as the program 84 and the first identifier I10. The program 84 is a program for causing the first terminal 4 to execute information processing related to the association. The program 84 includes a series of instructions for the information processing. At least one of the program 84 and the first identifier I10 may be stored in the storage medium 94 instead of the storage unit 42 or together with the storage unit 42. The first terminal 4 may acquire at least one of the program 84 and the first identifier I10 from the storage medium 94. The first terminal 4 may perform data communication with other computers (the management server 1, the second terminal 5, etc.) via the communication interface 43. The first terminal 4 may be operated via the input device 44 and the output device 45.

[0108] In addition, regarding the specific hardware configuration of the first terminal 4, components can be omitted, replaced, and added as appropriate depending on the embodiment. For example, the control unit 41 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, FPGA, DSP, GPU, ECU (Electronic Control Unit), etc. At least one of the input device 44, the output device 45, and the drive 46 may be omitted. The first identifier I10 may not be stored in the storage unit 42. The first identifier I10 may be acquired each time. In order to acquire data such as the identifier and unique information, the first terminal 4 may further include a data acquisition device such as a sensor or a reading device. The communication interface 43 may be configured with multiple types of modules. For example, the communication interface 43 includes a close-proximity wireless communication module and a wireless communication module, and the first terminal 4 may perform data communication with the second terminal 5 via the close-proximity wireless communication module and perform data communication with the management server 1 via the wireless communication module. The first terminal 4 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The first terminal 4 may be an information processing device designed specifically for the service provided, a general-purpose computer, a terminal device to be loaded onto a mobility vehicle, or the like.

[0109] (2nd terminal) 7 is a schematic diagram showing an example of a hardware configuration of the second terminal 5 according to the present embodiment. The second terminal 5 according to the present embodiment is a computer to which a control unit 51, a storage unit 52, a communication interface 53, an input device 54, an output device 55, and a drive 56 are electrically connected. The control unit 51, the storage unit 52, the communication interface 53, the input device 54, the output device 55, the drive 56, and the storage medium 95 of the second terminal 5 may be configured in the same manner as the control unit 11, the storage unit 12, the communication interface 13, the input device 14, the output device 15, the drive 16, and the storage medium 91 of the management server 1, respectively.

[0110] The control unit 51 (CPU) is an example of a processor resource of the second terminal 5, and the storage unit 52 (and RAM, ROM) is an example of a memory resource of the second terminal 5. In this embodiment, the storage unit 52 stores various information such as the program 85, the second identifier I20, the electronic certificate EC50, the private key A, and the public key A. The program 85 is a program for causing the second terminal 5 to execute information processing related to the linking. The program 85 includes a series of instructions for the information processing. At least one of the program 85, the second identifier I20, the electronic certificate EC50, the private key A, and the public key A may be stored in the storage medium 95 instead of or together with the storage unit 52. The second terminal 5 may obtain at least one of the program 85, the second identifier I20, the electronic certificate EC50, the private key A, and the public key A from the storage medium 95. The second terminal 5 may perform data communication with other computers (the management server 1, the first terminal 4, etc.) via the communication interface 53. The second terminal 5 may be operated via an input device 54 and an output device 55 .

[0111] In addition, regarding the specific hardware configuration of the second terminal 5, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 51 may be a The second terminal 5 may include a processor. The hardware processor may be configured by a microprocessor, FPGA, DSP, GPU, ECU, etc. At least one of the input device 54, the output device 55, and the drive 56 may be omitted. The second identifier I20, the electronic certificate EC50, the private key A, and the public key A may not be stored in the storage unit 52. That is, the second identifier I20, the electronic certificate EC50, the private key A, and the public key A may be acquired each time. In this case, the second terminal 5 may further include a data acquisition device such as a sensor and / or a reading device for acquiring the above-mentioned various data each time. The communication interface 53 may be configured by multiple types of modules, similar to the first terminal 4. The second terminal 5 may be configured by multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The second terminal 5 may be an information processing device designed exclusively for the service provided, a general-purpose computer, a terminal device for a user (for example, a smartphone, a tablet PC, etc.), etc.

[0112] [Software configuration example] FIG. 8 is a diagram illustrating an example of a software configuration of each device (the management server 1, the first server 2, the second server 3, the first terminal 4, and the second terminal 5) according to this embodiment.

[0113] (Management Server) The control unit 11 of the management server 1 loads the management program 81 stored in the storage unit 12 into the RAM, and causes the CPU to execute instructions included in the management program 81. As a result, the management server 1 operates as a computer including a setting unit 111, a release unit 112, and a notification unit 113 as software modules.

[0114] The setting unit 111 is configured to execute a process of setting the correspondence relationship between the first identifier I10 and the second identifier I20 when receiving a linking request (a request to set the correspondence relationship between the first identifier I10 and the second identifier I20) from the first terminal 4. In the process of setting the correspondence relationship between the first identifier I10 and the second identifier I20, the setting unit 111 generates linking information D10 for linking the first identifier I10 and the second identifier I20, and stores the generated linking information D10 in the storage unit 12.

