Secret key recovery system, secret key recovery method, and program

Abstract

To improve the convenience of a user who uses a service using a secret key.SOLUTION: A first restoration key acquisition unit (302) of a secret key restoration system (1) acquires a first restoration key managed in a first service in which a first secret key stored in a user terminal of a user is used. A second restoration key acquisition unit (303) acquires a second restoration key managed in a second service different from the first service. The secret key restoring unit (304) restores the first secret key based on the first restored key and the second restored key.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present disclosure relates to a private key recovery system, a private key recovery method, and a program. [Background technology]

[0002] Conventionally, services that use private keys stored in user terminals have been known. For example, Patent Document 1 describes a cryptocurrency service in which, when a user remits cryptocurrency from a specified account address, the remittance of the cryptocurrency is signed with a first private key associated with the specified account address, and the remittance of the cryptocurrency is further signed with a second private key associated with the specified account address. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-177377 Summary of the Invention [Problem to be solved by the invention]

[0004] However, Patent Document 1 does not describe the process to be followed if a user loses their private key. For example, if a user needs to contact a call center of a crypto asset service to restore a lost private key, this will be a hassle for the user, reducing user convenience. This point is not limited to crypto asset services. The same applies to other services that use private keys stored in user terminals. Conventional technologies have not been able to sufficiently improve user convenience.

[0005] One of the purposes of the present disclosure is to improve user convenience. [Means for solving the problem]

[0006] The private key recovery system according to the present disclosure includes a first recovery key acquisition unit that acquires a first recovery key managed by a first service that uses a first private key stored in a user's user terminal, a second recovery key acquisition unit that acquires a second recovery key managed by a second service that is different from the first service, and a private key recovery unit that recovers the first private key based on the first recovery key and the second recovery key. [Effects of the Invention]

[0007] The present disclosure can improve convenience for users. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a hardware configuration of a private key recovery system. [Figure 2] FIG. 10 is a diagram showing an example of a screen displayed when registering for use of the first service. [Figure 3] FIG. 2 is a diagram showing an example of a signature using a first private key and a second private key. [Figure 4] FIG. 10 is a diagram showing an example of a flow when a first secret key is restored. [Figure 5] FIG. 10 is a diagram showing an example of a screen displayed when restoring a first secret key. [Figure 6] FIG. 1 is a diagram illustrating an example of functions realized in a private key recovery system. [Figure 7] FIG. 3 is a diagram illustrating an example of a first database. [Figure 8] FIG. 10 is a diagram illustrating an example of a second database. [Figure 9] FIG. 10 is a diagram illustrating an example of a usage process executed in the private key recovery system. [Figure 10] FIG. 10 is a diagram illustrating an example of a usage process executed in the private key recovery system. [Figure 11] FIG. 10 is a diagram illustrating an example of a function realized in a modified example. [Figure 12] FIG. 10 is a diagram showing an example of a screen displayed on a user terminal according to the first modification. [Figure 13]FIG. 11 is a diagram showing an example of a screen displayed on a user terminal in Modification 3. DETAILED DESCRIPTION OF THE INVENTION

[0009] [1. Hardware configuration of the private key recovery system] An example of an embodiment of a private key recovery system, a private key recovery method, and a program according to the present disclosure will be described.

[0010] Fig. 1 is a diagram showing an example of the hardware configuration of a private key recovery system. For example, the private key recovery system 1 includes a first server 10, a second server 20, and a user terminal 30. Each of the first server 10, the second server 20, and the user terminal 30 is connected to a network N such as the Internet or a LAN. Although Fig. 1 shows one each of the first server 10, the second server 20, and the user terminal 30, there may be multiple of at least one of the first server 10, the second server 20, and the user terminal 30.

[0011] The first server 10 is a server computer for the first service. In this embodiment, the first service corresponds to a crypto asset service that accepts crypto asset transactions by users. The first service may be any service that is used by users. The first service is not limited to a crypto asset service. For example, the first service may be a financial service other than a crypto asset service (e.g., a financial service provided by a bank or securities company), an e-commerce service, a travel reservation service, a communication service, an online flea market service, or another service.

[0012] For example, the first server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of a volatile memory such as a RAM and a non-volatile memory such as a flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0013] The second server 20 is a server computer for the second service. In this embodiment, a cloud service that manages user data on the cloud (for example, a backup service that backs up data in storage other than the user terminal 30) corresponds to the second service as an example. The second service may be any service different from the first service. The second service is not limited to a cloud service. For example, the second service may be an email service, a search service, a video distribution service, an SNS, a news distribution service, or other services. In this embodiment, a case where the operator of the first service and the operator of the second service are different from each other is exemplified, but the operator of the first service and the operator of the second service may be the same.

[0014] For example, the second server 20 includes a control unit 21, a storage unit 22, and a communication unit 23. The hardware configurations of the control unit 21, the storage unit 22, and the communication unit 23 may be similar to those of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

[0015] The user terminal 30 is a user's computer. For example, the user terminal 30 is a smartphone, a tablet, a personal computer, or a wearable terminal. The user terminal 30 includes a control unit 31, a memory unit 32, a communication unit 33, an operation unit 34, and a display unit 35. The hardware configurations of the control unit 31, the memory unit 32, and the communication unit 33 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. The operation unit 34 is an input device such as a touch panel or a mouse. The display unit 35 is a display such as a liquid crystal or organic EL display.

[0016] The programs stored in the storage units 12, 22, 32 may be supplied to the first server 10, the second server 20, or the user terminal 30 via the network N. Also, at least one of a reading unit (e.g., a memory card slot) that reads a computer-readable information storage medium and an input / output unit (e.g., a USB port) for inputting and outputting data to and from an external device may be included in the first server 10, the second server 20, or the user terminal 30. For example, a program stored in an information storage medium may be supplied to the first server 10, the second server 20, or the user terminal 30 via at least one of the reading unit and the input / output unit.

[0017] Furthermore, the private key recovery system 1 only needs to include at least one computer. The computers included in the private key recovery system 1 are not limited to the example of FIG. 1. For example, the private key recovery system 1 may include only the first server 10 and the user terminal 30. In this case, the second server 20 exists outside the private key recovery system 1. The private key recovery system 1 may also include only the first server 10. In this case, the second server 20 and the user terminal 30 exist outside the private key recovery system 1. The private key recovery system 1 may also include only the user terminal 30. In this case, the first server 10 and the second server 20 exist outside the private key recovery system 1. For example, the private key recovery system 1 may include other computers not shown in FIG. 1.

[0018] [2. Overview of the private key recovery system] In this embodiment, a user operates the user terminal 30 to use the first service. For example, a first app, which is an application for the first service, is installed on the user terminal 30. The first app may be an app developed to utilize a blockchain technology called Web3. The user uses the first service from the first app. If the user has not yet registered to use the first service, the user registers to use the first service from the first app. Note that the user may also register to use the first service from a browser instead of the first app. The user may also use the first service from a browser.

[0019] Fig. 2 is a diagram showing an example of a screen displayed when registering for use of the first service. For example, when a user launches the first application, the user terminal 30 displays a usage registration screen SC1, which accepts the procedure for registering for use of the first service, on the display unit 35, as shown in the upper left of Fig. 2. The usage registration screen SC1 includes a button B10 that allows a user who has not yet registered for use of the first service to register for use of the first service, and a button B11 that allows a user who has registered for use of the first service to restore a first secret key, which will be described later.

