Information processing system, information processing method, and program

Abstract

To provide an information processing system, an information processing method, and a program capable of obtaining only processing results while mutually concealing data and an algorithm including a secret brought by a plurality of stakeholders having conflict of interest.SOLUTION: An information processing system includes: an identifier generation unit configured to generate a secret identifier in a first container in a reliable execution environment isolated from the outside, the first container being among a plurality of containers each having at least one stakeholder of a plurality of stakeholders; a safety verification unit configured to verify safety of the plurality of containers; and an identifier distribution unit configured to distribute, to a second container whose safety has been confirmed among the plurality of containers, the secret identifier to be used by the first container and the second container to execute processing in cooperation with each other.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] When multiple stakeholders with mutual interests bring together data and algorithms (processing logic) that contain secrets and wish to obtain only the processing results while keeping them confidential, the question arises as to where to aggregate and process them. For example, if processing is performed on infrastructure provided by a third party (such as a virtual environment on a cloud service), there is a concern that the data and algorithms may be intercepted by the infrastructure provider.

[0003] To prevent data and algorithms from being spied on by infrastructure providers, it is conceivable to execute processing in a container on a TEE (Trusted Execution Environment) (see, for example, Patent Document 1 below). Because the TEE is an execution environment isolated from infrastructure providers, even infrastructure providers with administrative privileges for the container cannot spy on the contents of the container. Therefore, by using a container on the TEE, stakeholders can execute processing while keeping data and algorithms secret from infrastructure providers. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2021-523483 Summary of the Invention [Problem to be solved by the invention]

[0005] However, when performing processing that links multiple containers on a TEE (for example, parallel distributed processing), it is necessary to share a secret identifier for encryption and authentication when sending and receiving intermediate data between the multiple containers.If one of multiple stakeholders generates a secret identifier and sets it in a container, the stakeholder who knows the secret identifier can impersonate the container, thereby enabling them to spy on intermediate data containing secrets of other stakeholders or to inject malicious programs into the processing.

[0006] In view of the above-mentioned problems, an object of the present invention is to provide an information processing system, an information processing method, and a program that can obtain only the processing results while keeping secret data and algorithms brought by multiple stakeholders with mutual interests confidential from each other. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems, an information processing system according to one embodiment of the present invention is an information processing system comprising: an identifier generation unit that generates a secret identifier in a first container in a trusted execution environment isolated from the outside, among a plurality of containers each owned by a plurality of stakeholders, the first container being one of the first containers; a safety verification unit that verifies the safety of the plurality of containers; and an identifier distribution unit that distributes the secret identifier to a second container among the plurality of containers whose safety has been confirmed, the second container using the secret identifier to enable the first container and the second container to work together to execute processing.

[0008] An information processing method according to one embodiment of the present invention is an information processing method executed by a computer, including an identifier generation process for generating a secret identifier in a first container in a trusted execution environment isolated from the outside, among a plurality of containers each owned by a plurality of stakeholders, the first container being one of the first containers, a security verification process for verifying the security of the plurality of containers, and an identifier distribution process for distributing the secret identifier to a second container among the plurality of containers whose security has been confirmed, the second container using the secret identifier to enable the first container and the second container to work together to execute processing.

[0009] A program according to one embodiment of the present invention is a program for causing a computer to function as an identifier generation means for generating a secret identifier in a first container in a trusted execution environment isolated from the outside world among a plurality of containers each owned by a plurality of stakeholders, with at least one container held by each of the plurality of stakeholders; a safety verification means for verifying the safety of the plurality of containers; and an identifier distribution means for distributing the secret identifier to a second container among the plurality of containers whose safety has been confirmed, to be used by the first container and the second container to work together to execute processing. [Effects of the Invention]