[0115] In addition, when receiving a linking request from the first terminal 4, the setting unit 111 may authenticate the first target through the first server 2. Then, the setting unit 111 may set a correspondence relationship between the first identifier I10 and the second identifier I20 on the condition that the authentication of the first target is successful. In one example, the authentication of the first target may be performed using unique information of the first target. In that case, the linking request transmitted from the first terminal 4 to the management server 1 may include the unique information of the first target. Then, the setting unit 111 may request the first server 2 to authenticate the first target by transmitting the first identifier I10 and unique information of the first target to the first server 2.

[0116] As an example, the linking information D10 stored in the storage unit 12 may include a first identifier I10, a second identifier I20, a setting time, and a release time, as shown in FIG. 9. The setting time indicates the time when the correspondence between the first target and the second target is set. The setting time may be configured by a timestamp. The release time indicates the time when the correspondence between the first target and the second target is released. The value of the release time may be added when a process for releasing the correspondence is executed. The method of expressing the release is not limited to this example. In another example, the release time may be replaced with at least one of an expiration date and a flag. The expiration date indicates a period during which the setting of the correspondence is valid. In this case, whether the setting of the correspondence is valid or not (i.e., whether the correspondence is set or released) is indicated depending on whether it is within the expiration date or not. The flag indicates whether the correspondence has been released or not. The flag may be set when a process for releasing the correspondence is executed. In yet another example, the linking information D10 may include at least one of an expiration date and a flag together with a field for the release time. Note that, when the setting of the correspondence is As long as the linking information D10 can be used, the configuration of the linking information D10 need not be limited to the example in FIG. 9, and may be modified as appropriate depending on the embodiment. In another example, the linking information D10 may further include information indicating the type of the object of use (whether the object is a regular object of use or a temporary object of use). Note that the type of the object of use does not necessarily need to be identified by separate information. For example, the type of the object of use may be identified by information such as an identifier.

[0117] The cancellation unit 112 is configured to cancel the correspondence relationship upon receiving a cancellation request from at least one of the first terminal 4 and the second terminal 5 or upon establishment of a predetermined cancellation condition. The notification unit 113 is configured to transmit a notification indicating a result of the process of setting the correspondence relationship to at least one of the first terminal 4 and the second terminal 5. Furthermore, the notification unit 113 is configured to transmit a notification indicating a result of the process of canceling the correspondence relationship to at least one of the first terminal 4 and the second terminal 5.

[0118] (First server) The control unit 21 of the first server 2 executes instructions included in the program 82 by the CPU. As a result, the first server 2 operates as a computer having the registration unit 211 as a software module. The registration unit 211 executes an account creation process for the first target in response to a request for account creation for the first target. In the account creation process for the first target, the registration unit 211 generates a first identifier I10 for the first target, and stores first target information D20 including the generated first identifier I10 in the storage unit 22. In one example, the first target information D20 stored in the storage unit 22 may include the first identifier I10, unique information (such as a vehicle registration number, vehicle identification information, and identification information of the first terminal 4), a vehicle model, and an owner, as shown in FIG. 10.

[0119] The first server 2 may further include a software module for authenticating the first target in response to an authentication request from the management server 1. In this case, the software module may authenticate the first target using unique information of the first target. In one example, the software module may access the first target information D20 registered in the storage unit 22 using the first identifier I10 included in the authentication request from the management server 1 as an argument, and extract the registered unique information linked to the first identifier I10. Then, the software module may authenticate the first target by comparing the extracted unique information with the unique information included in the authentication request from the management server 1.

[0120] (Second server) The control unit 31 of the second server 3 executes instructions included in the program 83 by the CPU. As a result, the second server 3 operates as a computer including a registration unit 311 and an authentication unit 312 as software modules.

[0121] The registration unit 311 executes an account creation process for the second target in response to a request for account creation for the second target. In the account creation process for the second target, the registration unit 311 generates a second identifier I20 for the second target, and stores second target information D30 including the generated second identifier I20 in the storage unit 32. In one example, the second target information D30 stored in the storage unit 32 may include the second identifier I20, owner identification information, and authority information, as shown in FIG. 11. The owner identification information is an example of information used to authenticate the second target. The information used to authenticate the second target may include, in addition to the owner identification information, a public key B of the certification authority used to create the electronic certificate of the second target. The authority information is information about the authority of the corresponding user. The authority information may include, for example, information for linking with a server that executes information processing related to the user's authority, information indicating association with various information E10, and the like.