[0020] For example, when the user selects button B10, the procedure for registering to use the first service begins. The flow of registration to use the first service may be the same as the flow for a known first service. In this embodiment, when registering to use the first service, email address authentication to confirm the validity of the email address and phone number authentication to confirm the validity of the phone number are performed. When these authentications are completed, the user terminal 30 displays an authentication completion screen SC2 on the display unit 35, as shown in the upper right corner of FIG. 2, indicating that these authentications have been completed.

[0021] For example, the authentication completion screen SC2 includes a button B20 for the user to create a wallet. A wallet is a tool for managing crypto assets. A wallet may be physical hardware, or may be data such as a program or a database. A first app or other data stored in the user terminal 30 may correspond to a wallet, or data stored in the first server 10 may correspond to a wallet. The meaning of a wallet may be the same as that in a known first service.

[0022] In this embodiment, before creating a wallet and using the first app, the user needs to generate a backup file that is a backup of the data used in the first service. An example of the specific contents of the backup file will be described later. For example, the backup file is not stored in the first server 10 or the user terminal 30, but is stored in the second server 20. When the user selects button B20, as shown in the lower left of FIG. 2, the user terminal 30 displays a generation screen SC3 for generating a backup file on the display unit 35.

[0023] For example, the generation screen SC3 includes a button B30 for the user to permit access to the second service. When the user selects the button B30, the user selects or inputs a second user account, which is the user's account in the second service. The second server 20 performs a second authentication to confirm the authenticity of the second user account. Once the authenticity of the second user account is confirmed, the second server 20 cooperates with the first server 10 and the user terminal 30 to store a backup file in a storage area associated with the second user account.

[0024] For example, when the saving of the backup file is completed, the user terminal 30 displays a backup completion screen SC4 indicating that the saving of the backup file is completed on the display unit 35, as shown in the lower right of FIG. 2. When the saving of the backup file is completed, the registration for use of the first service is completed. The user can now send and receive the cryptocurrency they own by operating the first app.

[0025] In this embodiment, a first private key and a second private key required for transactions in the first service are generated during registration for use of the first service. The user terminal 30 stores the first private key. The first server 10 and the second server 20 do not store the first private key. The first server 10 stores the second private key. The second server 20 and the user terminal 30 do not store the second private key. The first private key and the second private key are managed in a distributed manner by the user terminal 30 and the first server 10. For example, when a user trades crypto assets from the first application, transaction information related to the user's transaction is signed with the first private key and the second private key.

[0026] FIG. 3 is a diagram showing an example of a signature using the first private key and the second private key. As shown in FIG. 3, when a user trades crypto assets from the first application, the user terminal 30 signs part of the transaction information with the first private key. In the example of FIG. 3, the signed part of the transaction information is indicated by a dotted line. The user terminal 30 transmits the transaction information, part of which is signed with the first private key, to the first server 10. The first server 10 signs, with the second private key, the part of the transaction information received from the user terminal 30 that has not been signed with the first private key.

[0027] For example, the first server 10 transmits transaction information signed with the first private key and the second private key to the blockchain network (part of network N). The flow of processing the transaction information transmitted to the blockchain network may be the same as that of the publicly known first service. For example, after the validity of the signature of the transaction information is verified, the transaction specified by the user is carried out. Thus, in this embodiment, an example is given in which the user terminal 30 needs to store the first private key in order for the user to carry out a transaction from the first application.

[0028] For example, the user may lose the first private key due to some factor. If the user changes the model of the user terminal 30, the first private key is not stored in the new user terminal 30, and the user may lose the first private key. If the user deletes the first application, the user may lose the first private key. If a failure occurs in the storage unit 32, the user may lose the first private key. If the user loses the first private key, the user will not be able to conduct transactions from the first application. Therefore, in this embodiment, the user is able to restore the first private key from the first application.

[0029] FIG. 4 is a diagram showing an example of the flow when restoring a first private key. As shown in FIG. 4, when registering for use of the first service, a first recovery key and a second recovery key used to restore the first private key are generated. The first server 10 stores the first recovery key. The second server 20 and the user terminal 30 do not store the first recovery key. The second server 20 stores the second recovery key. The first server 10 and the user terminal 30 do not store the second recovery key. The backup file mentioned above includes the second recovery key. The user terminal 30 obtains the first recovery key from the first server 10 and obtains the second recovery key from the second server 20. The user terminal 30 restores the first private key based on the first recovery key and the second recovery key.

[0030] FIG. 5 is a diagram showing an example of a screen displayed when restoring a first private key. For example, if a user loses the first private key, the user terminal 30 causes the display unit 35 to display the usage registration screen SC1 shown in the upper left of FIG. 2. When the user selects button B11, the user terminal 30 causes the display unit 35 to display a first authentication screen SC5 for the first authentication, which is authentication for the first service, as shown in the upper left of FIG. 5. The first authentication is authentication for confirming the legitimacy of the first user account, which is the user's account for the first service. The first authentication screen SC5 includes an input form F50 for receiving input of the first user account.

[0031] For example, when a user enters a first user account in the input form F50 and selects the button B51, the first server 10 executes the first authentication. In the first authentication, the user may be requested to enter a first password, which is a password corresponding to the first user account. The first authentication may be multi-factor authentication that combines multiple authentications. For example, the first authentication may combine authentication that confirms the legitimacy of the first user account with biometric authentication performed using the user terminal 30.

[0032] For example, when the first authentication is completed, the user terminal 30 obtains the first recovery key from the first server 10. As shown in the upper right of Fig. 5, the user terminal 30 displays a second user account selection screen SC6 on the display unit 35, which allows the user to select a second user account. In the example shown in the upper right of Fig. 5, only one panel P60 indicating the second user account is displayed, but as in a modified example described below, if the user has multiple second user accounts, multiple panels P60 may be displayed.

[0033] For example, when the user selects panel P60, the user terminal 30 causes the display unit 35 to display a private key restoration screen SC7 for restoring the first private key, as shown in the lower left of FIG. 5. The private key restoration screen SC7 includes a button B70 for the user to restore the first private key and a button B71 for the user to cancel the restoration of the first private key. In the example in the lower left of FIG. 5, a backup file has been saved in the storage area associated with the second user account selected by the user, so the user can restore the first private key. If a backup file has not been saved, an error message is displayed on the private key restoration screen SC7.

[0034] For example, when the user selects button B70, the user terminal 30 obtains the second recovery key contained in the backup file from the second server 20. The user terminal 30 recovers the first private key based on the first recovery key and the second recovery key. Once the first private key is recovered, the user will be able to use the first service again. As shown in the lower right of Figure 5, the user terminal 30 displays a first service screen SC8 on the display unit 35, which shows the crypto assets held by the user, based on the first private key.

[0035] As described above, in the private key recovery system 1, if a user loses the first private key, the user can recover the first private key from the first application. This allows the private key recovery system 1 to improve user convenience. Furthermore, by distributing and managing the information necessary to recover the first private key between the first service and the second service, a malicious third party would need to break through the security of each of the first service and the second service in order to fraudulently recover the first private key. Therefore, the private key recovery system 1 can also improve security in the recovery of the first private key. Details of the private key recovery system 1 will be described below.

[0036] [3. Functions realized by the private key recovery system] FIG. 6 is a diagram showing an example of functions realized by the private key recovery system 1. As shown in FIG.