[0010] According to the present invention, it is possible to obtain only the processing results while keeping secret data and algorithms brought by multiple stakeholders who have mutual interests confidential from each other. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a block diagram illustrating an example of a configuration of an information processing system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing an example of the configuration of a container in which the Kicker program according to this embodiment runs. [Figure 3] FIG. 2 is a block diagram illustrating an example of the configuration of a container in which a Worker program according to the present embodiment runs. [Figure 4]10 is a flowchart illustrating an example of a processing flow in the information processing system according to the present embodiment. [Figure 5] 10A and 10B are diagrams illustrating the generation of a secret identifier and the verification of safety in the information processing system according to the present embodiment. [Figure 6] 10 is a diagram illustrating distribution of a secret identifier and execution of parallel distributed processing in an information processing system according to the present embodiment. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0013] <1. Information processing system configuration> The configuration of an information processing system according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the configuration of an information processing system according to this embodiment. The information processing system 1 shown in Fig. 1 is a system that uses data and algorithms provided by a data provider and an algorithm (processing logic) provider to execute processing in an infrastructure environment provided by an infrastructure provider and output the processing results. The data provider, algorithm provider, and infrastructure provider are examples of multiple stakeholders with mutual interests. Hereinafter, this embodiment will be described using as an example an example where there are three companies, Company A, Company B, and Company C, as data providers or algorithm providers.

[0014] The processing executed by the information processing system 1 is processing in which multiple containers, each of which is owned by, for example, a data provider and an algorithm provider among multiple stakeholders, are executed in cooperation with one another. The processing is, for example, parallel distributed processing or pipeline processing. In the following, this embodiment will be described using an example in which the processing executed by the information processing system 1 is parallel distributed processing.

[0015] 1, the information processing system 1 includes a server 10-1, a server 10-2, a server 20, and a server 30. Each server includes at least one of a container 100 and a container 200. Each server can communicate with other servers via a network NW.

[0016] (1) Server 10-1 The server 10-1 is a server that operates on the cloud of Company A. The server 10-1 includes a container 100, a container 200-1, and a container 200-2 as containers involved in the execution of distributed processing.

[0017] (2) Server 10-2 The server 10-2 is a server that operates on the cloud of Company A. The server 10-2 includes a container 200-3 as a container related to the execution of distributed processing.

[0018] (3) Server 20 The server 20 is a server that operates on the cloud of company B. The server 20 includes a container 200-4 as a container involved in the execution of distributed processing.

[0019] (4) Server 30 The server 30 is a server that operates on the cloud of company C. The server 30 includes a container 200-5 as a container related to the execution of distributed processing.

[0020] (5) Container 100 The container 100 is one of the containers that executes distributed processing. The container 100 is prepared as a container (first container) that functions as a master that can control other containers 200. For this reason, the container 100 is placed in advance in a trusted execution environment (TEE) that is isolated from the outside. In addition, a program for functioning as a master (hereinafter also referred to as a "Kicker program") and middleware for executing distributed processing (hereinafter also referred to as "distributed processing middleware") are pre-installed in the container 100. By being on a TEE, the container 100 can execute processing while keeping the data and algorithms confidential not only from data providers and algorithm providers, but also from infrastructure providers who have administrative authority over the container. Of the multiple containers included in the information processing system 1, only one container functions as the container 100, and the remaining containers function as the container 200. In some embodiments, the container 100 and the container 200 include an enclave isolated using a technology such as Software Guard Extensions (SGX) developed by Intel as a TEE and / or a virtual machine isolated using a technology such as Secure Encrypted Virtualization (SEV) developed by AMD as a TEE.

[0021] (6) Container 200 The container 200 is one of the containers that executes distributed processing. The container 200 is prepared as a container that functions under the control of the container 100 that functions as the master. A program (hereinafter also referred to as a "Worker program") for functioning under the control of the master and distributed processing middleware are pre-installed in the container 200. Of the multiple containers 200, only the container (second container) whose safety has been confirmed by the container 100 is able to execute distributed processing.

[0022] <2. Container configuration for running the Kicker program> The configuration of the information processing system 1 according to this embodiment has been described above. Next, the configuration of the container 100 in which the Kicker program according to this embodiment runs will be described with reference to Fig. 2. Fig. 2 is a block diagram showing an example of the configuration of the container 100 in which the Kicker program according to this embodiment runs. As shown in FIG. 2, the container 100 includes a Kicker program 110 and distributed processing middleware 120.

[0023] (1) Kicker Program 110 The Kicker program 110 is a program that allows the container 100 to function as a master and control the container 200 . As shown in FIG. 2, the Kicker program 110 includes an identifier generation unit 111, a safety verification unit 112, an identifier distribution unit 113, and an identifier setting unit 114.