[0122] The authentication unit 312 receives a verification request from the first terminal 4 (second identifier I20 and electronic certificate EC5 In response to the request for validity verification of EC50, the authentication unit 312 verifies the validity of the second target electronic certificate EC50 and the validity of the second target second identifier I20. In verifying the validity of the second target electronic certificate, first, the authentication unit 312 uses the public key B of the certification authority to decrypt the digital signature B of the certification authority included in the second target electronic certificate. The authentication unit 312 also calculates a hash value of the plain text of the owner identification information and the public key of the second target included in the second target electronic certificate. The authentication unit 312 then compares the information obtained by decrypting the digital signature B of the certification authority with the calculated hash value. If the comparison between the information obtained by decrypting the digital signature B of the certification authority and the calculated hash value is successful, the authentication unit 312 refers to the repository of the certification authority and determines whether the second target electronic certificate EC50 has been revoked. If it is determined that the digital certificate has not been revoked, the authentication unit 312 determines that the verification of the validity of the second target electronic certificate has been successful.

[0123] In verifying the validity of the second identifier I20, the authentication unit 312 verifies the validity of the second identifier by comparing the owner identification information included in the electronic certificate EC50 of the second target with the owner identification information included in the second target information D30 in the storage unit 32. When the comparison between the owner identification information included in the electronic certificate EC50 of the second target and the owner identification information included in the second target information D30 in the storage unit 32 is successful, the authentication unit 312 determines that the second identifier of the second target is valid.

[0124] The authentication unit 312 transmits the verification results of the validity of the electronic certificate EC50 and the second identifier I20 to the first terminal 4 via the communication interface 33.

[0125] (1st terminal) The control unit 41 of the first terminal 4 executes instructions included in the program 84 by the CPU. As a result, the first terminal 4 operates as a computer having a data exchange unit 411, a verification unit 412, a setting request unit 413, and a release request unit 414 as software modules. The data exchange unit 411 is configured to execute data exchange with the second terminal 5. In this embodiment, the data exchange unit 411 is configured to generate electronic information and provide the generated electronic information to the second terminal 5, triggered by the occurrence of a usage relationship between the first target and the second target. Furthermore, the data exchange unit 411 is configured to receive the electronic certificate EC50, the second identifier I20, and the electronic signature A of the second target provided from the second terminal 5, and to pass the received data to the verification unit 412 described below.

[0126] The verification unit 412 is configured to verify the authenticity of the second target. In verifying the authenticity of the second target, the verification unit 412 verifies the validity of the electronic certificate EC50 of the second target, the validity of the second identifier I20 of the second target, and the validity of the electronic signature A of the second target. In this embodiment, the verification unit 412 requests the second server 3 to verify the validity of the electronic certificate EC50 of the second target and the validity of the second identifier I20 of the second target. The verification unit 412 verifies the validity of the electronic signature A of the second target. In verifying the validity of the electronic signature A of the second target, first, the verification unit 412 decrypts the electronic signature A of the second target using the public key A of the second target included in the electronic certificate EC50 of the second target. In addition, the verification unit 412 generates predetermined information using electronic information provided from the first terminal 4 to the second terminal 5 and the second identifier I20 provided from the second terminal to the first terminal 4. Then, the verification unit 412 compares the information obtained by decrypting the second electronic signature A with the generated predetermined information. If the comparison between the information obtained by decrypting the second electronic signature A and the predetermined information is successful, the verification unit 412 determines that the second electronic signature A is valid.

[0127] The setting request unit 413 is configured to request the management server 1 to set (link) a correspondence relationship between the first object and the second object, on condition that the validity of the electronic certificate EC50, the validity of the second identifier I20, and the validity of the electronic signature A are successfully verified. The cancellation request unit 414 is configured to request the management server 1 to cancel the correspondence relationship between the first object and the second object. It is configured to rely on

[0128] (2nd terminal) The control unit 51 of the second terminal 5 executes instructions included in the program 85 by the CPU. As a result, the second terminal 5 operates as a computer including a data exchange unit 511, a signature generation unit 512, and a release request unit 513 as software modules. The data exchange unit 511 is configured to execute data exchange with the first terminal 4. In this embodiment, the data exchange unit 511 is configured to receive electronic information provided from the first terminal 4 and pass the received data to a signature generation unit 512 described below. Furthermore, the data exchange unit 511 is configured to provide the first terminal 4 with an electronic certificate EC50, a second identifier I20, and an electronic signature A generated by a signature generation unit 512 described below.

[0129] The signature generation unit 512 is configured to generate a second target electronic signature A when the data exchange unit 511 receives electronic information provided from the first terminal 4. In generating the second target electronic signature A, the signature generation unit 512 first generates predetermined information including the electronic information provided from the first terminal 4 and the second identifier I20. Next, the signature generation unit 512 generates the second target electronic signature A by encrypting the generated predetermined information using the second target private key A.

[0130] The cancellation request unit 513 is configured to request the management server 1 to cancel the correspondence relationship.

[0131] In this embodiment, an example is described in which each software module of each device is realized by a general-purpose CPU. However, some or all of the above software modules may be realized by one or more dedicated processors. Each of the above modules may be realized as a hardware module. With regard to the software configuration of each device, modules may be omitted, replaced, or added as appropriate depending on the embodiment.