[0037] [3-1. Functions realized by the first server] For example, the first server 10 includes a data storage unit 100, a second processing unit 101, and a first service providing unit 102. The data storage unit 100 is realized by a storage unit 12. The second processing unit 101 and the first service providing unit 102 are each realized by a control unit 11.

[0038] [Data storage section] The data storage unit 100 stores various data for the first service. For example, the data storage unit 100 stores a first database DB1.

[0039] 7 is a diagram showing an example of the first database DB1. The first database DB1 is a database that stores various information related to users who use the first service. For example, the first database DB1 stores a first user account, a first password, a second private key, a first recovery key, and wallet information. The first database DB1 may also store other information. For example, the first database DB1 may store a UUID (Universally Unique IDentifier), which will be described in a modified example below.

[0040] The first user account is information that can identify a user in the first service. The first user account may be used to log in to the first service, or a login account may exist separately from the first user account. The first password is information that is confirmed when logging in to the first service. If authentication other than authentication using the first user account and the first password is performed in the first service, authentication information for the other authentication may be stored in the first database DB1.

[0041] The second private key is a private key that is referenced when the first service is used. The second private key is managed by the first service. In this embodiment, an example is given in which the second private key is managed by the first service by storing the second private key in the first database DB1, but the second private key may also be managed in a database other than the first database DB1, a computer other than the first server 10, or an information storage medium. The other database, computer, or information storage medium is assumed to be under the management of the operator of the first service.

[0042] For example, the second private key may be letters, numbers, symbols, or a combination thereof. The second private key may be the same as a publicly known key. The algorithm for generating the second private key may also be the same as a publicly known key generation algorithm. In this embodiment, an example is given in which the second private key is generated using MPC (Multi Party Computation) technology. For example, the second private key may be generated using the MPC technology of Block Daemon (registered trademark). The MPC technology used in this embodiment is a mechanism in which the user and the operator of the first service each hold a separate private key. This significantly reduces the risk of losing the user's private key and contributes to preventing token (cryptocurrency) theft.

[0043] The first recovery key is a recovery key used to recover the first private key. The first recovery key is managed by the first service. In this embodiment, an example is given in which the first recovery key is managed by the first service by storing the first recovery key in the first database DB1, but the first recovery key may also be managed in a database other than the first database DB1, a computer other than the first server 10, or an information storage medium. The other database, computer, or information storage medium is assumed to be under the management of the operator of the first service.

[0044] For example, the first recovery key may be letters, numbers, symbols, or a combination thereof. The first recovery key may be the same as a publicly known key. The generation algorithm of the first recovery key may also be the same as a publicly known key generation algorithm. In this embodiment, a case where the first recovery key is generated by MPC technology, like the second private key, is taken as an example. For example, the first recovery key may be generated by MPC technology from Block Daemon (registered trademark).

[0045] Wallet information is information related to a user's wallet. For example, wallet information may be information that can identify a user's wallet (e.g., information about an account that manages crypto assets), information about crypto assets managed in the wallet, a user's transaction history, or other information. The first server 10 may require a user to possess a first private key in order to access their own wallet information.

[0046] The data stored in the data storage unit 100 is not limited to the above example. The data storage unit 100 may store data related to the first service. For example, the data storage unit 100 may store data necessary for displaying various screens on the first application. The data storage unit 100 may store programs for generating each of the first secret key, the second secret key, the first recovery key, and the second recovery key.

[0047] For example, when a user registers to use the first service, the first server 10 executes a program for generating a first private key and a second private key, thereby generating the first private key and the second private key. In this embodiment, an example is given in which the first server 10 generates a private key that is the basis of the first private key and the second private key, and then divides the original private key into the first private key and the second private key to generate the first private key and the second private key. This series of steps may be similar to the steps adopted in known MPC technology. The first server 10 transmits the first private key to the user terminal 30. The first server 10 stores the second private key in association with the user's first user account.

[0048] The first server 10 may generate the first private key and the second private key separately, rather than dividing the private key that is the basis for the first private key and the second private key. That is, the first server 10 may execute a program for generating the first private key and generate the first private key without generating the original private key. The first server 10 may execute a program for generating the second private key and generate the second private key without generating the original private key. The first server 10 may generate the first private key and the second private key based on a method other than MPC technology (for example, a method for generating random symbol strings, or a public key cryptography method that does not use MPC technology).

[0049] For example, when a user registers to use the first service, the first server 10 executes a program for generating a first recovery key and a second recovery key, thereby generating the first recovery key and the second recovery key. In this embodiment, an example is given in which the first server 10 generates the first recovery key and the second recovery key by dividing a first private key into the first recovery key and the second recovery key. This series of steps may be similar to the steps adopted in known MPC technology. The first server 10 stores the first recovery key in association with the user's first user account. The first server 10 transmits the second recovery key to the second server 20. The first server 10 may transmit the second recovery key to the second server 20 indirectly via the user terminal 30.

[0050] The first server 10 may separately generate the first recovery key and the second recovery key instead of dividing the first secret key that is the basis of the first recovery key and the second recovery key. That is, the first server 10 may execute a program for generating the first recovery key and generate the first recovery key without dividing the first secret key. The first server 10 may execute a program for generating the second recovery key and generate the second recovery key without dividing the first secret key. The first server 10 may generate the first recovery key and the second recovery key based on a method other than MPC technology (e.g., a method for generating a random symbol string or a public key cryptography method that does not use MPC technology). For example, the first server 10 may use a part of the first secret key as the first recovery key and the remaining part of the first secret key as the second recovery key. The first server 10 may generate the first recovery key and the second recovery key such that the first secret key is divided into the first recovery key and the second recovery key when the first secret key is substituted into a predetermined formula.

[0051] In the present embodiment, an example is given in which the first server 10 generates the first secret key, the second secret key, the first recovery key, and the second recovery key. However, a computer other than the first server 10 may generate at least one of the first secret key, the second secret key, the first recovery key, and the second recovery key. For example, in MPC technology, keys may be generated by a trusted third party's computer, so the first secret key, the second secret key, the first recovery key, and the second recovery key may be generated by a third party's computer. For example, the first server 10 may obtain the second secret key and the first recovery key generated by another computer. The user terminal 30 may obtain the first secret key generated by another computer. The second server 20 may obtain the second recovery key generated by another computer.

[0052] For example, at least two of the first server 10, the second server 20, and the user terminal 30 may cooperate with each other using a distributed protocol method to generate the first private key, the second private key, the first recovery key, and the second recovery key. The distributed protocol method may be a known method, such as Shamir's secret sharing method or a method called DKG (Distributed Key Generation). The method by which the first private key, the second private key, the first recovery key, and the second recovery key are shared may also be similar to the known distributed protocol method.

[0053] [Second processing section] The second processing unit 101 processes a second portion of the transmission information, which is different from the first portion, based on a second private key managed by the first service. The second private key managed by the first service is a second private key stored in a computer or information storage medium managed by the operator of the first service. In this embodiment, an example is given in which the second private key stored in the first database DB1 corresponds to the second private key managed by the first service. The second private key may be stored in a database other than the first database DB1, a computer other than the first server 10, or an information storage medium.

[0054] The transmitted information is information transmitted to the network N when a user uses the first service. In this embodiment, an example is taken of a case where a user trades crypto assets using the first service, so crypto asset transaction information corresponds to the transmitted information. The transmitted information is not limited to crypto asset transaction information. The transmitted information may be other information other than crypto asset transaction information. For example, the transmitted information may be transaction information of financial assets other than crypto assets (e.g., stocks or real estate), other trading objects other than financial assets (e.g., non-fungible tokens such as art), the user's personal information, confidential information that does not fall under personal information, or other information.

