Verification system and verification method

Abstract

To provide a verification system that verifies certificate information in various formats while protecting user privacy.SOLUTION: The verification system that verifies certificate information containing attribute information indicating a user's attributes and verification information related to verifying the user's credentials, is configured to include: a specification unit that specifies the format of the certificate information; an extraction unit that extracts verification information from the certificate information based on the specification result from the specification unit; a concealment unit that generates concealed attribute information by concealing a predetermined portion of the certificate information containing the attribute information; and a verification unit that performs verification based on the verification information extracted by the extraction unit and the concealed attribute information generated by the concealment unit.SELECTED DRAWING: Figure 12

Description

[Technical Field]

[0001] The present invention generally relates to techniques for verifying certificate information while protecting user privacy. [Background technology]

[0002] In identity management, the idea of ​​Self-Sovereign Identity (SSI), in which individuals control their own identities without the intervention of an administrative entity, has been attracting attention in recent years. The introduction of identity management based on SSI is particularly anticipated in use cases where protecting personal privacy is important. The elemental technologies for realizing SSI include Decentralized Identifier (DID) and Verifiable Credential (VC).

[0003] From the viewpoints of privacy protection and availability, an example of a verifiable certificate is an authorization system that utilizes VC. For example, a typical authorization system using VC consists of an issuer, holder, verifier, and VDR (Verifiable Data Registry). VC contains attribute information of the user who uses the holder requesting authorization from the verifier. When the verifier receives a VP (Verifiable Presentation) consisting of one or more VCs from the holder, authorization is performed based on the attribute information contained in the VP. In this case, the verifier must verify whether the presented VP and the VCs contained in the VP are valid before making an authorization decision.

[0004] In authorization using general certificates, a validation server has been proposed to reduce the burden on the verifier for validation (see Patent Document 1). For example, Patent Document 1 discloses the basic functions of the validation server.

[0005] Also, a format and presentation method of a selectively presentable VC has been proposed, which allows a Holder to pass only the attribute information it wishes to present to a Verifier and keep the rest confidential (see Non-Patent Document 1). For example, Non-Patent Document 1 defines a VC format called SD-JWT (Selective Disclosure JWT) that allows the Holder to selectively present only arbitrary attribute information. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-205230 [Non-Patent Document 1] Daniel Fett and two others, "Selective Disclosure for JWTs (SD-JWT)," [online], March 4, 2024, IETF Datatracker, [Retrieved April 23, 2024], Internet <URL: https: / / datatracker.ietf.org / doc / draft-ietf-oauth-selective-disclosure-jwt / > Summary of the Invention [Problem to be solved by the invention]

[0007] There are various data formats for VCs issued by issuers, and there is a problem that the verification server cannot perform verification while protecting the user's privacy. In Patent Document 1, the verification server does not support various formats and cannot protect the user's privacy. In Non-Patent Document 1, the user's privacy can be protected during verification, but the VC format (data format) is limited.

[0008] The present invention has been made in consideration of the above points, and aims to propose a verification system or the like that verifies certificate information in various formats while protecting the privacy of users. [Means for solving the problem]

[0009] In order to solve this problem, the present invention provides a verification system that verifies certificate information that includes attribute information indicating a user's attributes and verification information related to the verification of the user's qualifications, and includes an identification unit that identifies the format of the certificate information, an extraction unit that extracts verification information from the certificate information based on the identification result by the identification unit, a concealment unit that generates concealed attribute information by concealing a predetermined portion of the certificate information that includes the attribute information, and a verification unit that performs verification based on the verification information extracted by the extraction unit and the concealed attribute information generated by the concealment unit.

[0010] In the above configuration, verification information extracted according to the format of the certificate information and confidential attribute information in which the attribute information is concealed, rather than the user's attribute information, are used for verification, so that, for example, it is possible to verify various formats of certificate information while protecting the user's privacy. [Effects of the Invention]

[0011] According to the present invention, a highly confidential verification system can be realized. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 illustrates an example of a verification system according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of components of a verification system according to a first embodiment. [Figure 3] FIG. 2 illustrates an example of a software configuration of an issuer according to the first embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a software configuration of a Holder according to the first embodiment. [Figure 5] FIG. 2 illustrates an example of a software configuration of a verifier according to the first embodiment. [Figure 6]FIG. 2 illustrates an example of a software configuration of a validation server according to the first embodiment. [Figure 7] FIG. 1 illustrates an example of the configuration of a VDR according to a first embodiment. [Figure 8] FIG. 10 illustrates an example of processing for a VC according to the first embodiment; [Figure 9] FIG. 10 is a diagram illustrating an example of processing on a VP according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of a verification information extraction process and a confidentiality process according to the first embodiment. [Figure 11] FIG. 10 is a diagram illustrating an example of verification in the verification server according to the first embodiment. [Figure 12] FIG. 2 is a diagram illustrating an example of a sequence chart according to the first embodiment. [Figure 13] FIG. 10 is a diagram illustrating an example of a software configuration of a Holder according to a second embodiment. [Figure 14] FIG. 10 is a diagram illustrating an example of a user interface according to the second embodiment. [Figure 15] FIG. 10 illustrates an example of a software configuration of a verifier according to a second embodiment. [Figure 16] FIG. 10 is a diagram illustrating an example of a sequence chart according to the second embodiment. [Figure 17] FIG. 11 is a diagram illustrating an example of a software configuration of a Holder according to a third embodiment. [Figure 18] FIG. 11 is a diagram illustrating an example of a sequence chart according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] (I) First embodiment An embodiment of the present invention will be described in detail below, but the present invention is not limited to the embodiment.

[0014] In this embodiment, a verification system verifies a VP (Verifiable Presentation) including one or more VCs (Verifiable Credentials), and the verification system includes an Issuer, a Holder, an Agent, a verification server, and a Verifier.

[0015] The Issuer has the function of creating and issuing a VC for a user. The Holder has the function of holding the VC issued by the Issuer and outputting a VP containing one or more VCs requested by the Verifier. The Agent has the function of generating verification data from the VP output by the Holder and passing the generated verification data to the verification server. The verification server is a computer that performs the verification function of the Verifier and has the function of verifying the VP based on the verification data received from the Agent. VP verification includes at least one of signature verification, revocation verification, and validity verification for the VP and at least one of the single or multiple VCs included in the VP. The Verifier has the function of performing user-related processing (such as providing a service to the user) based on the verification results by the verification server.

[0016] For example, an Issuer issues a VC that includes a user's attribute information. Attribute information includes personal information such as name, age, gender, and address, as well as qualification information indicating the user's acquired qualifications. The Holder (e.g., the user's smartphone) holds the VC issued by the Issuer. When the Holder requests a Verifier (e.g., a convenience store cash register) to provide a service (e.g., sell alcoholic beverages), the Verifier requests one or more VCs (e.g., driver's license VCs) that include the user's attribute information (e.g., date of birth) required to approve or decline the provision of the service. The Holder then passes the VP that includes the VCs to the Agent. For example, the Agent is located in the Holder or the Verifier. The Agent generates verification data for the VP (VP verification data), identifies the formats of the VCs included in the VP, and generates verification data for each VC (VC verification data), and passes the VP verification data and each VC verification data to the verification server. Hereinafter, the VP verification data and VC verification data may be collectively referred to as verification data. The verification server verifies the VP and VC group based on the verification data. The Verifier makes an authorization decision based on the verification result by the verification server and the attribute information included in the VP, and provides the service (for example, confirming that the driver's license VC is valid and that the user is of legal age to sell alcoholic beverages, and then selling the alcoholic beverages). Note that while the example here shows the use of a single VC (driver's license VC), multiple VCs (for example, a university transcript VC and a driver's license VC in job hunting) may also be used.

[0017] The designations "first," "second," "third," etc. in this specification are used to identify components and do not necessarily limit the number or order. Furthermore, numbers used to identify components are used in different contexts, and numbers used in one context do not necessarily indicate the same configuration in another context. Furthermore, this does not prevent a component identified by a certain number from also serving the function of a component identified by another number.

[0018] Next, an embodiment of the present invention will be described with reference to the drawings. The following description and drawings are examples for explaining the present invention, and some omissions and simplifications have been made as appropriate for clarity of explanation. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0019] In the following description, identical elements in the drawings are given the same numbers, and their descriptions will be omitted where appropriate. When describing elements of the same type without distinction, the common portion (the portion excluding the branch number) of the reference sign including the branch number will be used, and when describing elements of the same type while distinguishing between them, the reference sign including the branch number will be used. For example, when describing VC20 without any particular distinction, it will be written as "VC20," and when describing individual VCs while distinguishing between them, it will be written as "VC20-1," "VC20-2," etc.