[0132] [Example] 12 shows an example of a processing procedure for linking settings by the management system 100 in an operation example of this embodiment. The following processing procedure is an example of a management method executed by a computer.

[0133] In step S11, the control unit 41 of the first terminal 4 operates as a data exchange unit 411 and provides electronic information to the second terminal 5. In response to this, the control unit 51 of the second terminal 5 operates as a data exchange unit 511 and receives the electronic information provided from the first terminal 4.

[0134] In step S12, the control unit 51 of the second terminal 5 operates as a signature generation unit 512 and generates a digital signature A of the second target using the digital information provided from the first terminal 4. In one example, the signature generation unit 512 first generates predetermined information including the digital information provided from the first terminal 4 and the second identifier I20 held in the storage unit 52. Next, the signature generation unit 512 encrypts the generated predetermined information using the private key A of the second target held in the storage unit 52, thereby generating a digital signature A of the second target.

[0135] In step S13, the control unit 51 of the second terminal 5 operates as a data exchange unit 511 and provides the generated second target electronic signature A, the second identifier I20 held in the memory unit 52, and the electronic certificate EC50 held in the memory unit 52 to the first terminal 4. In response to this, the control unit 41 of the first terminal 4 operates as a data exchange unit 411 and receives the electronic signature A, the second identifier I20, and the electronic certificate EC50 provided from the second terminal 5.

[0136] In step S14, the control unit 41 of the first terminal 4 operates as a verification unit 412 and transmits the second identifier I20 and the electronic certificate EC50 provided from the second terminal 5 to the second server 3, thereby requesting the second server 3 to verify the validity of the second identifier I20 and the electronic certificate EC50. Note that the transmission of the second identifier I20 and the electronic certificate EC50 to the management server 1 is performed via the communication interface 23.

[0137] In step S15, the verification request transmitted from the first terminal 4 is received by the communication interface 33 of the second server 3. In the second server 3 that has received the verification request from the first terminal 4, the control unit 31 operates as the authentication unit 312 and executes a process of verifying the validity of the second identifier I20 and the electronic certificate EC50 received from the first terminal 4. In one example, in verifying the validity of the electronic certificate EC50, the authentication unit 312 first accesses the second target information D30 in the storage unit 32 using the second identifier I20 as an argument, and acquires the public key B of the certification authority. The authentication unit 312 uses the acquired public key B to decrypt the electronic signature A of the certification authority included in the electronic certificate EC50. The authentication unit 312 also calculates a hash value of the plain text of the owner identification information and the public key A of the second target included in the electronic certificate EC50. The authentication unit 312 then compares the information obtained by decrypting the electronic signature B of the certification authority with the calculated hash value. If the comparison between the information obtained by decrypting the certificate authority's digital signature B and the calculated hash value is successful, the authentication unit 312 refers to the certificate authority's repository and determines whether the second target digital certificate EC50 has been revoked. If it is determined that the digital certificate has not been revoked, the authentication unit 312 determines that the validation of the second target digital certificate has been successful.

[0138] In addition, in one example, to verify the validity of the second identifier I20, the authentication unit 312 first accesses the second object information D30 in the storage unit 32 using the second identifier I20 as an argument, and acquires the owner identification information corresponding to the second object. Next, the authentication unit 312 verifies the validity of the second identifier by comparing the acquired owner identification information with the owner identification information included in the electronic certificate EC50. If the comparison between the acquired owner identification information and the owner identification information included in the electronic certificate EC50 is successful, the authentication unit 312 determines that the second identifier of the second object is valid.

[0139] If the verification of the validity of the second identifier I20 and the electronic certificate EC50 is successful, the authentication unit 312 transmits the verification result (verification success) to the first terminal 4 through the communication interface 33 (step S16).

[0140] In step S17, the verification result transmitted from the second server 3 is received by the communication interface 43 of the first terminal 4. In the first terminal 4 that has received the verification result from the second server 3, the control unit 41 operates as the verification unit 412 and verifies the validity of the second target electronic signature A provided from the second terminal 5. In one example, the verification unit 412 first decrypts the second target electronic signature A using the public key A of the second target included in the electronic certificate EC50 of the second target. The verification unit 412 also generates predetermined information using electronic information provided from the first terminal 4 to the second terminal 5 and the second identifier I20 provided from the second terminal to the first terminal 4. Then, the verification unit 412 compares the information obtained by decrypting the second target electronic signature A with the generated predetermined information. If the comparison of the information obtained by decrypting the second target electronic signature A with the predetermined information is successful, the verification unit 412 determines that the second target electronic signature A is valid.

[0141] In step S18, in response to successful verification of the validity of the electronic certificate EC50, the second identifier I20, and the electronic signature A, the control unit 41 of the first terminal 4 operates as a setting request unit 413 and requests the management server 1 to set the correspondence relationship between the first target and the second target. Specifically, the setting request unit 413 transmits a linking request including the first identifier I10 and the second identifier I20 to the management server 1 via the communication interface 23.