[0024] (1-1) Identifier Generation Unit 111 The identifier generation unit 111 has a function of generating a secret identifier. The secret identifier is, for example, a random character string. The identifier generation unit 111 generates a secret identifier in a container 100 in the TEE among multiple containers, at least one of which is owned by multiple stakeholders. This allows the identifier generation unit 111 to prevent the secret identifier from being spied on by all stakeholders, including data providers, algorithm providers, and infrastructure providers. Note that the identifier generation unit 111 may also create a pair of keys that are owned by each of the multiple stakeholders.

[0025] (1-2) Safety Verification Unit 112 The safety verification unit 112 has a function of verifying the safety of multiple containers. In verifying safety, the safety verification unit 112 checks a first level of safety regarding the execution environment of the container 100 and the other containers 200, and a second level of safety regarding the execution environment of the other containers 200 except for the container 100 functioning as the master. The safety verification unit 112 approves a container 200 for which the safety of the execution environment can be confirmed in terms of both the first safety and the second safety through the safety verification as a target for distribution of a secret identifier. On the other hand, the safety verification unit 112 excludes a container 200 for which the safety of the execution environment cannot be confirmed in terms of either the first safety or the second safety through the safety verification from the target for distribution of a secret identifier.

[0026] In a first safety check regarding the execution environment of the container 100 and the other containers 200, the safety verification unit 112 verifies that the container 100 and the other containers 200 are running in the execution environment of the infrastructure provider. For example, upon receiving a request from the worker program of the container 200, the safety verification unit 112 establishes a secure communication path (TLS: Transport Layer Security) between the worker program of the container 200 and the kicker program of the container 100. At this time, the safety verification unit 112 performs server / client authentication using TLS certificates and verifies that both the container 100 running the kicker program and the container 200 running the worker program are running in the execution environment of the infrastructure provider. For example, the safety verification unit 112 uses TLS authentication to exclude containers 200 deployed on non-standard servers from targets for executing linked processing.

[0027] In the second safety confirmation regarding the execution environment of the other container 200, the safety verification unit 112 confirms that the container is in the TEE and that the middleware (distributed processing middleware) that executes the processing has not been tampered with. For example, the safety verification unit 112 confirms that each container is running on the TEE and that the distributed processing middleware (container image) has not been tampered with by performing remote attestation between the container 100 and the container 200. In this embodiment, the safety verification unit 112 confirms that the distributed processing middleware has not been tampered with, but this is not limiting, and the safety verification unit 112 may also confirm that the programs and data included in the execution environment have not been tampered with.

[0028] (1-3) Identifier distribution unit 113 The identifier distribution unit 113 has a function of distributing (transmitting) secret identifiers to the containers 200. The identifier distribution unit 113 distributes secret identifiers to the containers 200, among the multiple containers 200, whose safety has been confirmed by the safety verification unit 112, to the containers 200, which are used for the containers 100 and 200 to cooperate and execute processing.

[0029] (1-4) Identifier setting unit 114 The identifier setting unit 114 has a function of setting a secret identifier in the distributed processing middleware 120. The identifier setting unit 114 sets the secret identifier generated by the identifier generation unit 111 in the distributed processing middleware 120.

[0030] (2) Distributed Processing Middleware 120 The distributed processing middleware 120 has a function for executing distributed processing. As shown in FIG. 2, the distributed processing middleware 120 includes an identifier verification unit 121 and a processing execution unit 122.

[0031] (2-1) Identifier Verification Unit 121 The identifier verification unit 121 has a function of verifying the secret identifiers of other containers 200 that are to be linked. When executing a process linked with another container 200, the identifier verification unit 121 verifies whether or not its own container 100 and the other container 200 have the same secret identifier. The identifier verification unit 121 recognizes other containers 200 that are confirmed to have the same secret identifier through verification as targets for the process. On the other hand, the identifier verification unit 121 excludes other containers 200 that are confirmed to not have the same secret identifier through verification from targets for the linked process.

[0032] (2-2) Processing execution unit 122 The process execution unit 122 has a function of executing distributed processing. The process execution unit 122 executes processing in cooperation with only other containers 200 that have been confirmed by the identifier verification unit 121 to have the same secret identifier.

[0033] <3. Container configuration in which the Worker program runs> The configuration of the container 100 in which the Kicker program according to this embodiment runs has been described above. Next, the configuration of the container 200 in which the Worker program according to this embodiment runs will be described with reference to Fig. 3. Fig. 3 is a block diagram showing an example of the configuration of the container 200 in which the Worker program according to this embodiment runs. As shown in FIG. 3, the container 200 includes a worker program 210 and distributed processing middleware 220.