[0020] 1, reference numeral 1000 denotes an entire verification system according to the first embodiment.

[0021] The verification system 1000 includes, as its components, an issuer 100, a holder 200, a verifier 300, a verification server 400, and a VDR 500.

[0022] The Issuer 100, the Holder 200, the Verifier 300, the validation server 400, and the VDR 500 are communicably connected to one another via a network 600, and are able to exchange data and the like.

[0023] The Issuer 100 is at least one computer that creates a VC including attribute information of a user who uses the Holder 200 and outputs the VC to the Holder 200. Details of the Issuer 100 will be described later.

[0024] The Holder 200 is a terminal device such as a smartphone that creates a VP by adding its own digital signature to the VC issued by the Issuer 100 and outputs the VP to the Verifier 300. Details of the Holder 200 will be described later.

[0025] Verifier 300 is at least one computer that can make an authorization decision in response to a request for a service using a VP and provide a predetermined service. Verifier 300 extracts verification data from the VP presented by Holder 200 and passes it to verification server 400. It also receives the verification result from verification server 400. Details of Verifier 300 will be described later.

[0026] The verification server 400 is at least one computer that verifies the VP based on the verification data received from the Verifier 300. The verification server 400 passes the verification result to the Verifier 300. Details of the verification server 400 will be described later.

[0027] The VDR 500 is at least one computer that stores information related to the verification of the VP. Details of the VDR 500 will be described later.

[0028] 2 is a block diagram showing an example of components (entities) of the verification system 1000. The Issuer 100, Holder 200, Verifier 300, verification server 400, and VDR 500 may have substantially the same configuration, except for some differences in configuration and processing speed. Here, the hardware configuration of each component will be described using entity 10 as an example.

[0029] The entity 10 is at least one computer and includes a processor 11, a main memory device 12, an auxiliary memory device 13, an input device 14, an output device 15, and a communication I / F 16. The processor 11 is, for example, a CPU (Central Processing Unit) and executes programs. The main memory device 12 is, for example, a memory having a storage area capable of storing programs and data executed by the processor 11. The auxiliary memory device 13 is, for example, a cache and has a storage area for temporarily storing programs and data stored in the main memory device 12. The input device 14 is, for example, a mouse, keyboard, etc. that accepts operations from outside. The output device 15 is, for example, a display. The communication I / F 16 exchanges data, etc. with the outside via a network 600.

[0030] The functions of entity 10 may be realized, for example, by processor 11 reading a program stored in auxiliary storage device 13 into main storage device 12 and executing it (software), or may be realized by hardware such as a dedicated circuit, or may be realized by a combination of software and hardware. Note that one function of entity 10 may be divided into multiple functions, or multiple functions may be combined into one function. Also, some of the functions of entity 10 may be provided as separate functions or may be included in other functions. Also, some of the functions of entity 10 may be realized by another computer that can communicate with entity 10. Also, each hardware component of entity 10 may be one or more.

[0031] 3 is a block diagram showing an example of the software configuration of the Issuer 100. The Issuer 100 includes a VC issuance acceptance unit 101, a VC creation unit 102, a VC output unit 103, a public key information registration unit 104, and a revocation information registration unit 105.

[0032] The VC issuance reception unit 101 receives a request to issue a VC from the Holder 200. When the issuance request is received by the VC issuance reception unit 101, the VC creation unit 102 creates a VC including user attribute information. The VC output unit 103 outputs the VC created by the VC creation unit 102 to the Holder 200. The public key information registration unit 104 registers a public key corresponding to the private key of the Issuer 100 in the VDR 500. In public key management using the VDR 500, the public key information registration unit 104 registers, for example, a pair of (identifier, public key). At this time, the public key information registration unit 104 may use the identifier of the Issuer 100 as a DID and register a public key linked to the DID in the VDR 500. Furthermore, when the public key information registration unit 104 writes public key information to a VC without registering the public key in the VDR 500, it is not necessary to register anything in the VDR 500. The revocation information registration unit 105 registers the revocation information of the VC to be revoked in the VDR 500 .

[0033] The VC created by the VC creation unit 102 includes verification information used for verification, and is digitally signed with the private key of the Issuer 100. The verification information includes a public key identifier capable of identifying the public key corresponding to the private key, a revocation information identifier capable of identifying revocation information capable of confirming the revocation of the VC, validity information capable of confirming the validity of the VC, etc. Details of the data to be signed will be described later.

[0034] 4 is a block diagram showing an example of the software configuration of Holder 200. Holder 200 includes a VC issuance request unit 201, a VP creation unit 202, a VP presentation unit 203, a public key information registration unit 204, and a VC storage unit 205.

[0035] The VC issuance request unit 201 requests the Issuer 100 to issue a VC. The VP creation unit 202 creates a VC as a VP, which includes user attribute information required for the Verifier 300 to make an authorization decision. The VP may contain a single VC or multiple VCs. The VP created by the VP creation unit 202 is digitally signed with the private key of the Holder 200. The VP presentation unit 203 presents the VP created by the VP creation unit 202 to the Verifier 300.

[0036] The public key information registration unit 204 registers a public key corresponding to the private key of Holder 200 in the VDR 500. In public key management using the VDR 500, the public key information registration unit 204 registers, for example, a pair of (identifier, public key). At this time, the public key information registration unit 204 may use the identifier of Holder 200 as a DID and register a public key linked to the DID. Furthermore, if the public key information registration unit 204 writes public key information to a VC without registering the public key in the VDR 500, it is not necessary to register anything in the VDR 500. The VC storage unit 205 stores and manages the VC. Note that the VC may be stored and managed in a Wallet application downloaded to Holder 200. In this case, for example, Holder 200 presents a VP via the Wallet application.

[0037] 5 is a block diagram showing an example of the software configuration of the Verifier 300. The Verifier 300 is configured to include a Verifier basic function 310 and an Agent 320. The Verifier basic function 310 includes a VP acquisition unit A 311, a VP presentation unit 312, a verification result acquisition unit 313, an authorization decision unit 314, and a service provision unit 315. The Agent 320 includes a VP acquisition unit B 321, a format specification unit 322, a verification information extraction unit 323, a confidentiality processing unit 324, a verification data presentation unit 325, a verification result acquisition unit 326, a verification result presentation unit 327, and a format storage unit 328.

[0038] The VP acquisition unit A311 acquires a VP presented by Holder 200. The VP presentation unit 312 passes the VP to the VP acquisition unit B321 of Agent 320. The verification result acquisition unit 313 receives the verification result from Agent 320. The authorization decision unit 314 makes an authorization decision based on the attribute information of the VC and the verification result. The service provision unit 315 provides a service according to the result of the authorization decision by the authorization decision unit 314.

[0039] The VP acquisition unit B321 acquires a VP presented by the VP presentation unit 312 of the verifier basic function 310. The format identification unit 322 identifies the format of the VP acquired by the VP acquisition unit B321 and the format of each of the VCs included in the VP. VC formats include, for example, JWT format, JSON-LD format, and SD-JWT format. Note that the VP format may be the same as the VC, and includes JWT format, JSON-LD format, and SD-JWT format.

[0040] The verification information extraction unit 323 extracts a verification information group to be used for verification from the VP and the VC group included in the VP based on the format identified by the format identification unit 322. The concealment processing unit 324 performs concealment processing to conceal attribute information based on the format identified by the format identification unit 322. The verification data presentation unit 325 presents the data of the verification information group and the data that has been concealed to the verification server 400 as verification data.

[0041] The verification result acquisition unit 326 receives the verification result from the verification server 400. The verification result presentation unit 327 passes the verification result acquired by the verification result acquisition unit 326 to the authorization decision unit 314. The format storage unit 328 stores information on each format of the VP and VC group, and the verification portion and concealment portion corresponding to the format, in association with each other. In FIG. 5, the Agent 320 includes the format storage unit 328, but the format storage unit 328 may be provided as external storage, and the format storage unit 328 may communicate with the Agent 320.

[0042] 6 is a block diagram showing an example of the software configuration of the validation server 400. The validation server 400 includes a verification data acquisition unit 401, a public key acquisition unit 402, a revocation information acquisition unit 403, a signature verification unit 404, a revocation verification unit 405, a validity verification unit 406, and a verification result presentation unit 407.