[0142] In step S19, the linking request transmitted from the first terminal 4 is received by the communication interface 13 of the management server 1. In response to this, the control unit 11 of the management server 1 operates as a setting unit 111 and executes the linking process. In one example, in the linking process, the setting unit 111 generates linking information D10 for linking the first identifier I10 and the second identifier I20, and records the generated linking information D10 in the storage unit 12.

[0143] In this embodiment, in response to the occurrence of a usage relationship between the first object and the second object, the authenticity of the second object is verified (steps S14-S17 in FIG. 12). This is expected to ensure security. Furthermore, if the authenticity of the second object is successfully verified, a corresponding relationship between the first identifier I10 and the second identifier I20 is set. Recording this setting makes it possible to trace the usage relationship between the first object and the second object. Therefore, according to this embodiment, it is possible to trace the usage relationship between the first object and the second object while ensuring security.

[0144] [Variation 1] Although the embodiments of the present disclosure have been described above by taking operational examples as examples, the above description is merely an example of the present disclosure in every respect. It goes without saying that various improvements or modifications can be made without departing from the scope of the present disclosure. For example, the following modifications are possible. In the following, the same reference numerals are used for components similar to those in the above operational examples, and the description of the same points as those in the above operational examples is omitted as appropriate.

[0145] In one example, the management system 100 may be configured to allow a proxy user of a second subject (user) to proxy exercise authority of the second subject through use of a first subject (mobility).

[0146] FIG. 13 is a diagram showing an example of a situation in which the management system 100 of this modified example is applied. FIG. 14 is a diagram showing an example of a hardware configuration of the third terminal 6 in this modified example. FIG. 15 is a diagram showing an example of a software configuration of each device (management server 1, first server 2, second server 3, first terminal 4, and second terminal 5) according to this modified example. FIG. 16 is a diagram showing an example of second target information D30 held by the second server 3 according to this modified example. FIG. 17 is a diagram showing an example of association information D10 held by the management server 1 in this modified example.

[0147] In FIG. 13, the second target grants the proxy user the proxy authority at any timing before the usage relationship between the first target and the proxy user occurs. In one example, the second target applies to the second server 3 for granting the proxy authority to the proxy user through the second terminal 5. Here, as shown in FIG. 15, the second terminal 5 of this modification operates as a computer having a proxy designation unit 514 as a software module in addition to a data exchange unit 511, a signature generation unit 512, and a release request unit 513. Accordingly, when applying to the second server 3 for granting the proxy authority to the proxy user, the control unit 51 of the second terminal 5 operates as the proxy designation unit 514. The proxy designation unit 514 applies to the second server 3 for granting the proxy authority to the proxy user by transmitting the second identifier I20 of the second target, the owner identification information of the second target, and the proxy identifier I30 of the proxy user to the second server 3 (step SB101).

[0148] The second server 3, which has received an application for proxy authority from the second terminal 5, authenticates the second target and grants proxy authority to the proxy user. Here, as shown in FIG. 15, the second server 3 in this modified example operates as a computer equipped with a proxy authority granting unit 313 as a software module in addition to a registration unit 311 and an authentication unit 312. Accordingly, in the second server 3, which has received an application for proxy authority from the second terminal 5, the control unit 31 operates as the proxy authority granting unit 313. The proxy authority granting unit 313 authenticates the owner identification information of the second target included in the application for proxy authority and the first authentication information stored in the memory unit 230. The validity of the second identifier I20 is verified by matching it with the owner identification information registered in the second target information D30 (the owner identification information registered in a form linked to the second identifier I20). If the matching of the owner identification information of the second target included in the proxy application with the owner identification information registered in the second target information D30 is successful, the proxy authority granting unit 313 determines that the second identifier I20 is valid.

[0149] When it is determined that the second identifier I20 of the second object is valid, the proxy authority granting unit 313 sets a correspondence (linkage) between the second identifier I20 of the second object and the proxy identifier I30 of the proxy user. In one example, the linkage may be set by recording the proxy identifier I30 in the second object information D30 corresponding to the second object. Note that in this modification, as shown in FIG. 16, the second object information D30 may include the electronic certificate EC50 of the second object and the proxy identifier I30 of the proxy user in addition to the second identifier I20, the owner identification information, and the authority information. Note that the second object information D30 may further include the private key A of the second object.

[0150] After completing the setting of the correspondence (linking) between the second identifier I20 of the second target and the proxy identifier I30 of the proxy user, the proxy authority granting unit 313 grants the proxy authority of the second target to the proxy user (step SB102). In one example, the proxy authority granting unit 313 grants the proxy authority of the second target to the proxy user (third terminal 6) by transmitting the second identifier I20 of the second target, the electronic certificate EC50 of the second target, and the private key A of the second target to a third terminal 6 (corresponding to the "proxy user terminal" according to the present disclosure) used by the proxy user. Note that the electronic certificate EC50 and the private key A of the second target may be provided directly from the second terminal 5 to the third terminal 6 after the proxy authority for the proxy user is granted.