[0034] (1) Worker Program 210 The worker program 210 is a program for operating the container 200 under the control of the kicker program 110 of the container 100 . As shown in FIG. 3, the Worker program 210 includes a communication path establishment unit 211 and an identifier setting unit 212.

[0035] (1-1) Communication path establishment unit 211 The communication path establishment unit 211 has a function of establishing a secure communication path between the container 100 and the container 200. When the Worker program 210 is started, information indicating the connection destination of the container 100 is specified in advance in the container 200. Based on the connection destination, the communication path establishment unit 211 requests the Kicker program 110 of the container 100 to establish a secure communication path. When establishing a communication path, the communication path establishment unit 211 confirms the security of the execution environment of the container 100, which is the communication partner. For example, by performing Remote Attestation on the container 100, it is confirmed that the container 100 is running in a TEE, and that the container image and server certificate have not been tampered with, thereby confirming that the container 100 is running in the infrastructure provider's environment. If the security of the execution environment of the container 100 cannot be confirmed, the container 100 is not an appropriate distributor of the secret identifier, and the processing is terminated.

[0036] (1-2) Identifier setting unit 212 The identifier setting unit 212 has a function of setting a secret identifier in the distributed processing middleware 220. The identifier setting unit 212 sets a secret identifier distributed from the Kicker program 110 of the container 100 in the distributed processing middleware 220.

[0037] (2) Distributed Processing Middleware 220 The distributed processing middleware 220 has a function for executing distributed processing. As shown in FIG. 3, the distributed processing middleware 220 includes an identifier verification unit 221 and a process execution unit 222.

[0038] (2-1) Identifier Verification Unit 221 The identifier verification unit 221 has a function of verifying the secret identifier of another container (container 100 or container 200) that is to be linked. When executing a process linked with another container, the identifier verification unit 221 verifies whether its own container 200 and the other container have the same secret identifier. The identifier verification unit 221 recognizes another container that is confirmed to have the same secret identifier as a target for the process. On the other hand, the identifier verification unit 221 excludes another container that is confirmed to not have the same secret identifier as a target for the linked process.

[0039] (2-2) Processing execution unit 222 The process execution unit 222 has a function of executing distributed processing. The process execution unit 222 executes processing in cooperation with only other containers that have been confirmed by the identifier verification unit 221 to have the same secret identifier. When the container 200 executes processing in cooperation with other containers 200, the processing execution unit 222 can execute processing by directly communicating with the other containers 200 based on information in the container 100 indicating the connection destination of each container 200.

[0040] <4. Processing flow> The configuration of the container 200 in which the Worker program according to this embodiment runs has been described above. Next, the processing flow in the information processing system 1 according to this embodiment will be described with reference to Figs. 4 to 6. Fig. 4 is a flowchart showing an example of the processing flow in the information processing system 1 according to this embodiment. Fig. 5 is a diagram illustrating the generation of a secret identifier and the verification of safety in the information processing system 1 according to this embodiment. Fig. 6 is a diagram illustrating the distribution of a secret identifier and the execution of parallel distributed processing in the information processing system 1 according to this embodiment. 5 and 6 are diagrams showing specific examples of the processing flow shown in Fig. 4. Fig. 5 shows the processing of steps S101 to S103 in Fig. 4. Fig. 6 shows the processing of steps S104 to S107 in Fig. 4. Containers 200-1 to 200-5 shown in Fig. 5 and 6 include worker programs 210-1 to 210-5 and distributed processing middleware 220-1 to 220-5, respectively.

[0041] 4, first, the information processing system 1 generates a secret identifier (step S101). For example, in the example shown in Fig. 5, the identifier generation unit 111 of the Kicker program 110 of the container 100 on the TEE randomly generates a secret identifier.

[0042] Next, the information processing system 1 verifies a first security regarding the execution environment (step S102). For example, in the example shown in Fig. 5, the security verification unit 112 of the Kicker program 110 of the container 100 on the TEE receives a request from the communication path establishment unit 211 provided in each of the Worker programs 210-1 to 210-5 of the containers 200-1 to 200-5, establishes a secure communication path with each of the Worker programs 210-1 to 210-5 of the containers 200-1 to 200-5, and verifies the first security regarding the execution environment. 5, it is assumed that the container 200-5 of the server 30 in the cloud of company C is deployed to a server provided by an unspecified infrastructure provider. Therefore, the container 200-5 is excluded from the targets for executing the linked process by the first safety verification regarding the execution environment by the safety verification unit 112.