[0055] The first part is a part of the transmission information that is to be processed by the first processing unit 301, which will be described later. It is assumed that which part of the transmission information becomes the first part is predetermined. For example, if the data length of the transmission information is predetermined, the part from the beginning to a predetermined number of bits may be the first part. The first part is not limited to the beginning part of the transmission information, but may also be an intermediate part or an end part. The transmission information may consist of only the first part and the second part, or may include parts other than the first part and the second part. In other words, the transmission information may include a part that is not the subject of a signature.

[0056] The second part is a part of the transmission information that is to be processed by the second processing unit 101. The second part is a part different from the first part. It is assumed that which part of the transmission information becomes the second part is predetermined. The second part may be all of the transmission information remaining other than the first part, or it may be a part of the remaining part. For example, if the data length of the transmission information is predetermined, the second part may be the part from the bit next to the last bit of the first part to the last or a predetermined bit. The second part is not limited to the last part of the transmission information, but may be the beginning or middle part.

[0057] For example, when the first server 10 receives transmission information from a user terminal 30 of a certain user, the second processing unit 101 obtains, from the first database DB1, a second private key associated with the first user account of the user. The first server 10 may obtain the first user account from the user terminal 30, or may obtain information with which the first user account can be searched (for example, a session ID with which a session between the first server 10 and the user terminal 30 can be identified, or a UUID, which will be described later). The second processing unit 101 may obtain the second private key from a database other than the first database DB1, a computer other than the first server 10, or an information storage medium.

[0058] For example, the second processing unit 101 processes the second part by signing the second part based on the second private key. The second processing unit 101 may sign the second part based on the second private key and a predetermined signature algorithm. The signature algorithm may be a known algorithm. For example, the signature algorithm may be a library provided in a programming language such as Python (e.g., a Python cryptography library), or may be an algorithm that is not particularly related to a programming language library (e.g., Rivest-Shamir-Adleman (RSA) or Digital Signature Algorithm (DSA)).

[0059] The processing performed by the second processing unit 101 may be any processing that uses the second private key. The processing performed by the second processing unit 101 is not limited to signing the second part. For example, the second processing unit 101 may process the second part by encrypting the second part based on the second private key and an encryption algorithm. The second processing unit 101 may process the second part by decrypting the second part based on the second private key and a decryption algorithm. The second processing unit 101 may process the second part by issuing a digital certificate corresponding to the second part based on the second private key.

[0060] [Service Department 1] The first service providing unit 102 provides the first service to the user. Providing the first service to the user means executing information processing for the user to use the first service. For example, the first service providing unit 102 provides the first service to the user by displaying various screens of the first service (for example, the screens described in FIGS. 2 and 5) on the user terminal 30. The first service providing unit 102 provides the first service to the user by updating the first database DB1 based on data received from the user terminal 30.

[0061] In this embodiment, the first service providing unit 102 provides the first service to the user based on the transmission information whose first and second parts have been processed. For example, the first service providing unit 102 provides the first service to the user by transmitting the transmission information whose first and second parts have been processed to the network N. The first service providing unit 102 may provide the first service to the user by using the transmission information whose first and second parts have been processed in internal information processing instead of transmitting it to the network N.

[0062] In this embodiment, the first service is exemplified as a service in which a user conducts transactions related to financial assets. Furthermore, transaction information will be described as an example of transmitted information. For this reason, the first service providing unit 102 provides the first service to the user by transmitting to the blockchain network transaction information related to the transaction, which is processed with at least a first private key (in this embodiment, the first private key and the second private key). The method by which the first service providing unit 102 transmits the signed transaction information to the blockchain network may be similar to the method used in known crypto asset services.

[0063] [3-2. Functions realized by the second server] For example, the second server 20 includes a data storage unit 200 and a second service providing unit 201. The data storage unit 200 is realized by the storage unit 22. The second service providing unit 201 is realized by the control unit 21.

[0064] [Data storage section] The data storage unit 200 stores various data for the second service. For example, the data storage unit 200 stores a second database DB2.

[0065] 8 is a diagram showing an example of the second database DB2. The second database DB2 is a database that stores various information related to users who use the second service. For example, the second database DB2 stores a backup file including a second user account, a second password, and a second recovery key. The second database DB2 may also store other information. For example, the second database DB2 may store various files such as document files or image files uploaded from the user terminal 30 to the second service (for example, files uploaded for backup purposes).

[0066] The second user account is information that can identify a user in the second service. The second user account may be used to log in to the second service, or a login account may exist separately from the second user account. In this embodiment, an example is given in which the first user account and the second user account are different from each other, but the first user account and the second user account may be the same. In other words, a common user account may be used for the first service and the second service.

[0067] The second password is information that is confirmed when logging in to the second service. If authentication other than authentication using the second user account and the second password is performed in the second service, authentication information for the other authentication may be stored in the second database DB2. In this embodiment, an example is given in which the first password and the second password are different from each other, but the first password and the second password may also be the same. In other words, a common password may be used for the first service and the second service.

[0068] The backup file is a file used in restoring the first private key. For example, the backup file indicates the second restoration key. If information other than the second restoration key is used in restoring the first private key, the backup file may include information other than the second restoration key. The backup file may also include information that is not particularly used in restoring the first private key. The backup file is saved in a storage area in the data storage unit 200 that is allocated to the second user account.

[0069] The data stored in the data storage unit 200 is not limited to the above examples. The data storage unit 200 may store data related to the second service. For example, the data storage unit 200 may store data necessary for displaying various screens in the second service. The data storage unit 200 may store data necessary for the first service and the second service to cooperate with each other.

[0070] [Second Service Department] The second service providing unit 201 provides the second service to the user. Providing the second service to the user means executing information processing for the user to use the second service. For example, the second service providing unit 201 provides the second service to the user by displaying various screens for the second service (for example, screens for uploading or downloading various data) on the user terminal 30.

[0071] For example, the second service providing unit 201 receives data selected by a user from the user terminal 30 of the user. The second service providing unit 201 stores the data in the second database in association with the second user account of the user. The second service providing unit 201 obtains the data selected by the user from the second database and transmits the data to the user terminal 30.

[0072] For example, when a user registers to use the first service, the second service providing unit 201 obtains a second recovery key from the first server 10, the user terminal 30, or another computer. The second service providing unit 201 stores the second recovery key in the second database in association with the second user account of the user. When a user performs an operation to recover the first private key, the second service providing unit 201 obtains the second recovery key associated with the second user account of the user from the second database. The second service providing unit 201 transmits the second recovery key to the user terminal 30 of the user.

[0073] [3-3. Functions implemented on user devices] For example, the user terminal 30 includes a data storage unit 300, a first processing unit 301, a first restoration key acquisition unit 302, a second restoration key acquisition unit 303, and a private key recovery unit 304. The data storage unit 300 is realized by the memory unit 32. The first processing unit 301, the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 are realized by the control unit 31.

[0074] [Data storage section] The data storage unit 300 stores data necessary for the user to use each of the first service and the second service. For example, the user terminal 30 receives the first application from a computer that distributes the first application and records the first application in the data storage unit 300. The user terminal 30 receives a first secret key from the first server 10 and records the first secret key in the data storage unit 300. Note that if the user uses the first service from a browser instead of the first application, the data storage unit 300 stores the browser. If a second application, which is an application for the second service, is prepared, the data storage unit 300 may store the second application.