[0043] The verification data acquisition unit 401 receives verification data from the Agent 320. The public key acquisition unit 402 acquires the public key of Issuer 100 and the public key of Holder 200 using information (public key identifier) ​​about the public key included in the verification data, for example, the identifier of Issuer 100 and the identifier of Holder 200. For example, when acquiring the public key of Issuer 100, the public key acquisition unit 402 acquires the public key of Issuer 100 using the identifier (ID) of Issuer 100 included in the verification data. Issuer ) to obtain the public key associated with the identifier from the VDR 500.

[0044] The revocation information acquisition unit 403 acquires revocation information using revocation specification information (in this example, revocation information identifier) ​​related to the revocation of the VC included in the verification data. For example, the revocation information acquisition unit 403 acquires revocation information using the identifier (ID) of the VC. VC ) from the VDR 500. However, the revocation information acquisition unit 403 may acquire the revocation information of the VC by inquiring of the Issuer 100.

[0045] The signature verification unit 404 verifies the signatures of the VP and the VCs included in the VP, using the verification data acquired by the verification data acquisition unit 401 and the public key acquired by the public key acquisition unit 402. For example, when the VC is in the JWT (JSON Web Token) format, the signature verification unit 404 receives the hash values ​​of the header and payload of the VC and the signature from the verification data acquisition unit 401, and verifies the ID of the Issuer 100 that issued the VC. Issuer The signature verification unit 404 decrypts the signature using the public key associated with the signature and verifies that it matches the hash value. If the signature verification unit 404 can verify the match, the signature verification is successful and it can be confirmed that there has been no spoofing or tampering.

[0046] The revocation verification unit 405 performs revocation verification between the VP and the VCs included in the VP using the revocation information acquired by the revocation information acquisition unit 403. For example, the revocation verification unit 405 performs revocation verification between the VP and the VCs included in the VP using the revocation information acquired by the revocation information acquisition unit 403. VC By obtaining the expiration information associated with the VC from the VDR 500, it is possible to check whether the VC has expired.

[0047] The validity verification unit 406 verifies the validity of the VP and the VCs included in the VP using the verification data acquired by the verification data acquisition unit 401. For example, in the case of a VC for which a validity period is set, the validity verification unit 406 can confirm that the VC is valid if it can confirm that the start date of the validity period has passed and that the end date of the validity period has not passed.

[0048] The verification result presentation unit 407 presents the verification results of the signature verification, revocation verification, and validity verification to the Agent.

[0049] 7 is a block diagram showing an example of the configuration of the VDR 500. The VDR 500 stores, for example, public key information of the Issuer 100 (Issuer public key information 501), public key information of the Holder 200 (Holder public key information 502), and VC revocation information (VC revocation information 503).

[0050] Here, a method for managing the issuer public key information 501 will be described. Issuer1 , Issuer100's public key pk Issuer1 For example, when expressing (ID Issuer1 ,pk Issuer1 The Holder public key information 502 is also managed in the same manner as the Issuer 100. The Holder 200's identifier is Holder1 , Holder200's public key pk Holder1 For example, when expressing (ID Holder1 ,pk Holder1An example of the identifier of the Issuer 100 and the identifier of the Holder 200 is the DID.

[0051] As a method for managing the VC revocation information 503, the identifier of the issued VC is ID VC1 , revocation information VC1 For example, when expressing (ID VC1 ,Revocation information VC1 ) is managed in this form.

[0052] In addition, VDR 500 may store other information such as VC validity information, VP validity information, and VP revocation information in the same manner as VC revocation information 503.

[0053] 8 is a diagram showing an example of processing for a VC by Agent 320. Here, the explanation will be given taking VC 20 as an example. For example, if the format of VC 20 is JWT format, VC 20 is composed of three elements: a header 21, a payload 22, and a signature 23. JWT is obtained by encoding these three elements using Base64URL.

[0054] The header 21 contains the type of token and the signature algorithm used. The payload 22 contains metadata 22A, attribute information 22B, and verification information 22C. The signature 23 contains a hash value of the header 21 and payload 22 signed with the private key of Issuer 100.

[0055] If the VC 20 is presented to the verification server 400 as is without processing by the Agent 320, the payload 22 including the attribute information 22B is decoded during verification of the VC 20, and the verification server 400 can see the contents of the attribute information 22B, which results in a violation of the user's privacy.

[0056] The concealment processing unit 324 of the Agent 320 performs concealment processing, that is, generates a hash value of the header 21 and the payload 22 including the attribute information 22B, resulting in a one-way value, and the contents of the attribute information 22B are concealed.

[0057] Furthermore, the verification information extraction unit 323 of the Agent 320 extracts the public key identifier, the revocation information identifier, and the validity information from the verification information 22C, and extracts the signature 23 from the VC 20. Here, the public key identifier, the revocation information identifier, the validity information, and the signature 23 extracted from the VC 20 by the verification information extraction unit 323 constitute a verification information group 31, which is an example of a verification information group. The header 21 and the payload 22 hashed by the confidentiality processing unit 324 constitute a hash value 32, which is an example of a hash value. The verification information group 31 and the hash value 32 are combined to constitute VC verification data 30, which is an example of VC verification data. The Agent 320 manages this in the form of (hash value, verification information group) as VC verification data. The verification server 400 can correctly verify the VC by using the VC verification data.

[0058] 9 is a diagram showing an example of processing performed by Agent 320 on a VP. Here, the explanation will be given taking VP 40 as an example. For example, when VP 40 is in the JWT format, VP 40 is composed of three elements: a header 41, a payload 42, and a signature 43. The header 41 describes the token type and the signature algorithm used. The payload 42 describes metadata 42A, a VC group 42B, and verification information 42C. The signature 43 describes a value obtained by signing a hash value of the header 41 and payload 42 with the private key of Holder 200.

[0059] Agent 320 extracts from VP 40 VP verification data 50 of VP 40 and VC verification data 30 for each VC 20 included in VP 40. The combination of VP verification data 50 and VC verification data 30 is verification data 60, which is an example of verification data. Verification data is composed of a set of (hash value, verification information group), and is output in the same number as the number of VPs and VCs included in the VP.

[0060] In addition, the VP verification data 50 is composed of a VP verification information group 51 and a VP hash value 52. Although not shown in the figure, the VP verification information group 51 includes a public key identifier capable of identifying the public key corresponding to the private key of Holder 200, a revocation information identifier capable of identifying the revocation information of the VP, VP validity information, a signature 43, etc. The VP hash value 52 includes a value obtained by hashing the header 41 and payload 42.

[0061] FIG. 10 is a diagram showing an example of the verification information extraction process and the confidentiality process of the Agent 320. In FIG.

[0062] Upon receiving the VP, the VP acquisition unit B321 passes the VP to the format identification unit 322.

[0063] The format identification unit 322 divides the VP into VCs and identifies the format of the VP and the format of each of the divided VCs. Next, the format identification unit 322 acquires format identification data from the format storage unit 328. The format identification data is managed in the form of format identification information, concealment part information, and verification part information for various formats (format information, format identification information, concealment part information, verification part information). The format identification information indicates information used to identify the format, the concealment part information indicates the part that needs to be concealed, and the verification part information indicates the part of the verification information and signature. The same applies to the VP, and a description thereof will be omitted.

[0064] For example, if the VC format is the JWT format, the VC format is identified depending on whether "jwt" is written in the "typ" field in the header of the data format. The format identification unit 322 references the format identification information, determines that "typ" = "jwt", and identifies the format as the JWT format. The format identification unit 322 also references the format identification information and performs a brute force format identification for the VP format and other VC formats. Furthermore, if the format is the JWT format, the hidden part is the header and the payload including attribute information. The verification parts are the algorithm written in the JWT header, the public key identifier, revocation information identifier, and validity information written in the payload, and the character string signed with the private key written in the signature.

[0065] First, the format identification unit 322 identifies the format of the VP and the format of the VC. Next, the format identification unit 322 identifies the concealment part and the verification part corresponding to the format for the VP and the divided VC group using the format identification data. At this time, the format identification unit 322 generates format data (format, concealment part, verification part) corresponding to each of the VP and the VC group using the format identification data acquired from the format storage unit 328, and passes the VP, the VC group, and the format data to the verification information extraction unit 323 and the concealment processing unit 324. As a result, even if, for example, a VP includes multiple different VC formats, the VC format can be determined, the VC concealment processing can be performed, and a VC verification information group can be extracted appropriately for each VC.