[0043] Next, the information processing system 1 verifies the second security regarding the execution environment (step S103). In the example shown in Fig. 5, the security verification unit 112 of the Kicker program 110 of the container 100 on the TEE verifies the second security regarding the execution environment between the Kicker program 110 of the containers 200-1 to 200-5 and the Worker programs 210-1 to 210-5 of the containers 200-1 to 200-5 with which a communication path has been established. 5, it is assumed that the distributed processing middleware 220-1 of the container 200-1 of the server 10-1 in the cloud of Company A has been tampered with, and the container 200-2 of the server 10-2 in the cloud of Company A and the container 200-5 of the server 30 in the cloud of Company C are not running on the TEE. Therefore, the containers 200-1, 200-2, and 200-5 are excluded from the targets for executing the coordinated process by the safety verification unit 112 performing the second safety verification on the execution environment.

[0044] 6, the information processing system 1 distributes the secret identifier (step S104). In the example shown in Fig. 6, the identifier distribution unit 113 of the Kicker program 110 of the container 100 on the TEE distributes the secret identifier generated by the identifier generation unit 111 to the worker program 210-3 of the container 200-3 and the worker program 210-4 of the container 200-4, whose safety has been confirmed by the safety verification unit 112.

[0045] Next, the information processing system 1 sets a secret identifier (step S105). In the example shown in Fig. 6, the identifier setting unit 114 of the Kicker program 110 of the container 100 on the TEE sets a secret identifier in the distributed processing middleware 120 of the container 100. Furthermore, the identifier setting unit 212 of the Worker program 210-3 of the container 200-3 sets a secret identifier in the distributed processing middleware 220 of the container 200-3. Furthermore, the identifier setting unit 212 of the Worker program 210-4 of the container 200-4 sets a secret identifier in the distributed processing middleware 220 of the container 200-4.

[0046] Next, the information processing system 1 verifies the secret identifier (step S106). In the example shown in FIG. 6, the identifier verification unit 121 of the distributed processing middleware 120 of the container 100 verifies whether the container 100 and the container 200-3 or 200-4 have the same secret identifier when executing a process linked with the container 200-3 or 200-4. The identifier verification unit 221 of the distributed processing middleware 220 of the container 200-3 verifies whether the container 200-3 and the container 100 or 200-4 have the same secret identifier when executing a process linked with the container 100 or 200-4. The identifier verification unit 221 of the distributed processing middleware 220 of the container 200-4 verifies whether the container 200-4 and the container 100 or 200-3 have the same secret identifier when executing a process linked with the container 100 or 200-3.

[0047] Next, the information processing system 1 executes parallel distributed processing (step S107). In the example shown in Fig. 6, the parallel distributed processing is executed by the distributed processing middleware 120 of the container 100, the distributed processing middleware 220 of the container 200-3, the distributed processing middleware 220 of the container 200-4, and the distributed processing middleware (processing execution unit 122 or processing execution unit 222) that has been confirmed to have the same secret identifier in step S106.

[0048] The processing flow according to this embodiment has been described above. As described above, the information processing system 1 according to this embodiment includes an identifier generation unit 111 that generates a secret identifier in a first container that is in a trusted execution environment isolated from the outside and is one of a plurality of containers owned by a plurality of stakeholders, at least one of which is owned by each of the stakeholders; a safety verification unit 112 that verifies the safety of the plurality of containers; and an identifier distribution unit 113 that distributes a secret identifier to a second container of the plurality of containers whose safety has been confirmed, the secret identifier being used by the first container and the second container to work together to execute processing.

[0049] This configuration eliminates the need for any of multiple stakeholders to generate a secret identifier and set it in a container, and the secret identifier is not known to the stakeholders, making it impossible for a stakeholder to spy on intermediate data containing the secrets of other stakeholders or to inject malicious programs into the process. Therefore, the information processing system 1 according to this embodiment makes it possible to obtain only the processing results while keeping secret data and algorithms brought together by multiple stakeholders who have mutual interests confidential from each other.