[0075] [First processing section] The first processing unit 301 processes a first portion of the transmission information transmitted from the user terminal 30 based on the first private key. The first processing unit 301 processes the first portion by signing the first portion based on the first private key. The first processing unit 301 may sign the first portion based on the first private key and a predetermined signature algorithm. The signature algorithm may be a known algorithm. For example, the signature algorithm may be a library provided in a programming language such as Python (e.g., a Python cryptography library), or may be an algorithm not particularly related to a programming language library (e.g., Rivest-Shamir-Adleman (RSA) or Digital Signature Algorithm (DSA)).

[0076] The processing performed by the first processing unit 301 may be any processing that uses the first private key. The processing performed by the first processing unit 301 is not limited to signing the first portion. For example, the first processing unit 301 may process the first portion by encrypting the first portion based on the first private key and an encryption algorithm. The first processing unit 301 may process the first portion by decrypting the first portion based on the first private key and a decryption algorithm. The first processing unit 301 may process the first portion by issuing a digital certificate corresponding to the first portion based on the first private key.

[0077] [First recovery key acquisition unit] The first restoration key acquisition unit 302 acquires a first restoration key managed by a first service that uses a first private key stored in the user terminal 30 of the user. In this embodiment, the first restoration key is managed by the first server 10 of the first service, and therefore the first restoration key acquisition unit 302 acquires the first restoration key by downloading the first restoration key from the first server 10 of the first service to the user terminal 30. Note that the first restoration key may be managed by a computer or information storage medium other than the first server 10. In this case, the first restoration key acquisition unit 302 may acquire the first restoration key from the other computer or information storage medium.

[0078] For example, the first restoration key acquisition unit 302 requests the first server 10 for a first restoration key associated with the first user account of the user who is to have the first private key restored. The request for the first restoration key may include the first user account, or may include other information that can be used to search for the first restoration key (for example, a session ID that can identify a session between the first server 10 and the user terminal 30, or other information that can identify the user). Upon receiving the request for the first restoration key, the first server 10 acquires the first restoration key associated with the first user account from the first database DB1 based on the request, and transmits the acquired first restoration key to the user terminal 30. The first restoration key acquisition unit 302 acquires the first restoration key from the first server 10.

[0079] In this embodiment, the first restoration key acquisition unit 302 acquires a first restoration key associated with a first user account when first authentication is performed for the first user account in the first service. The first authentication is authentication performed when acquiring the first restoration key. In the example in the upper left of FIG. 5, the first authentication corresponds to authentication that confirms the legitimacy of the first user account entered from the first authentication screen SC5. The first authentication is not limited to authentication that confirms the legitimacy of the first user account. For example, the first authentication may be authentication that confirms the legitimacy of not only the first user account but also a first password, knowledge authentication, biometric authentication, or possession authentication that does not use the first user account.

[0080] [Second recovery key acquisition unit] The second restoration key acquisition unit 303 acquires a second restoration key managed by a second service different from the first service. In this embodiment, the second restoration key is managed by the second server 20 of the second service, and so the second restoration key acquisition unit 303 acquires the second restoration key by downloading the second restoration key from the second server 20 of the second service to the user terminal 30. Note that the second restoration key may be managed by a computer or information storage medium other than the second server 20. In this case, the second restoration key acquisition unit 303 may acquire the second restoration key from the other computer or information storage medium.

[0081] For example, the second restoration key acquisition unit 303 requests the second server 20 for a second restoration key associated with the second user account of the user from whom the second private key is to be restored. The request for the second restoration key may include the second user account, or may include other information that can be used to search for the second restoration key (for example, a session ID that can identify a session between the second server 20 and the user terminal 30, or other information that can identify the user). Upon receiving the request for the second restoration key, the second server 20 acquires the second restoration key associated with the second user account from the second database DB2 based on the request, and transmits the second restoration key to the user terminal 30. The second restoration key acquisition unit 303 acquires the second restoration key from the second server 20.

[0082] The second recovery key acquisition unit 303 acquires a second recovery key associated with a second user account when second authentication is performed for the second user account in the second service. The second authentication is performed when acquiring the second recovery key. In the example in the upper right of FIG. 5, the second authentication corresponds to authentication for verifying the legitimacy of the second user account selected from the second user account selection screen SC6. For example, the second authentication may use an authentication screen similar to the one in the upper left of FIG. 5. The second authentication is not limited to authentication for verifying the legitimacy of the second user account. For example, the second authentication may be authentication for verifying the legitimacy of not only the second user account but also the second password, or knowledge authentication, biometric authentication, or possession authentication in which the second user account is not used.

[0083] [Private key recovery section] The private key recovery unit 304 recovers the first private key based on the first recovery key and the second recovery key. Recovery of the first private key can also be referred to as regenerating or recovering the first private key. In this embodiment, the recovery of the first private key is performed within the user terminal 30, and therefore the private key recovery unit 304 recovers the first private key within the user terminal 30 based on the first recovery key and the second recovery key. After the user terminal 30 acquires the first recovery key and the second recovery key, the private key recovery unit 304 can recover the first private key without communicating with any computer other than the user terminal 30.

[0084] For example, the private key recovery unit 304 recovers the first private key based on a known recovery algorithm. The private key recovery unit 304 may recover the first private key using MPC technology. For example, the private key recovery unit 304 may recover the first private key using MPC technology from Block Daemon (registered trademark). In this embodiment, the first private key is divided to generate the first recovery key and the second recovery key, and the private key recovery unit 304 recovers the first private key by combining the first recovery key and the second recovery key. It is assumed that the process for recovering the first private key is indicated in the first application.

[0085] Note that the method for restoring the first private key is not limited to combining the first and second recovery keys. The private key restoration unit 304 may restore the first private key from the first and second recovery keys based on a predetermined restoration algorithm. For example, the private key restoration unit 304 may restore the first private key by adding the first and second recovery keys together based on a predetermined formula. The private key restoration unit 304 may restore the first private key while communicating with the first server 10, the second server 20, or another computer.

[0086] [4. Processing performed by the private key recovery system] 9 and 10 are diagrams showing an example of a usage process executed in the private key recovery system 1. The control units 11, 21, and 31 execute programs stored in the storage units 12, 22, and 32, respectively, to execute the process of FIG.

[0087] 9, when the user selects the first application, the user terminal 30 starts the first application (S1). The user terminal 30 executes processing with the first server 10 to display the usage registration screen SC1 (S2). The user terminal 30 identifies the operation performed by the user via the operation unit 34 (S3). In S3, the user performs either an operation to select button B10 or an operation to select button B11.

[0088] In S3, when the user selects button B10 (S3:B10), the user terminal 30 executes authentication with the first server 10 at the time of registration for use of the first service (S4). The user terminal 30 executes processing with the first server 10 to display an authentication completion screen SC2 (S5). The user terminal 30 executes processing with the first server 10 to display a generation screen SC3. When the user selects button B30, the user terminal 30 executes processing with the first server 10 and the second server 20 to generate a backup file (S6).