[0066] The verification information extraction unit 323 extracts a set of verification information from the VP and VC groups based on the format data generated by the format identification unit 322. At this time, the verification information extraction unit 323 extracts a public key identifier, a revocation information identifier, validity information, and a signature as the set of verification information.

[0067] The concealment processing unit 324 performs the concealment process using the format data generated by the format identification unit 322. For example, if the VC format is JWT, the hash value required for signature verification is the hash value of the header and payload. That is, if the VC format is JWT, the concealment parts are the header and payload.

[0068] The public key identifier and signature extracted by the verification information extraction unit 323 are used for signature verification in the verification server 400. General signature verification requires a public key, a signature, and a hash value of the data corresponding to the signature. For example, if the VC format is JWT, the verification server 400 uses the public key, the signature, and hash values ​​of the header and payload for signature verification. If a public key is stored in the VDR 500, the verification information extraction unit 323 extracts the identifier of the issuer 100, allowing the verification server 400 to obtain the public key associated with the identifier from the VDR 500. If a public key is included in the VC, the verification information extraction unit 323 extracts the public key as is.

[0069] The revocation information identifier extracted by the verification information extraction unit 323 is used for revocation verification in the verification server 400. The revocation information identifier is, for example, a VC identifier. When revocation information is stored in the VDR 500, the verification information extraction unit 323 extracts the VC identifier (ID VC ), the validation server 400 can obtain the revocation information associated with the VC from the VDR 500.

[0070] The validity information extracted by the verification information extraction unit 323 is used for validity verification in the verification server 400. For example, if a validity period is set for the VC, the verification information extraction unit 323 extracts the validity period, and the verification server 400 can verify the validity period by comparing it with the date and time when the VC was presented.

[0071] The processing order of the verification information extraction unit 323 and the concealment processing unit 324 may be parallel as shown in Fig. 10, or one may be performed first. Note that the processing by the verification information extraction unit 323 and the concealment processing unit 324 has been described using VC as an example, but the same may also be true for VP, and therefore a description thereof will be omitted.

[0072] The verification data presentation unit 325 receives the verification information group (public key identifier, revocation information identifier, validity information, and signature) extracted by the verification information extraction unit 323 and the hash value generated by the confidentiality processing unit 324, and presents all of these to the verification server 400 as verification data.

[0073] 11 is a diagram showing an example of verification in the verification server 400. A verification data acquisition unit 401 acquires verification data generated by the Agent 320. The verification data includes a public key identifier, a revocation information identifier, validity information, a signature, and a hash value.

[0074] The public key acquisition unit 402 receives the public key identifier from the verification data acquisition unit 401 and acquires the public key. For example, if the public key is stored in the VDR 500, the public key acquisition unit 402 acquires the public key by receiving the public key identifier from the verification data acquisition unit 401 and acquiring the public key. Issuer ) to obtain the public key corresponding to the identifier from VDR500, and then use it to obtain the identifier (ID Holder ) and obtains the public key corresponding to the identifier from the VDR 500.

[0075] The revocation information acquisition unit 403 receives the revocation information identifier from the verification data acquisition unit 401 and acquires the revocation information of the VP and VC group. For example, when the revocation information is stored in the VDR 500, the revocation information acquisition unit 403 acquires the VC identifier (ID VC1 ) and obtains the expiration information of the VC corresponding to the identifier from the VDR 500.

[0076] The processing order of the public key acquisition unit 402 and the revocation information acquisition unit 403 may be parallel as shown in FIG. 11, or one may be performed first.

[0077] The signature verification unit 404 receives the hash value and the signature from the verification data acquisition unit 401, and receives the public key from the public key acquisition unit 402. Signature verification is performed by checking the consistency between the hash value of the data corresponding to the signature and the value obtained by decrypting the signature with the public key. For example, if the VC format is JWT, the signature verification unit 404 performs VC signature verification by checking the consistency between the hash values ​​of the header and payload and the value obtained by decrypting the signature with the public key of the Issuer 100. Also, for example, if the VP format is JWT, the signature verification unit 404 performs VP signature verification by checking the consistency between the hash values ​​of the header and payload and the value obtained by decrypting the signature with the public key of the Holder 200.

[0078] The revocation verification unit 405 receives the revocation information of the VP and VC group from the revocation information acquisition unit 403. The revocation verification unit 405 receives the revocation information for the VP and VC group and performs revocation verification for each.

[0079] The validity verification unit 406 receives validity information from the verification data acquisition unit 401. For example, if a validity period is set in the VC, the validity verification unit 406 verifies the validity period.

[0080] The processing order of the signature verification unit 404, the revocation verification unit 405, and the validity verification unit 406 may be either parallel as shown in FIG. 11 or sequentially.

[0081] The verification result presenting unit 407 receives the verification results of the VP and VC group verified by the signature verification unit 404, revocation verification unit 405, and validity verification unit 406, and presents them as the verification results to the Agent 320. For example, if a VP includes VC1 and VC2, and the results of the signature verification, revocation verification, and validity verification of VP and VC1 and the revocation verification of VC2 are valid, and the results of the signature verification and validity verification of VC2 are invalid, the verification result presenting unit 407 presents them to the Agent 320 in the format of "(VP:(signature verification: valid, revocation verification: valid, validity verification: valid), VC1:(signature verification: valid, revocation verification: valid, validity verification: valid), VC2:(signature verification: invalid, revocation verification: valid, validity verification: invalid)".

[0082] 12 is a sequence chart showing an example of the procedure according to the first embodiment. The sequence chart shows a series of steps in which Holder 200 creates a VP, submits it to Verifier 300, and Verification Server 400 verifies the VP and passes the verification result to Verifier 300.

[0083] The VP creation unit 202 of the Holder 200 creates a VP from the VC requested by the Verifier 300. The VP presentation unit 203 presents the VP created by the VP creation unit 202 to the Verifier 300.

[0084] The Verifier 300 includes a Verifier basic function 310 and an Agent 320. A VP acquisition unit A311 of the Verifier basic function 310 receives a VP from the Holder 200. A VP presentation unit 312 passes the VP received by the VP acquisition unit A311 to the Agent 320.

[0085] The VP acquisition unit B321 of the Agent 320 receives a VP from the VP presenting unit 312. The format identification unit 322 divides the VP into VC groups and identifies the VP format and the format of each of the divided VC groups. After identifying the VP format and the format of each VC group, the format identification unit 322 passes format data that can identify the respective verification locations and concealment locations to the verification information extraction unit 323 and the concealment processing unit 324. The verification information extraction unit 323 uses the format data to extract a verification information group from the VP and VC group. The concealment processing unit 324 uses the format data to perform concealment processing on the VP and VC group. The verification data presenting unit 325 passes verification data including the verification information group extracted by the verification information extraction unit 323 and the hash value concealed by the concealment processing unit 324 to the verification server 400.

[0086] The verification data acquisition unit 401 of the verification server 400 receives verification data. The public key acquisition unit 402 receives the public key identifier from the verification data acquisition unit 401 and acquires the public key. For example, if a public key is stored in the VDR 500, the public key acquisition unit 402 acquires the public key of Issuer 100 from the VDR 500 using the identifier of Issuer 100, and acquires the public key of Holder 200 from the VDR 500 using the identifier of Holder 200. The revocation information acquisition unit 403 receives the revocation information identifier from the verification data acquisition unit 401 and acquires the revocation information. For example, if revocation information of a VC is stored in the VDR 500, the revocation information acquisition unit 403 acquires the revocation information of the VC from the VDR 500 based on the identifier of the VC.

[0087] The signature verification unit 404 performs signature verification based on the verification data received from the verification data acquisition unit 401 and the public key received from the public key acquisition unit 402. The revocation verification unit 405 performs revocation verification of the VP and VC group using the revocation information received from the revocation information acquisition unit 403. The validity verification unit 406 performs validity verification of the VP and VC group using the validity information received from the verification data acquisition unit 401. The verification result presentation unit 407 receives the verification results of the VP and VC group verified by the signature verification unit 404, revocation verification unit 405, and validity verification unit 406, and presents them to the Agent as the verification results.

[0088] In the Verifier 300, the verification result acquisition unit 326 of the Agent 320 receives the verification result from the verification server 400. The verification result presentation unit 327 of the Agent 320 passes the verification result to the Verifier basic function 310. The verification result acquisition unit 313 of the Verifier basic function 310 receives the verification result from the Agent 320, and the Verifier 300 makes an authorization decision based on the VC attribute information and the verification result, and provides a service according to the result of the authorization decision.