[0050] In addition, the results of the parallel distributed processing may be output to any stakeholder among the stakeholders, namely, the data provider, the algorithm provider, and the infrastructure provider, or the results of the parallel distributed processing may be output to a person other than these stakeholders.

[0051] The embodiments of the present invention have been described above. Note that the information processing system 1, the server 10, the server 20, the server 30, the container 100, and the container 200 in the above-described embodiment may be partly or entirely implemented by a computer. In this case, a program for implementing the functions may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into and executed by a computer system. Note that the term "computer system" as used herein includes hardware such as an OS and peripheral devices. Additionally, "computer-readable recording media" refers to portable media such as flexible disks, optical magnetic disks, ROMs, CD-ROMs, etc., and storage devices such as hard disks built into computer systems. Furthermore, "computer-readable recording media" may also include devices that dynamically store programs for a short period of time, such as communication lines when transmitting programs via networks such as the Internet or communication lines such as telephone lines, and devices that store programs for a certain period of time, such as volatile memory within computer systems that serve as servers or clients in such cases. Furthermore, the above program may be one that realizes part of the above-mentioned functions, or may be one that can realize the above-mentioned functions in combination with a program already recorded in a computer system, or may be one that is realized using a programmable logic device such as an FPGA (Field Programmable Gate Array).

[0052] The embodiments of the present invention have been described in detail above with reference to the drawings, but the specific configuration is not limited to that described above, and various design changes and the like are possible within the scope that does not deviate from the gist of the present invention. [Explanation of symbols]

[0053] 1...information processing system, 10 (10-1 to 10-2)...server, 20...server, 30...server, 100...container, 110...Kicker program, 111...identifier generation unit, 112...safety verification unit, 113...identifier distribution unit, 114...identifier setting unit, 120...distributed processing middleware, 121...identifier verification unit, 122...processing execution unit, 200 (200-1 to 200-5)...container, 210 (210-1 to 210-5)...worker program, 211...communication path establishment unit, 212...identifier setting unit, 220 (220-1 to 220-5)...distributed processing middleware, 221...identifier verification unit, 222...processing execution unit, NW...network

Claims

1. an identifier generation unit that generates a secret identifier in a first container in a trusted execution environment isolated from the outside, among a plurality of containers each of which has at least one for a plurality of stakeholders; a safety verification unit that verifies the safety of the plurality of containers; an identifier distribution unit that distributes the secret identifier to a second container of the plurality of containers whose safety has been confirmed, the secret identifier being used for the first container and the second container to execute processing in cooperation with each other; An information processing system comprising:

2. an identifier verification unit that, when executing a process linked with another container, verifies whether or not the container itself and the other container have the same secret identifier; a processing execution unit that executes processing in cooperation with only the other containers that have been confirmed to have the same secret identifier; The information processing system according to claim 1 , further comprising:

3. the identifier verification unit excludes the other container that is confirmed not to have the same secret identifier from being a target for executing a coordinated process; The information processing system according to claim 2 .

4. the safety verification unit confirms a first safety regarding an execution environment between the first container and other containers, and a second safety regarding an execution environment of other containers excluding the first container; The information processing system according to claim 1 .

5. the safety verification unit confirms, in the first safety confirmation, that the first container and the other container are running in an execution environment of an infrastructure provider; The information processing system according to claim 4 .

6. the safety verification unit verifies, in the second safety verification, that the device is in a trusted execution environment isolated from the outside and that the middleware that executes the process has not been tampered with. The information processing system according to claim 4 .

7. an identifier generation step of generating a secret identifier in a first container in a trusted execution environment isolated from the outside, among a plurality of containers each of which has at least one for a plurality of stakeholders; a safety verification step of verifying the safety of the plurality of containers; an identifier distribution step of distributing the secret identifier to a second container among the plurality of containers whose safety has been confirmed, the secret identifier being used for the first container and the second container to execute processing in cooperation with each other; 2. A computer-implemented information processing method comprising:

8. Computer, an identifier generating means for generating a secret identifier in a first container in a trusted execution environment isolated from the outside, among a plurality of containers each of which has at least one for a plurality of stakeholders; a safety verification means for verifying the safety of the plurality of containers; an identifier distribution means for distributing the secret identifier to a second container of the plurality of containers whose safety has been confirmed, the secret identifier being used for the first container and the second container to execute processing in cooperation with each other; A program to function as a

Images