[0089] In S6, the first server 10 generates an original secret key. The first server 10 generates a first secret key and a second secret key based on the original secret key. The first server 10 generates a first recovery key and a second recovery key based on the first secret key. The first server 10 stores the second secret key and the first recovery key in the first database DB1. The first server 10 transmits the first secret key to the user terminal 30. The user terminal 30 records the first secret key in the storage unit 32. The first server 10 transmits the second recovery key to the second server 20. The second recovery key may be transmitted from the first server 10 to the second server 20 via the user terminal 30. The second server 20 stores the second recovery key in the second database DB2. When the processing of S6 is executed, a second authentication using a second user account may be executed.

[0090] The user terminal 30 executes processing between the first server 10 and the second server 20 to display a backup completion screen SC4 (S7). After this, the user is able to use the first service. When the user performs an operation to conduct a transaction using the first service, the user terminal 30 generates transaction information (S8). The user terminal 30 signs the first portion of the transaction information based on the first private key stored in the storage unit 32 (S9).

[0091] The user terminal 30 transmits the transaction information signed with the first private key to the first server 10 (S10). The first server 10 receives the transaction information from the user terminal 30 (S11). The first server 10 signs the second part of the transaction information using the second private key (S12). The first server 10 transmits the signed transaction information to the blockchain network (S13), and the process ends. Note that, in S8 to S13, an example was given of a case where processing is performed during a transaction, but similar processing may also be performed when the first service screen SC8 is displayed.

[0092] If the user selects button B11 in S3 (S3:B11), the process moves to FIG. 10, where the user terminal 30 executes processing with the first server 10 to display a first authentication screen SC5 (S14). The user terminal 30 executes first authentication with the first server 10 using the first user account (S15). If the first authentication fails, this processing ends. If the first authentication is successful, the user terminal 30 executes processing with the first server 10 to obtain a first recovery key stored in the first database DB1 (S16). In S16, the first recovery key associated with the first user account for which the first authentication was successful is obtained.

[0093] The user terminal 30 displays the second user account selection screen SC6 on the display unit 35 (S17). In S17, the user terminal 30 may execute processing with the first server 10 to display the second user account selection screen SC6, or may execute processing with the second server 20 to display the second user account selection screen SC6. The user terminal 30 may display the second user account selection screen SC6 on the display unit 35 by communicating with both the first server 10 and the second server 20.

[0094] The user terminal 30 executes second authentication with the second server 20 using the second user account (S18). If the second authentication fails, this process ends. If the second authentication is successful, the user terminal 30 executes processing with the second server 20 to display a private key restoration screen SC7 (S19). When the user selects button B70, the user terminal 30 executes processing with the second server 20 to obtain a second restoration key for the backup file stored in the second database DB2 (S20). In S20, the second restoration key associated with the second user account for which the second authentication was successful is obtained. The presence or absence of a backup file may be determined by checking for the existence of a file with a predetermined file name indicating that it is a backup file.

[0095] The user terminal 30 restores the first secret key based on the first recovery key and the second recovery key (S21), and then this process ends. In S21, the user terminal 30 restores the first secret key by combining the first recovery key and the second recovery key. The user terminal 30 records the first secret key in the storage unit 32. When the user uses the first application after the first secret key has been restored, the processes of S8 to S13 are executed based on the recorded first secret key.

[0096] [5. Summary of embodiments] The private key recovery system 1 of this embodiment acquires a first recovery key managed by a first service that uses a first private key stored in the user terminal 30. The private key recovery system 1 acquires a second recovery key managed by a second service. The private key recovery system 1 recovers the first private key based on the first recovery key and the second recovery key. This allows the first private key to be recovered even if the user loses the first private key, so the private key recovery system 1 can improve user convenience. For example, the private key recovery system 1 can save the user the trouble of calling a call center to resume use of the first service. For example, the user can recover the first private key by operating the first app. The first recovery key and the second recovery key used to recover the first private key are managed in a distributed manner by the first service and the second service, so the private key recovery system 1 can improve security when recovering the first private key.

[0097] Furthermore, the user terminal 30 obtains the first recovery key by downloading the first recovery key from the first server 10 to the user terminal 30. The user terminal 30 obtains the second recovery key by downloading the second recovery key from the second server 20 to the user terminal 30. The user terminal 30 recovers the first private key within the user terminal 30 based on the first recovery key and the second recovery key. By having the user terminal 30 recover the first private key by itself rather than requesting another computer to recover the first private key, the private key recovery system 1 can reduce the risk of the first recovery key and the second recovery key required to recover the first private key being leaked.

[0098] Furthermore, the first service is a service in which a user conducts transactions related to financial assets. The private key recovery system 1 provides the first service to the user by transmitting transaction information processed with the first private key to the blockchain network. As a result, even if the user loses the first private key, the first private key can be quickly restored and financial asset transactions can be conducted, so the private key recovery system 1 can improve the convenience of users who conduct financial asset transactions.

[0099] Furthermore, the private key recovery system 1 processes a first portion of the transmission information transmitted from the user terminal 30 based on the first private key. The private key recovery system 1 processes a second portion of the transmission information, which is different from the first portion, based on a second private key managed by the first service. The private key recovery system 1 provides the first service to the user based on the transmission information in which the first and second portions have been processed. This allows the private key recovery system 1 to enhance security in the first service.

[0100] Furthermore, when the first authentication for the first user account is performed, the private key recovery system 1 acquires the first recovery key associated with the first user account, thereby enabling the private key recovery system 1 to enhance security when restoring the first private key.

[0101] Furthermore, when a second authentication is performed for the second user account, the private key recovery system 1 acquires a second recovery key associated with the second user account, thereby enabling the private key recovery system 1 to enhance security when recovering the first private key.

[0102] [6. Modifications] The present disclosure is not limited to the above-described embodiments, and may be modified as appropriate without departing from the spirit of the present disclosure.

[0103] 11 is a diagram showing an example of functions realized in the modified example. For example, the first server 10 in the modified example includes a memory determination unit 103, a presentation unit 104, a login information recording unit 105, and a login execution unit 106. Each of the memory determination unit 103, the presentation unit 104, the login information recording unit 105, and the login execution unit 106 is realized by the control unit 11.

[0104] [6-1. Variation 1] For example, a user may use multiple second user accounts for the second service. Therefore, if a user has multiple second user accounts for the second service, the second recovery key may be associated with a second user account selected by the user from the multiple second user accounts. Although the first modification gives an example in which the user selects only one of the multiple second user accounts, the user may select multiple second user accounts. That is, the first modification gives an example in which the second recovery key is associated with only one second user account, but the second recovery key may be associated with each of the multiple second user accounts.

[0105] FIG. 12 is a diagram showing an example of a screen displayed on the user terminal 30 of Modification 1. As shown in the upper left of FIG. 12, the user terminal 30 displays a generation screen SC3 including buttons B31 indicating each of a plurality of second user accounts on the display unit 35. Information on the plurality of second user accounts is assumed to be stored in advance in the user terminal 30. For example, information on the plurality of second user accounts may be stored in cookies in the browser of the user terminal 30. The user selects the button B31 of the second user account to be associated with the second recovery key (i.e., the second user account that saves the backup file). Instead of selecting the button B31, the user may select the second user account to be associated with the second recovery key by manually entering the second user account on the generation screen SC3.

[0106] For example, when a user selects a second user account to associate with the second recovery key, the second server 20 stores a backup file including the second recovery key in the second database DB2 in association with the second user account. At this time, the second server 20 may perform second authentication using the second user account. A backup file including the second decryption key is not associated with a second user account not selected by the user. That is, the second server 20 saves the backup file including the second decryption key in a storage area corresponding to the second user account selected by the user, among storage areas corresponding to each of the multiple second user accounts used by the user. The second server 20 does not save a backup file including the second decryption key in a storage area corresponding to a second user account not selected by the user.