[0089] According to this embodiment, the attribute information is kept confidential in the verifier, so that signature verification, revocation verification, and validity verification can be performed while protecting the privacy of the user.

[0090] (II) Second embodiment The verification system using the present invention according to the second embodiment has almost the same configuration and operation as the verification system using the present invention according to the first embodiment, so the following mainly describes the differences.

[0091] In the second embodiment, the Holder 200 is configured to include an Agent 220. This configuration allows a user to pass verification data to the verification server 400 at their own discretion. The Agent 220 presents a VP to the Verifier 300, and the verification server 400 presents a verification result to the Verifier 300, so the Verifier 300 associates the VP with the verification result and makes an authorization decision. Details will be explained below.

[0092] 13 is a block diagram showing an example of the software configuration of Holder 200 according to the second embodiment. Holder 200 is configured to include Holder basic function 210 and Agent 220. Holder basic function 210 includes VC issuance request unit 211, VP creation unit 212, VP presenter A 213, public key information registration unit 214, and VC storage unit 215. Agent 220 includes VP acquisition unit 221, VP presenter B 222, format identification unit 223, verification information extraction unit 224, confidentiality processing unit 225, verification data presenter 226, and format storage unit 227.

[0093] The VC issuance request unit 211 requests the Issuer 100 to issue a VC. The VP creation unit 212 creates a VC as a VP, which includes user attribute information required for the Verifier 300 to make an authorization decision. The VP may contain a single VC or multiple VCs. The VP presentation unit A213 presents the VP created by the VP creation unit 212 to the VP acquisition unit 221 of the Agent 220. The public key information registration unit 214 registers the public key corresponding to the private key of the Holder 200 in the VDR 500. The VC storage unit 215 stores and manages the VCs.

[0094] The VP acquisition unit 221 acquires a VP presented from the Holder basic function 210. The VP presentation unit B222 presents the VP acquired by the VP acquisition unit 221 to the Verifier 300. The format identification unit 223 divides the VP into VC groups and identifies the VP format and each format of the divided VC groups. The format identification unit 223 identifies the VP format and each format of the VC groups, and passes format data that can identify each verification point and concealment point to the verification information extraction unit 224 and the concealment processing unit 225.

[0095] The verification information extraction unit 224 extracts a set of verification information from the VPs and VCs using the format data. The concealment processing unit 225 performs concealment processing on the VPs and VCs using the format data. The verification data presentation unit 226 receives an instruction from the user as to whether to transmit verification data including the verification information extracted by the verification information extraction unit 224 and the hash value concealed by the concealment processing unit 225. In response to receiving the instruction from the user, the verification data presentation unit 226 passes the verification data to the verification server 400. The format storage unit 227 stores information on each format of the VPs and VCs and the corresponding verification locations and concealment locations in association with each other. In FIG. 13, the Agent 220 includes the format storage unit 227. However, the format storage unit 227 may be provided as an external storage, and the format storage unit 227 may communicate with the Agent 220.

[0096] FIG. 14 shows an example of a user interface (confirmation screen 70) when the Holder 200 presents verification data to the verification server 400. The confirmation screen 70 is displayed when the verification data presenting unit 226 presents verification data to the verification server 400. On the confirmation screen 70-1, the user can confirm that the verification server 400 that presents the verification data is "Server-1" and that the VP to be presented is "VP1." On the confirmation screen 70-2, the user can confirm that "VP1" includes "VC1," "VC2," "VC3," and "VC4." In this way, the VP and the VCs included in the VP can be confirmed on the confirmation screen 70, so the user can select the verification server to present the verification data to and the VP and VCs to be presented at their own discretion. The confirmation screen 70 may be displayed on a Wallet app downloaded to the Holder 200.

[0097] 15 is a block diagram showing an example of the software configuration of the verifier 300 according to the second embodiment. The verifier 300 includes a VP acquisition unit 331, a verification result acquisition unit 332, an authorization decision unit 333, and a service provision unit 334.

[0098] The VP acquisition unit 331 acquires a VP presented by the Holder 200. The verification result acquisition unit 332 receives the verification result from the verification server 400. The authorization decision unit 333 makes an authorization decision based on the attribute information of the VC and the verification result. The service provision unit 334 provides a service according to the result of the authorization decision.

[0099] 16 is a sequence chart showing an example of the procedure according to the second embodiment. The sequence chart shows a series of steps in which Holder 200 creates a VP, submits verification data to the verification server 400, and the verification server 400 verifies the VP and passes the verification result to Verifier 300.

[0100] Holder 200 comprises Holder basic function 210 and Agent 220. VP creation unit 212 of Holder basic function 210 creates a VP from the VC requested by Verifier 300. VP presentation unit A 213 presents the VP created by VP creation unit 212 to Agent 220. VP acquisition unit 221 of Agent 220 receives the VP. VP presentation unit B 222 passes the VP received by VP acquisition unit 221 to Verifier 300.

[0101] The format identification unit 223 divides the VP received by the VP acquisition unit 221 into VCs, identifies the format of the VP and each format of the divided VCs, and passes format data capable of identifying the respective verification locations and concealment locations to the verification information extraction unit 224 and the concealment processing unit 225. The verification information extraction unit 224 extracts a verification information group from the VP and VCs using the format data. The concealment processing unit 225 performs concealment processing on the VP and VCs using the format data. The verification data presenting unit 226 passes verification data including the verification information group extracted by the verification information extraction unit 224 and the hash value concealed by the concealment processing unit 225 to the verification server 400. At this time, a confirmation screen such as that shown in FIG. 14 is displayed to the user, and the user selects, at his or her own discretion, the verification server 400 to which the verification data should be presented and the VP and VC group to be presented.

[0102] The verification data acquisition unit 401 of the verification server 400 receives verification data from the verification data presenting unit 226. The public key acquisition unit 402 receives the public key identifier from the verification data acquisition unit 401 and acquires the public key. For example, if the public key is stored in the VDR 500, the public key acquisition unit 402 acquires the public key of Issuer 100 from the VDR 500 using the identifier of Issuer 100, and acquires the public key of Holder 200 from the VDR 500 using the identifier of Holder 200. The revocation information acquisition unit 403 receives the revocation identifiers of the VP and VC groups from the verification data acquisition unit 401 and acquires the revocation information of the VP and VC groups. For example, if the revocation information of a VC is stored in the VDR 500, the revocation information acquisition unit 403 acquires the revocation information of the VC from the VDR 500 using the identifier of the VC.

[0103] The signature verification unit 404 verifies the signatures of the VP and VC group using the verification data received from the verification data acquisition unit 401 and the public key received from the public key acquisition unit 402. The revocation verification unit 405 verifies the revocation of the VP and VC group based on the revocation information received from the revocation information acquisition unit 403. The validity verification unit 406 verifies the validity of the VP and VC group based on the validity information received from the verification data acquisition unit 401. The verification result presentation unit 407 receives the verification results of the VP and VC group verified by the signature verification unit 404, revocation verification unit 405, and validity verification unit 406, and presents them to the Verifier 300 as the verification results.

[0104] The VP acquisition unit 331 of the Verifier 300 receives the VP from the Agent 220. The verification result acquisition unit 332 receives the verification result from the verification server 400. The authorization decision unit 333 makes an authorization decision based on the VC's attribute information and the verification result. At this time, in order to determine whether the verification result is trustworthy, the Verifier 300 needs to confirm that the VP has been verified by the verification server 400 and that the VP and the verification result are linked. For example, the VP and the verification result can be linked by including a VP verification identifier in the verification result and signing it with the private key of the verification server 400.

[0105] In this embodiment, the Holder 200 is provided with the Agent 220, so that the internal organization of the Holder 200 can conceal the attribute information and extract the verification information group. Also, the user can pass the verification data to the verification server 400 at his / her own discretion. With this configuration, the Holder 200 determines whether privacy protection processing is necessary and performs privacy protection, so that the leakage of attribute information can be prevented at the user's own discretion.

[0106] (III) Third embodiment The verification system utilizing the present invention in the third embodiment has almost the same configuration and operation as the verification systems utilizing the present invention in the first and second embodiments, so the following will mainly explain the differences.