[0151] When the proxy user (third terminal 6) is granted the proxy authority of the second target, if a usage relationship between the first target and the proxy user occurs, data is exchanged between the first terminal 4 and the third terminal 6. In one example, first, electronic information is provided from the first terminal 4 to the third terminal 6 (step SA1201). Next, in the third terminal 6 that receives the electronic information provided from the first terminal 4, an electronic signature A of the proxy user is generated. The generated electronic signature A is provided from the third terminal 6 to the first terminal 4 together with the second identifier I20, the electronic certificate EC50, and the proxy identifier I30 (step S1202).

[0152] Here, the third terminal 6 in this modification is configured as a computer in which a control unit 61, a storage unit 62, a communication interface 63, an input device 64, an output device 65, and a drive 66 are electrically connected, as shown in Fig. 14. The control unit 61, the storage unit 62, the communication interface 63, the input device 64, the output device 65, the drive 66, and the storage medium 96 of the third terminal 6 may be configured similarly to the control unit 51, the storage unit 52, the communication interface 53, the input device 54, the output device 55, the drive 56, and the storage medium 95 of the second terminal 5, respectively. However, the storage unit 62 of the third terminal 6 stores various information such as the program 86, the proxy identifier I30 of the proxy user, the second identifier I20 of the second target, the electronic certificate EC50 of the second target, and the private key A of the second target. The second identifier I20 of the second target, the electronic certificate EC50 of the second target, and the private key A of the second target were provided by the second server 3 when the agency authority for the second target was granted to the proxy user (step SB102).

[0153] The third terminal 6 having the hardware configuration as shown in Fig. 14 operates as a computer including a data exchange unit 611, a signature generation unit 612, and a release request unit 613 as software modules as shown in Fig. 15. The data exchange unit 611, the signature generation unit 612, and the release request unit 613 are realized by the control unit 61 of the third terminal 6 executing instructions included in the program 86 in the storage unit 62.

[0154] In the third terminal 6 having the software module shown in FIG. 15, the steps in FIG. In the step SA1201, the control unit 61 operates as a data exchange unit 611 and receives electronic information provided from the first terminal 4. Next, the control unit 61 of the third terminal 6 operates as a signature generation unit 612 and generates an electronic signature A of the second target. The generation of the electronic signature A may be similar to the above-mentioned operation example. That is, the signature generation unit 612 first generates predetermined information including the electronic information provided from the first terminal 4 and the second identifier I20 held in the storage unit 52. Then, the signature generation unit 612 generates an electronic signature A of the second target by encrypting the generated predetermined information using the private key A of the second target held in the storage unit 62.

[0155] When electronic signature A of the second target is generated, control unit 61 of third terminal 6 operates as data exchange unit 611 and provides the generated electronic signature A, the second identifier I20 of the second target held in memory unit 62, electronic certificate EC50 of the second target held in memory unit 62, and the proxy identifier I30 of the proxy user held in memory unit 62 to the first terminal 4. At this time, control unit 41 of first terminal 4 operates as data exchange unit 411 and receives electronic signature A, second identifier I20, electronic certificate EC50, and proxy identifier I30 provided from the third terminal 6.

[0156] In the first terminal 4 that receives the electronic signature A, the second identifier I20, the electronic certificate EC50, and the proxy identifier I30, the control unit 41 operates as a verification unit 412 and requests the second server 3 to verify the validity of the second identifier I20, the electronic certificate EC50, and the proxy identifier I30 by sending the second identifier I20, the electronic certificate EC50, and the proxy identifier I30 provided from the third terminal 6 to the second server 3 (step SA1203).

[0157] When the verification request transmitted from the first terminal 4 is received by the communication interface 23 of the second server 3, the control unit 31 of the second server 3 operates as the authentication unit 312 and executes a process of verifying the validity of the second identifier I20, the electronic certificate EC50, and the proxy identifier I30 received from the first terminal 4. The verification of the validity of the second identifier I20 and the electronic certificate EC50 may be the same as the above operation example. Regarding the verification of the validity of the proxy identifier I30, in one example, the authentication unit 312 first accesses the second target information D30 in the storage unit 32 using the second identifier I20 as an argument, and identifies the proxy identifier registered in the second target information D30 in a form linked to the second identifier I20. Next, the authentication unit 312 compares the proxy identifier registered in the second target information D30 with the proxy identifier I30 provided from the first terminal 4. When the proxy identifier registered in the second target information D30 and the proxy identifier I30 provided from the first terminal 4 are successfully matched, the authentication unit 312 determines that the proxy identifier I30 is valid.