[0107] For example, when saving of the backup file is completed, the user terminal 30 displays a backup completion screen SC4 indicating that the backup file has been saved on the display unit 35, as shown in the upper right of Fig. 12. When the user starts the first app and performs an operation for restoration after losing the first private key, the user terminal 30 displays a first authentication screen SC5 on the display unit 35, as shown in the lower left of Fig. 12. The backup completion screen SC4 and the first authentication screen SC5 may be the same as those in the embodiment.

[0108] For example, when the authenticity of the first user account is confirmed, the user terminal 30 displays a second user account selection screen SC6 including buttons B60 indicating each of a plurality of second user accounts on the display unit 35, as shown in the lower right of Fig. 12. The user can select a second user account by selecting the button B60. Instead of selecting the button B60, the user may select the second user account associated with the second recovery key by manually entering the second user account on the second user account selection screen SC6.

[0109] When second authentication is performed for a second user account selected by a user from among multiple second user accounts, the second restoration key acquisition unit 303 of Modification 1 acquires a second restoration key associated with the second user account. For example, if a backup file is saved in the second user account indicated by the button B60 selected by the user, the second restoration key acquisition unit 303 acquires the second restoration key in the same manner as in the embodiment. The processing of the private key recovery unit 304 after the second restoration key is acquired is the same as in the embodiment. If a backup file is not saved in the second user account indicated by the button B60 selected by the user, an error occurs, and the first private key is not restored. In this case, the second user account selection screen SC6 may be displayed again.

[0110] In Variation 1, if a user has multiple second user accounts for the second service, the second recovery key is associated with a second user account selected by the user from the multiple second user accounts. When second authentication is performed for a second user account selected by the user from the multiple second user accounts, the private key recovery system 1 acquires the second recovery key associated with the second user account. This allows the user to recover the first private key by associating the second recovery key with a desired second user account from the multiple second user accounts, thereby improving user convenience.

[0111] [6-2. Variation 2] For example, the second user account may be associated with the user's second recovery key and a second recovery key of another user different from the user. The user here is the user from whom the first private key is to be restored. That is, the word "user" in Variation 2 refers to the user who has lost the first private key (the user who performs the operation to recover the first private key). The user in Variation 2 may or may not be the owner of the second user account.

[0112] The other user is a person related to the user. For example, the other user may be a family member or relative of the user, or may be a person other than the family member or relative of the user (for example, a person who belongs to the same organization as the user, such as a company). The other user may or may not be the holder of the second user account. For example, if the holder of the second user account is a father who manages the second recovery key on behalf of his family, the second user account of the father may be associated with the second recovery key of the father and the second recovery keys of his family members, such as his wife or children.

[0113] In Variation 2, multiple second recovery keys are associated with the second user account, and information that can identify which second recovery key belongs to which person (for example, information such as a UUID, first user account, or name, which will be described later) is stored in the second database DB2. This information identifies which second recovery key belongs to which person. When restoring the first private key, it is sufficient to specify which second recovery key to acquire from the multiple second recovery keys associated with the second user account based on the information about the user whose first private key is to be restored.

[0114] The second restoration key acquisition unit 303 of the second modification acquires the second restoration key of the user from among the second restoration key of the user and the second restoration key of another user different from the user. For example, the second restoration key acquisition unit 303 acquires information that can identify the user from whom the first secret key is to be restored (for example, information such as a UUID, a first user account, or a name, which will be described later), and acquires the second restoration key associated with the information. The information may be input to the user terminal 30, or may be acquired by acquiring the first user account of the currently logged-in user from the first server 10. The second restoration key acquisition unit 303 may display information on multiple second restoration keys associated with the second user account on the user terminal 30, and acquire the second restoration key selected by the user. The processing of the secret key recovery unit 304 after the second restoration key is acquired is the same as in the embodiment.

[0115] In the second modification, the second user account is associated with the user's second recovery key and a second recovery key of another user different from the user. The private key recovery system 1 acquires the user's second recovery key from among the user's second recovery key and the second recovery key of the other user different from the user. This enables the private key recovery system 1 to efficiently manage the second recovery key, thereby improving user convenience. For example, in the example described above in which the father manages the second recovery keys of the family, the family's second recovery key is associated with the father's second user account, and the private key recovery system 1 can also allow the father to manage the family's second recovery key.

[0116] [6-3. Variation 3] For example, there may be a plurality of second services that manage the second recovery key. In this case, the second recovery key may be managed by a second service selected by the user from the plurality of second services. Although the third modification takes an example in which the user selects only one of the plurality of second services, the user may select multiple second services. That is, the third modification takes an example in which the second recovery key is associated with only one second service, but the second recovery key may be managed by each of the plurality of second services. The second user accounts of the plurality of second services may be the same as or different from each other.

[0117] In the third modification, a case where the operators of the multiple second services are different from each other is taken as an example, but the operators of the multiple second services may be the same. Also, a case where the multiple second services are the same type of service is taken as an example, but the multiple second services may be different from each other. In the third modification, each of the multiple second services is a service that manages user data on the cloud, as in the embodiment. In the third modification, a second server 20 corresponding to each of the multiple second services is assumed to exist. The functions of each of the multiple second servers 20 may be similar.

[0118] FIG. 13 is a diagram showing an example of a screen displayed on the user terminal 30 of Modification Example 3. As shown in the upper left of FIG. 13, the user terminal 30 displays a generation screen SC3 including buttons B32 indicating each of a plurality of second services on the display unit 35. Information on the plurality of second services may be pre-stored in the user terminal 30 or may be transmitted from the first server 10 to the user terminal 30. Furthermore, information on the second user account for each of the plurality of second services may be pre-stored in the user terminal 30. The user selects the button B32 of the second service to be associated with the second recovery key (i.e., the second service that saves the backup file). Instead of selecting the button B32, the user may select the second service to be associated with the second recovery key by manually entering the name of the second service on the generation screen SC3.

[0119] In the example of FIG. 13, two second services, "XXX Cloud Service" and "YYY Cloud Service," are shown, but the user may be allowed to select a second service to save the backup file from three or more second services. For example, when the user selects a second service to associate with the second recovery key, the user terminal 30 prompts the user to select a second user account for the second service. The selection of the second user account may be performed in a manner similar to that of the embodiment or in a manner similar to that of Modification Example 1. Only a specific second service may allow the user to select one of multiple second user accounts, as in Modification Example 1. If only one second user account is available to the user for another second service, the selection of the second user account may not be required.

[0120] For example, the second server 20 of the second service selected by the user stores a backup file including the second decryption key in the second database DB2 in association with the second user account of the second service selected by the user. A backup file including the second decryption key is not stored in the second database DB2 of a second service not selected by the user. That is, among the multiple second services used by the user, the second server 20 of the second service selected by the user saves a backup file including the second decryption key in the second database DB2. The second server 20 of the second service not selected by the user does not save a backup file including the second decryption key in the second database DB2.

[0121] For example, when saving of the backup file is completed, the user terminal 30 displays a backup completion screen SC4 indicating that the backup file has been saved on the display unit 35, as shown in the upper right of Fig. 13. When the user launches the first app after losing the first private key, the user terminal 30 displays a first authentication screen SC5 on the display unit 35, as shown in the lower left of Fig. 13. The backup completion screen SC4 and the first authentication screen SC5 may be the same as those in the embodiment.