[0107] In the third embodiment, similarly to the second embodiment, the Holder 200 includes the Agent 240. Since the Holder 200 includes the Agent 240, the user can pass the verification data to the verification server 400 at his / her own discretion. The main difference from the second embodiment is that the verification result is presented from the Agent 240 to the Verifier 300.

[0108] 17 is a block diagram showing an example of the software configuration of Holder 200 according to the third embodiment. Holder 200 is configured to include Holder basic function 230 and Agent 240. Holder basic function 230 includes VC issuance request unit 231, VP creation unit 232, VP presenter A 233, public key information registration unit 234, and VC storage unit 235. Agent 240 includes VP acquisition unit 241, format identification unit 242, verification information extraction unit 243, confidentiality processing unit 244, verification data presenter 245, verification result acquisition unit 246, VP presenter B 247, verification result presenter 248, and format storage unit 249.

[0109] The VC issuance request unit 231 requests the Issuer 100 to issue a VC. The VP creation unit 232 creates a VC as a VP, which includes user attribute information required for the Verifier 300 to make an authorization decision. The VP may contain a single VC or multiple VCs. The VP presentation unit A233 presents the VP created by the VP creation unit 232 to the Agent 240. The public key information registration unit 234 registers the public key corresponding to the private key of the Holder 200 in the VDR 500. The VC storage unit 235 stores and manages VCs.

[0110] The VP acquisition unit 241 acquires a VP presented from the Holder basic function 230. The format identification unit 242 identifies the format of the VP acquired by the VP acquisition unit 241 and the VC group included in the VP. The verification information extraction unit 243 extracts a verification information group from the VP and the VC group. The anonymization processing unit 244 generates a hash value that anonymizes the attribute information. The verification data presentation unit 245 passes verification data including the verification information group extracted by the verification information extraction unit 243 and the hash value generated by the anonymization processing unit 244 to the verification server 400.

[0111] The verification result acquisition unit 246 receives the verification result from the verification server 400. The VP presentation unit B 247 presents the VP acquired by the VP acquisition unit 241 to the Verifier 300. The verification result presentation unit 248 passes the verification result to the Verifier 300. The format storage unit 249 stores information on each format of the VP and VC group, and the verification portion and concealment portion corresponding to the format, in association with each other. In FIG. 17, the Agent 240 includes the format storage unit 249, but the format storage unit 249 may be provided as external storage, and the format storage unit 249 may exchange information with the Agent 240.

[0112] In the verification data presenting unit 245, the presentation is confirmed on a confirmation screen as shown in Fig. 14, as in the second embodiment. This allows the user to select the verification server 400 to present the verification data and the VP and VC group to present at their discretion. The confirmation screen may be displayed on the Wallet application downloaded to the Holder 200.

[0113] The software configuration of the verifier 300 according to the third embodiment is the same as that shown in Fig. 15, and is therefore not shown. The verifier 300 includes a VP acquisition unit 331, a verification result acquisition unit 332, an authorization decision unit 333, and a service provision unit 334.

[0114] The VP acquisition unit 331 acquires a VP presented by the Agent 240 of the Holder 200. The verification result acquisition unit 332 receives the verification result from the Agent 240. The authorization decision unit 333 makes an authorization decision based on the attribute information of the VC and the verification result. The service provision unit 334 provides a service according to the result of the authorization decision.

[0115] 18 is a sequence chart showing an example of the procedure according to the third embodiment. The sequence chart shows a series of steps in which Holder 200 creates a VP, submits verification data to the verification server 400, the verification server 400 verifies the VP, and Holder 200 passes the VP and the verification results to Verifier 300.

[0116] The Holder 200 includes a Holder basic function 230 and an Agent 240. A VP creation unit 232 of the Holder basic function 230 creates a VP from the VC requested by the Verifier 300. A VP presentation unit A 233 presents the VP created by the VP creation unit 232 to the Agent 240.

[0117] The VP acquisition unit 241 of the Agent 240 receives the VP. The format identification unit 242 divides the VP into VCs, identifies the format of the VP and the format of each of the divided VCs, and passes format data that can identify the verification location and the concealment location of each to the verification information extraction unit 243 and the concealment processing unit 244. The verification information extraction unit 243 extracts a verification information group from the VP and VCs using the format data. The concealment processing unit 244 performs concealment processing on the VP and VCs using the format data. The verification data presentation unit 245 presents verification data including the verification information group extracted by the verification information extraction unit 243 and the hash value concealed by the concealment processing unit 244 to the verification server 400. At this time, a confirmation screen such as that shown in FIG. 14 is displayed to the user, and the user selects, at his or her own discretion, the verification server 400 to which the verification data should be presented and the VP and VC group to be presented.

[0118] The verification data acquisition unit 401 of the verification server 400 receives verification data. The public key acquisition unit 402 receives the public key identifier from the verification data acquisition unit 401 and acquires the public key. For example, if a public key is stored in the VDR 500, the public key acquisition unit 402 acquires the public key of Issuer 100 from the VDR 500 using the identifier of Issuer 100, and acquires the public key of Holder 200 from the VDR 500 using the identifier of Holder 200. The revocation information acquisition unit 403 receives the revocation information identifier from the verification data acquisition unit 401 and acquires the revocation information of the VP and VC group. For example, if revocation information of a VC is stored in the VDR 500, the revocation information acquisition unit 403 acquires the revocation information of the VC from the VDR 500 using the identifier of the VC.

[0119] The signature verification unit 404 verifies the signatures of the VP and VC group using the verification data received from the verification data acquisition unit 401 and the public key received from the public key acquisition unit 402. The revocation verification unit 405 verifies the revocation of the VP and VC group based on the revocation information received from the revocation information acquisition unit 403. The validity verification unit 406 verifies the validity of the VP and VC group based on the validity information received from the verification data acquisition unit 401. The verification result presentation unit 407 receives the verification results of the VP and VC group verified by the signature verification unit 404, revocation verification unit 405, and validity verification unit 406, and presents them to Agent 240 as the verification results.

[0120] The verification result acquisition unit 246 of the Agent 240 receives the verification result from the verification server 400. The VP presentation unit B 247 passes the VP to the Verifier 300. The verification result presentation unit 248 passes the verification result to the Verifier 300. The VP and the verification result are presented in association with each other. For example, the VP and the verification result may be presented simultaneously.

[0121] In the verifier 300, the VP acquisition unit 331 receives a VP. The verification result acquisition unit 332 receives the verification result. The authorization decision unit 333 makes an authorization decision based on the attribute information of the VC and the verification result. At this time, the VP and the verification result must be linked.

[0122] In this embodiment, since Holder 200 is equipped with Agent 240, like in the second embodiment, the leakage of attribute information can be prevented at the user's own discretion. Also, since the VP and the verification result are simultaneously presented to Verifier 300, Verifier 300 can easily link the VP and the verification result. Also, like in the second embodiment, by including a VP verification identifier in the verification result and signing it with the private key of verification server 400, Verifier 300 can confirm that it has been verified by verification server 400 and that the VP and the verification result are linked.

[0123] It should be noted that the present invention is not limited to the above-described embodiment, and includes various modifications and equivalent configurations within the spirit of the appended claims. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to an embodiment including all of the described configurations.

[0124] (IV) Supplementary Note The above-described embodiment includes, for example, the following contents.

[0125] In the above embodiment, the present invention has been described as being applied to a verification system, but the present invention is not limited to this and can be widely applied to various other systems, devices, methods, and programs.

[0126] In the above embodiment, the case where verification data for a VC is generated when a VP is requested has been described, but the present invention is not limited to this. For example, when Holder 200 receives a VC from Issuer 100, Holder 200 may generate verification data for the VC.

[0127] In the above-described embodiments, some or all of the programs may be installed from a program source into a device, such as a computer, that implements the entities. The program source may be, for example, a program distribution server connected via a network or a computer-readable recording medium (e.g., a non-transitory recording medium). In the above description, two or more programs may be implemented as one program, or one program may be implemented as two or more programs.

[0128] Furthermore, in the above-described embodiment, the screens shown and described are merely examples, and any design may be used as long as the information received is the same.

[0129] Furthermore, the screens shown and described in the above-described embodiment are merely examples, and any design may be used as long as the information presented is the same.

[0130] In the above-described embodiment, the output of information is not limited to display on a display screen, but may be audio output from a speaker, output to a file, printed on paper or the like by a printer, projected onto a screen or the like by a projector, or in other forms.

[0131] In addition, in the above description, information such as programs, tables, files, etc. that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or in a recording medium such as an IC card, an SD card, or a DVD.