[0158] If the verification of the validity of the second identifier I20, the electronic certificate EC50, and the proxy identifier I30 is successful, the authentication unit 312 transmits the verification result (verification success) to the first terminal 4 through the communication interface 33 (step SA1203). In this modification, the second server 3 that performs the above-mentioned verification process corresponds to the "external server 200" according to the present disclosure.

[0159] When the verification result transmitted from the second server 3 is received by the communication interface of the first terminal 4, the control unit 41 of the first terminal 4 operates as a verification unit 412 and verifies the validity of the electronic signature A provided from the third terminal 6 (step SA1205). The verification of the validity of the electronic signature A may be similar to the above-mentioned operation example.

[0160] If the verification of the validity of the second identifier I20, the electronic certificate EC50, and the electronic signature A is successful, the control unit 41 of the first terminal 4 operates as a setting request unit 413 and requests the management server 1 to set the correspondence relationship between the first target and the proxy user (step SA1206). In one example, the setting request unit 413 transmits a linking request including the first identifier I10, the second identifier I20, and the proxy identifier I30 to the management server 1 via the communication interface 23.

[0161] When the linking request transmitted from the first terminal 4 is received by the communication interface 13 of the management server 1, the control unit 11 of the management server 1 operates as the setting unit 111 and executes the linking process (step SA1207). In one example, the setting unit 111 generates linking information D10 for linking the first identifier I10, the second identifier I20, and the proxy identifier I30, and records the generated linking information D10 in the storage unit 12.

[0162] In one example, the linking information D10 in this modified example may include a first identifier I10, a second identifier I20, a proxy identifier I30, a setting time, and a release time, as shown in FIG. 17. The setting time indicates the time when the correspondence between the first target and the proxy user is set. The setting time may be configured by a timestamp. The release time indicates the time when the correspondence between the first target and the proxy user is released. The value of the release time may be added when the process of releasing the correspondence is executed. The method of expressing the release is not limited to this example. In another example, the release time may be replaced with at least one of an expiration date and a flag. The expiration date indicates a period during which the setting of the correspondence is valid. In this case, whether the setting of the correspondence is valid or not (i.e., whether the correspondence is set or released) is indicated depending on whether it is within the expiration date or not. The flag indicates whether the correspondence is released or not. The flag may be set when the process of releasing the correspondence is executed. In yet another example, the linking information D10 may include at least one of an expiration date and a flag together with a field of the release time. As long as the association information D10 can indicate the setting of the correspondence relationship, the configuration of the association information D10 is not limited to the example of FIG. 17 and may be changed as appropriate depending on the embodiment. In another example, the association information D10 may further include information indicating the type of the object (whether it is a regular object or a temporary object). The type of the object does not necessarily need to be identified by separate information. For example, the type of the object may be identified by information such as an identifier.

[0163] In step SB101 in FIG. 13, at least one of the expiration date of the proxy exercise and the authority (valid authority) permitting the proxy exercise may be specified together with the designation of the proxy user. In response to this, designation information configured to indicate at least one of the designated expiration date and the valid authority may be generated. The designation information of at least one of the designated expiration date and the valid authority may be appropriately managed. In one example, the designation information may be transmitted from the second terminal 5 to the second server 3 and managed in the second server 3 in a form associated with the second target information D30. When at least one of the expiration date of the proxy exercise and the authority (valid authority) permitting the proxy exercise is designated, the proxy authority granted to the proxy user may be extinguished upon the arrival of the designated valid authority. Furthermore, the proxy authority granted to the proxy user may be extinguished by the exercise of the designated valid authority.

[0164] According to this modified example, the proxy user can exercise the authority of the user (second target) on behalf of the user through the use of mobility. This makes it possible to increase the scalability of the authority exercise while ensuring security. For example, assume a situation in which the authority information includes information regarding an electronic prescription, and the authority of the target is to receive medicine prescribed by the electronic prescription. In this case, the user (second target) grants the authority of proxy to a proxy user such as a family member, and the proxy user can receive the medicine prescribed for the user (second target) through the use of mobility.

[0165] [Variation 2] In the above operation example, a case has been described in which the first object is a mobility and the second object is a user, but as shown in FIG. 17, the first object may be a user and the second object may be a mobility. In that case, the first terminal 4 may be a user terminal used by a user who is the first object, and the second terminal 5 may be a loaded terminal loaded on the mobility. Furthermore, the first server 2 may be configured to authenticate a user who is the first object, and the second server 3 may be configured to authenticate a mobility who is the second object. It is sufficient that the device is configured to perform authentication of the identity of the user.

[0166] <Other> The processes and means described in the present disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0167] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. Or, a process described as being performed by different devices may be executed by one device. In a computer system, the hardware configuration for implementing each function can be flexibly changed.