[0132] The above-described embodiment has the following characteristic configurations, for example.

[0133] (1) A verification system (e.g., verification system 1000) that verifies certificate information (e.g., VP, VC) including attribute information (e.g., attribute information, personal information) indicating a user's attributes and verification information (e.g., public identifier, revocation information identifier, validity information, signature) related to verification of the user's qualifications, the verification system (e.g., verification system 1000) including an identification unit (e.g., format identification unit 322, format identification unit 223, format identification unit 242) that identifies the format of the certificate information, and an extraction unit that extracts verification information from the certificate information based on the identification result (e.g., format data) by the identification unit. The certificate authentication system includes a verification unit (e.g., a verification information extraction unit 323, a verification information extraction unit 224, a verification information extraction unit 243), a concealment unit (e.g., a concealment processing unit 324, a concealment processing unit 225, a concealment processing unit 244) that conceals a predetermined portion (e.g., a concealed portion) including attribute information of the certificate information to generate concealed attribute information (e.g., a hash value), and a verification unit (e.g., a verification server 400, a signature verification unit 404, a revocation verification unit 405, a validity verification unit 406) that performs verification based on the verification information extracted by the extraction unit and the concealed attribute information generated by the concealment unit. The predetermined portion may be identified by an identification unit, may be identified by the concealment unit, or may be identified by other means.

[0134] In the above configuration, verification information extracted according to the format of the certificate information and confidential attribute information in which the attribute information is concealed, rather than the user's attribute information, are used for verification, so that, for example, it is possible to verify various formats of certificate information while protecting the user's privacy.

[0135] (2) The identification unit identifies a verification portion (e.g., a verification portion) in the certificate information that includes verification information, and identifies a concealment portion (e.g., a concealment portion) that includes attribute information of the certificate information as the predetermined portion, the extraction unit extracts the verification information from the certificate information based on the verification portion identified by the identification unit, and the concealment unit conceals the concealment portion identified by the identification unit to generate concealed attribute information (e.g., see FIG. 10). The identification unit may identify the format of the certificate information using format identification information that indicates the format of the certificate information stored in a storage unit, or may identify the format of the certificate information in accordance with processing specified in a program, or may identify the format of the certificate information by some other method.

[0136] According to the above configuration, the identification unit identifies the concealment portion and the verification portion, so that, for example, processing related to identification can be performed efficiently.

[0137] (3) The certificate authentication system includes a memory unit (e.g., a format storage unit 328, a format storage unit 227, a format storage unit 249) that stores information in which format identification information (e.g., format identification information) that can identify the format of the certificate information, verification location information (e.g., verification location information) that indicates the verification location in the certificate information where verification information is included, and concealment location information (e.g., concealment location information) that indicates the concealment location that includes attribute information of the certificate information is associated with each other, and the identification unit identifies the format of the certificate information based on the format identification information stored in the memory unit, and identifies the verification location information and concealment location information that are associated with the format identification information of the identified format (e.g., see Figure 10).

[0138] According to the above configuration, for example, the format specification information, the concealment portion information, and the verification portion information are stored in association with each other in the storage unit, so that the format of the certificate information can be easily managed.

[0139] (4) The certificate information (e.g., VC20) includes attribute information (e.g., attribute information 22B) indicating the user's attributes and verification information related to verifying the user's qualifications. The verification information includes verification information (e.g., verification information 22C) including public key identification information (e.g., public key identifier) ​​capable of identifying a public key corresponding to the private key of the issuer that issued the qualifications, revocation identification information (e.g., revocation information identifier) ​​capable of identifying whether the qualifications have been revoked, and validity identification information (e.g., validity information) capable of identifying the validity of the qualifications, and a signature (e.g., signature 23) in which information obtained by anonymizing the attribute information and the verification information is signed with the private key of the issuer. The extraction unit extracts the public key identification information, revocation identification information, validity identification information, and signature from the certificate information based on the identification result by the identification unit (e.g., see Figure 8).

[0140] According to the above configuration, for example, the verification unit can verify the certificate information using the public key identification information, the revocation identification information, the validity identification information, and the signature.

[0141] (5) The anonymizing unit anonymizes a predetermined portion including attribute information of the certificate information based on the result of identification by the identifying unit (for example, format data) to generate anonymized attribute information (for example, see FIG. 10).

[0142] According to the above configuration, the concealment unit can conceal the attribute information in accordance with the format of the certificate information.

[0143] (6) The anonymizing unit hashes a predetermined portion of the certificate information including the attribute information based on the result of identification by the identifying unit, and generates a hash value as confidential attribute information (see, for example, FIG. 10).

[0144] In the above configuration, the verification unit performs verification using a hash value, so that, for example, the attribute information is not restored in the verification unit, and the user's attribute information can be more securely protected.

[0145] (7) The certificate information includes attribute information indicating the user's attributes and verification information related to verifying the user's qualifications, and the verification information includes confidential attribute processing information (e.g., a signature) in which a predetermined process (e.g., an electronic signature) has been performed on confidential attribute information in which the portion including the attribute information has been concealed, and the verification unit performs signature verification based on the confidential attribute information generated by the concealment unit and the confidential attribute processing information included in the certificate information (see, for example, Figure 11).

[0146] According to the above configuration, for example, it is possible to perform signature verification while keeping user attribute information secret.

[0147] (8) The certificate information includes attribute information indicating the user's attributes and verification information related to verifying the user's qualifications, and the verification information includes revocation identification information (e.g., a revocation information identifier) ​​that can identify whether the qualifications have expired. The extraction unit extracts the revocation identification information included in the verification information of the certificate information, and the verification unit performs revocation verification based on the revocation identification information extracted by the extraction unit (see, for example, Figure 11).

[0148] According to the above configuration, for example, revocation verification can be performed while keeping user attribute information secret.

[0149] (9) The certificate information includes attribute information indicating the user's attributes and verification information related to the verification of the user's qualifications, and the verification information includes validity identification information (e.g., validity information) that can identify the validity of the qualifications. The extraction unit extracts the validity identification information included in the verification information of the certificate information, and the verification unit performs validity verification based on the validity identification information extracted by the extraction unit.

[0150] According to the above configuration, for example, validity verification can be performed while keeping user attribute information confidential.

[0151] (10) An issuing device (e.g., Issuer 100) that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications, a holding device (e.g., Holder 200) that holds the certificate information, a verification device (e.g., verification server 400) that verifies the certificate information, and a processing device (e.g., Verifier 300) that performs processing related to the user based on the certificate information and the verification result of the verification device are communicably connected, and the processing device has the identification unit, the extraction unit, the concealment unit, and the verification information extracted by the extraction unit. and a first transmitting unit (e.g., verification data presenting unit 325) that transmits the verification information and the secret attribute information generated by the concealment unit to the verification device, the verification device comprises a first receiving unit (e.g., verification data acquiring unit 401) that receives the verification information and the secret attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit (e.g., verification result presenting unit 407) that transmits the verification result by the verification unit to the processing device, and the processing device comprises a second receiving unit (e.g., verification result acquiring unit 326) that receives the verification result transmitted by the second transmitting unit.

[0152] In the above configuration, verification information extracted according to the format of the certificate information and confidential attribute information in which the user's attribute information is concealed are transmitted to the verification device, so that the verification device can verify the certificate information while protecting the user's privacy, for example.

[0153] (11) An issuing device (e.g., Issuer 100) that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications, a holding device (e.g., Holder 200) that holds the certificate information, a verification device (e.g., verification server 400) that verifies the certificate information, and a processing device (e.g., Verifier 300) that performs processing related to the user based on the certificate information and the verification result of the verification device are communicably connected, and the holding device receives instructions from the user regarding whether or not to transmit the verification information extracted by the extraction unit and the confidential attribute information generated by the confidential unit to the verification device. and a first transmitting unit (e.g., verification data presenting unit 226) that transmits the verification information and the secret attribute information to the verification device in response to an instruction received by the receiving unit, the verification device comprising a first receiving unit (e.g., verification data acquisition unit 401) that receives the verification information and the secret attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit (e.g., verification result presenting unit 407) that transmits the verification result by the verification unit to the processing device, and the processing device comprising a second receiving unit (e.g., verification result acquisition unit 332) that receives the verification result transmitted by the second transmitting unit.