[0168] The present disclosure can also be realized by supplying a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors of the computer read and execute the program. Such a computer program may be provided to the computer by a non-transitory computer-readable storage medium connectable to the system bus of the computer, or may be provided to the computer via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk, etc.), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, a semiconductor drive (e.g., a solid-state drive), and any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0169] 1 Management Server 2. First Server 3 Second Server 4. Terminal 1 41 Control section 411 Data Exchange Department 412 Verification Department 413 Setting Request Department 414 Cancellation Request Department 42 Storage section 43 Communication Interface 44 Input Devices 45 Output Device 46 Drive 5. Terminal 2 84 Programs

Claims

1. A terminal associated with a first object, which is one of a mobility and a user, providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; verifying the validity of the obtained digital signature using the second target public key included in the digital certificate; transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; A control unit configured to execute Terminal.

2. The electronic signature of the second target is generated by encrypting predetermined information including the electronic information and the identifier of the second target using a private key corresponding to the public key of the second target. The terminal according to claim 1.

3. The electronic information is a random number generated by the control unit. The terminal according to claim 2.

4. Verifying the validity of the electronic certificate decrypting the digital signature of the certification authority included in the digital certificate using the public key of the certification authority; verifying the validity of information obtained by decrypting the digital signature of the certificate authority using identification information of the second target and the public key of the second target included in the digital certificate; determining whether the electronic certificate has expired; Including, The terminal according to claim 2.

5. the first object is the mobility, The terminal related to the first object is a loaded terminal loaded on the mobility vehicle, the second object is the user, The other terminal related to the second object is a proxy user terminal used by a proxy user of the user. The terminal according to claim 2.

6. Verifying the validity of the electronic certificate using a public key of the certificate authority to verify the validity of the obtained digital certificate and to verify the validity of the proxy user's proxy authority; The terminal according to claim 5.

7. Verifying the validity of the proxy user's proxy authority Transmitting a verification request including an identifier of the user and an identifier of the proxy user to an external server that manages information on a proxy user to which proxy authority has been granted by the user; receiving a verification result of the validity of the proxy authority of the proxy user from the external server; The terminal according to claim 6.

8. A terminal associated with a first object, which is one of a mobility object and a user, providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; verifying the validity of the obtained digital signature using the second target public key included in the digital certificate; transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; Execute Information processing methods.

9. The electronic signature of the second target is generated by encrypting predetermined information including the electronic information and the identifier of the second target using a private key corresponding to the public key of the second target. The information processing method according to claim 8.

10. The electronic information is a random number. The information processing method according to claim 9.

11. Verifying the validity of the electronic certificate decrypting the digital signature of the certification authority included in the digital certificate using the public key of the certification authority; verifying the validity of information obtained by decrypting the digital signature of the certificate authority using identification information of the second target and the public key of the second target included in the digital certificate; determining whether the electronic certificate has expired; Including, The information processing method according to claim 9.

12. the first object is the mobility, The terminal related to the first object is a loaded terminal loaded on the mobility vehicle, the second object is the user, The other terminal related to the second object is a proxy user terminal used by a proxy user of the user. The information processing method according to claim 9.

13. Verifying the validity of the electronic certificate using a public key of the certificate authority to verify the validity of the obtained digital certificate and to verify the validity of the proxy user's proxy authority; The information processing method according to claim 12.

14. Verifying the validity of the proxy user's proxy authority Transmitting a verification request including an identifier of the user and an identifier of the proxy user to an external server that manages information on a proxy user to which proxy authority has been granted by the user; receiving a verification result of the validity of the proxy authority of the proxy user from the external server; The information processing method according to claim 13.

15. A terminal associated with a first object, which is one of a mobility object and a user, providing electronic information to another terminal associated with a second subject, the second subject being the other of the mobility and the user; obtaining, from the other terminal, a digital signature of the second object generated using the digital information, a digital certificate of the second object issued by a certificate authority, and an identifier of the second object; verifying the validity of the obtained digital certificate using a public key of the certificate authority; verifying the validity of the obtained digital signature using the second target public key included in the digital certificate; transmitting, to a management server, a request for setting a correspondence relationship between the identifier of the first target and the identifier of the second target in response to a successful verification of the validity of the electronic certificate and the electronic signature; In order to execute program.

16. The electronic signature of the second target is generated by encrypting predetermined information including the electronic information and the identifier of the second target using a private key corresponding to the public key of the second target. The program according to claim 15.

17. The electronic information is a random number. The program according to claim 16.

18. Verifying the validity of the electronic certificate decrypting the digital signature of the certification authority included in the digital certificate using the public key of the certification authority; verifying the validity of information obtained by decrypting the digital signature of the certificate authority using identification information of the second target and the public key of the second target included in the digital certificate; determining whether the electronic certificate has expired; Including, The program according to claim 16.

19. the first object is the mobility, The terminal related to the first object is a loaded terminal loaded on the mobility vehicle, the second object is the user, The other terminal related to the second object is a proxy user terminal used by a proxy user of the user. The program according to claim 16.

20. Verifying the validity of the electronic certificate using a public key of the certificate authority to verify the validity of the obtained digital certificate and to verify the validity of the proxy user's proxy authority; 20. The program of claim 19.

Images