[0154] In the above configuration, the storage device can conceal the attribute information and extract the verification information. Furthermore, the user can pass the confidential attribute information and the verification information to the verification device at their own discretion. According to the above configuration, the storage device conceals the attribute information and transmits the confidential attribute information and the verification information based on the user's instructions, thereby preventing information leakage unintended by the user.

[0155] (12) An issuing device (e.g., Issuer 100) that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications, a holding device (e.g., Holder 200) that holds the certificate information, a verification device (e.g., verification server 400) that verifies the certificate information, and a processing device (e.g., Verifier 300) that performs processing related to the user based on the certificate information and the verification result of the verification device are communicably connected, and the holding device includes the identifying unit, the extracting unit, the concealing unit, and a receiving unit (e.g., verification data presenting unit 245) that receives from a user an instruction as to whether or not to transmit the verification information extracted by the extracting unit and the concealed attribute information generated by the concealing unit to the verification device, and a processing device (e.g., Verifier 300) that transmits the verification information and the concealed attribute information to the verification device in response to the instruction received by the receiving unit. The verification device comprises a first transmitting unit (e.g., verification data presenting unit 245) that transmits the verification information and confidential attribute information to the verification device, and the verification device comprises a first receiving unit (e.g., verification data acquisition unit 401) that receives the verification information and confidential attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit (e.g., verification result presenting unit 407) that transmits the verification result by the verification unit to the holding device, the holding device comprises a second receiving unit (e.g., verification result acquisition unit 246) that receives the verification result transmitted by the second transmitting unit, and a third transmitting unit (e.g., VP presenting unit B247 and verification result presenting unit 248) that links the certificate information and the verification result and transmits them to the processing device, and the processing device comprises a third receiving unit (e.g., VP acquisition unit 331 and verification result acquisition unit 332) that receives the certificate information and verification result transmitted by the third transmitting unit.

[0156] In the above configuration, the certificate information and the verification result are linked and transmitted from the storage device to the processing device, which reduces the burden on the processing device that links the certificate information and the verification result, and prevents information from leaking unintended by the user.

[0157] Furthermore, the above-described configurations may be modified, rearranged, combined, or omitted as appropriate within the scope of the present invention.

[0158] It should be understood that items included in a list in the format "at least one of A, B, and C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). Similarly, items listed in the format "at least one of A, B, or C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). [Explanation of symbols]

[0159] 100...Issuer, 200...Holder, 300...Verifier, 400...Verification server, 1000...Verification system.

Claims

1. A verification system for verifying certificate information including attribute information indicating a user's attribute and verification information related to verification of the user's qualification, comprising: an identification unit that identifies a format of the certificate information; an extraction unit that extracts verification information from the certificate information based on the result of identification by the identification unit; a concealment unit that conceals a predetermined portion of the certificate information including attribute information to generate concealed attribute information; a verification unit that performs verification based on the verification information extracted by the extraction unit and the concealed attribute information generated by the concealment unit; A verification system comprising:

2. the identification unit identifies a verification portion in the certificate information that includes verification information, and identifies a concealment portion that includes attribute information of the certificate information as the predetermined portion; the extraction unit extracts verification information from the certificate information based on the verification location identified by the identification unit; the concealment unit conceals the concealed part identified by the identification unit to generate concealed attribute information. The verification system of claim 1 .

3. a storage unit that stores information in which format identification information that can identify a format of the certificate information, verification portion information that indicates a verification portion in the certificate information that includes verification information, and concealment portion information that indicates a concealment portion that includes attribute information of the certificate information are associated with each other; the identification unit identifies a format of the certificate information based on format identification information stored in the storage unit, and identifies verification part information and concealment part information associated with the format identification information of the identified format. The verification system of claim 2 .

4. the certificate information includes attribute information indicating user attributes and verification information related to verification of the user's qualifications; The verification information includes: Verification information including public key identification information capable of identifying a public key corresponding to the private key of an issuer that issued the qualification, revocation identification information capable of identifying whether the qualification has been revoked, and validity identification information capable of identifying the validity of the qualification; a signature obtained by signing the attribute information and the verification information with a private key of the issuer, the extraction unit extracts public key identification information, revocation identification information, validity identification information, and a signature from the certificate information based on the identification result by the identification unit; The verification system of claim 1 .

5. the concealment unit conceals a predetermined portion including attribute information of the certificate information based on the result of identification by the identification unit, and generates concealed attribute information. The verification system of claim 1 .

6. the concealment unit hashes a predetermined portion of the certificate information including attribute information based on the result of the identification by the identification unit, and generates a hash value as concealed attribute information. The verification system of claim 5 .

7. the certificate information includes attribute information indicating user attributes and verification information related to verification of the user's qualifications; the verification information includes secret attribute processed information obtained by performing a predetermined process on secret attribute information in which a portion including the attribute information has been concealed; the verification unit performs signature verification based on the confidential attribute information generated by the confidentiality unit and confidential attribute processing information included in the certificate information. The verification system of claim 1 .

8. the certificate information includes attribute information indicating user attributes and verification information related to verification of the user's qualifications; The verification information includes revocation identification information that can identify whether the qualification has expired, the extraction unit extracts revocation identification information included in the verification information of the certificate information, the verification unit performs revocation verification based on the revocation identification information extracted by the extraction unit. The verification system of claim 1 .

9. the certificate information includes attribute information indicating user attributes and verification information related to verification of the user's qualifications; The verification information includes validity specification information capable of specifying the validity of the qualification, the extraction unit extracts validity specification information included in the verification information of the certificate information, the verification unit performs validity verification based on the validity specification information extracted by the extraction unit. The verification system of claim 1 .

10. an issuing device that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications; a holding device that holds the certificate information; a verification device that verifies the certificate information; and a processing device that performs processing related to the user based on the certificate information and the verification result of the verification device, all of which are communicably connected; the processing device includes the identification unit, the extraction unit, the concealment unit, and a first transmission unit that transmits the verification information extracted by the extraction unit and the concealment attribute information generated by the concealment unit to the verification device; the verification device includes a first receiving unit that receives the verification information and the secret attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit that transmits a verification result by the verification unit to the processing device; the processing device includes a second receiving unit that receives the verification result transmitted by the second transmitting unit; The verification system of claim 1 .

11. an issuing device that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications; a holding device that holds the certificate information; a verification device that verifies the certificate information; and a processing device that performs processing related to the user based on the certificate information and the verification result of the verification device, all of which are communicably connected; the holding device comprises the identifying unit, the extracting unit, the concealing unit, a receiving unit that receives from a user an instruction as to whether or not to transmit the verification information extracted by the extracting unit and the concealed attribute information generated by the concealing unit to the verification device, and a first transmitting unit that transmits the verification information and the concealed attribute information to the verification device in response to the instruction being received by the receiving unit; the verification device includes a first receiving unit that receives the verification information and the secret attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit that transmits a verification result by the verification unit to the processing device; the processing device includes a second receiving unit that receives the verification result transmitted by the second transmitting unit; The verification system of claim 1 .

12. an issuing device that issues certificate information including attribute information indicating a user's attributes and verification information related to verification of the user's qualifications; a holding device that holds the certificate information; a verification device that verifies the certificate information; and a processing device that performs processing related to the user based on the certificate information and the verification result of the verification device, all of which are communicably connected; the holding device comprises the identifying unit, the extracting unit, the concealing unit, a receiving unit that receives from a user an instruction as to whether or not to transmit the verification information extracted by the extracting unit and the concealed attribute information generated by the concealing unit to the verification device, and a first transmitting unit that transmits the verification information and the concealed attribute information to the verification device in response to the instruction being received by the receiving unit; the verification device includes a first receiving unit that receives the verification information and the secret attribute information transmitted by the first transmitting unit, the verification unit, and a second transmitting unit that transmits a verification result by the verification unit to the holding device; the holding device includes a second receiving unit that receives the verification result transmitted by the second transmitting unit, and a third transmitting unit that associates the certificate information with the verification result and transmits them to the processing device; the processing device includes a third receiving unit that receives the certificate information and the verification result transmitted by the third transmitting unit; The verification system of claim 1 .

13. A verification method for verifying certificate information including attribute information indicating a user's attribute and verification information related to verification of the user's qualification, comprising: an identifying unit identifying a format of the certificate information; an extracting unit extracting verification information from the certificate information based on the identification result by the identifying unit; a concealment unit concealing a predetermined portion including attribute information of the certificate information to generate concealed attribute information; a verification unit performing verification based on the verification information extracted by the extraction unit and the concealed attribute information generated by the concealment unit; Verification methods including:

Images