[0122] For example, when the authenticity of the first user account is confirmed, the user terminal 30 displays a second user account selection screen SC6 including buttons B61 indicating each of a plurality of second services on the display unit 35, as shown in the lower right of Fig. 13. The user can select a second service by selecting the button B61. The user may select the second service that manages the second recovery key by manually inputting the second service on the second user account selection screen SC6, rather than selecting the button B61.

[0123] For example, when a user selects a second service that manages a second recovery key, the user terminal 30 prompts the user to select a second user account for the second service. The selection of the second user account may be performed in the same manner as in the embodiment, or in the same manner as in Modification 1. Only a specific second service may allow the user to select one of multiple second user accounts, as in Modification 1.

[0124] The second restoration key acquisition unit 303 of Modification 3 acquires a second restoration key managed by a second service selected by the user from among multiple second services. For example, if a backup file is stored in the second service indicated by the button B61 selected by the user, the second restoration key acquisition unit 303 acquires the second restoration key in the same manner as in the embodiment or Modification 1. The processing of the private key recovery unit 304 after the second restoration key is acquired is the same as in the embodiment. If a backup file is not stored in the second service indicated by the button B61 selected by the user, an error occurs, and the first private key is not restored. In this case, the second user account selection screen SC6 may be displayed again.

[0125] In Variation 3, the second recovery key is managed by a second service selected by the user from among a plurality of second services. The private key recovery system 1 acquires the second recovery key managed by the second service selected by the user from among the plurality of second services. This allows the user to recover the first private key by managing the second recovery key in a desired second service from among the plurality of second services, thereby improving user convenience.

[0126] [6-4. Variation 4] For example, the user terminal 30 may store login information used to log in to the first service. The login information is information that can identify a user. The login information may be the first user account, but in variant example 4, an example is given in which the login information is a UUID different from the first user account. The login information may be information other than the first user account and UUID. For example, the login information may be a session ID that can identify a session between the first server 10 and the user terminal 30, authentication information called a token, or the IP address of the user terminal 30.

[0127] In the fourth modification, the first database DB1 stores login information. For example, when a user logs in to the first service using a first user account and a first password, the first server 10 issues a UUID for the user so that the UUID does not overlap with UUIDs of other users, and stores the UUID in the first database DB1. The UUID may be letters, numbers, symbols, or a combination of these. The first server 10 transmits the UUID to the user terminal 30. When the user terminal 30 receives the UUID from the first server 10, it records the UUID in the storage unit 32.

[0128] The private key recovery system 1 of the fourth modification includes a memory determination unit 103. The memory determination unit 103 determines whether or not login information used to log in to the first service is stored in the user terminal 30. For example, when the user launches the first application, the first server 10 requests the login information from the user terminal 30. If the login information is stored in the memory unit 32, the user terminal 30 transmits the login information to the first server 10. If the login information is not stored in the memory unit 32, the user terminal 30 does not transmit the login information to the first server 10.

[0129] For example, the memory determination unit 103 determines whether or not login information has been received from the user terminal 30, thereby determining whether or not login information is stored in the user terminal 30. The memory determination unit 103 may determine whether or not the login information received from the user terminal 30 is stored in the first database DB1.

[0130] In the fourth modification, the processes of the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 are executed when it is determined that the login information is not stored in the user terminal 30. The processes of the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 do not have to be executed when it is determined that the login information is stored in the user terminal 30.

[0131] For example, when it is determined that the login information is stored in the user terminal 30, the first server 10 may cause the user terminal 30 to display a screen other than the usage registration screen SC1 (for example, a screen for prompting the user to input authentication information other than the login information, a screen for performing biometric authentication, a screen showing the menu of the first application, or the first service screen SC8). When it is determined that the login information is not stored in the user terminal 30, the first server 10 may cause the user terminal 30 to display the usage registration screen SC1.

[0132] For example, the processes of the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 may be executed when the login information received from the user terminal 30 is stored in the first database DB1. The processes of the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 may not be executed when it is determined that the login information received from the user terminal 30 is stored in the first database DB1.

[0133] For example, if the login information received from the user terminal 30 is stored in the first database DB1, the first server 10 may cause the user terminal 30 to display a screen other than the usage registration screen SC1 (for example, a screen for logging in to the first service, or the first service screen SC8). If it is determined that the login information received from the user terminal 30 is not stored in the first database DB1, the first server 10 may cause the user terminal 30 to display the usage registration screen SC1.

[0134] The private key recovery system 1 of the fourth modification determines whether or not login information is stored in the user terminal 30. The processes of the first recovery key acquisition unit 302, the second recovery key acquisition unit 303, and the private key recovery unit 304 are each executed when it is determined that login information is not stored in the user terminal 30. This allows the private key recovery system 1 to recover the first private key when login information is not stored in the user terminal 30. The private key recovery system 1 can recover the first private key when recovery of the first private key is necessary, thereby improving user convenience.

[0135] [6-5. Variation 5] For example, after the button B11 described in the embodiment is selected, a series of processes such as obtaining the first restoration key is executed. Therefore, the button B11 corresponds to an instruction object that the user uses to instruct the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 to execute each process. The words "button B11" can be read as "instruction object." The instruction object is a part of the user interface that the user uses to instruct the execution of each process. The instruction object may be any part and is not limited to the button B11. For example, the instruction object may be a button of a type other than the button B11, a check box, a slide bar, an icon, an image other than an icon, text, or another part.

[0136] In Modification 5, a case will be described in which, in Modification 4, whether or not a button B11, which is an example of an instruction object, is presented to the user terminal 30 is controlled based on the determination result of the memory determination unit 103. The private key recovery system 1 of Modification 5 includes a presentation unit 104. If it is determined that login information is stored in the user terminal 30, the presentation unit 104 does not present the button B11 to the user terminal 30, and if it is determined that login information is not stored in the user terminal 30, the presentation unit 104 presents the button B11 to the user terminal 30.

[0137] For example, when it is determined that the login information is stored in the user terminal 30, the presentation unit 104 generates display data for a screen that does not include the button B11 (for example, another screen described in Modification 4, i.e., a screen that prompts the user to input authentication information other than the login information, a screen for performing biometric authentication, a screen showing the menu of the first application, or a screen such as the first service screen SC8) and transmits the display data to the user terminal 30. In this case, the user cannot select the button B11. When it is determined that the login information is not stored in the user terminal 30, the presentation unit 104 generates display data for the usage registration screen SC1 that includes the button B11 and transmits the display data to the user terminal 30. The respective processes of the first recovery key acquisition unit 302, the second recovery key acquisition unit 303, and the private key recovery unit 304 are executed when an operation is performed on the button B11. The flow of this series of processes is as described in the embodiment and Modification 4.

[0138] The private key recovery system 1 of Variation 5 does not present the button B11 to the user terminal 30 when it is determined that the login information is stored in the user terminal 30, and presents the button B11 to the user terminal 30 when it is determined that the login information is not stored in the user terminal 30. This allows the private key recovery system 1 to prevent the execution of processing for recovering the first private key when the login information is stored in the user terminal 30. In other words, the private key recovery system 1 can prevent unnecessary processing from being executed. The private key recovery system 1 can recover the first private key when the login information is not stored in the user terminal 30.

[0139] [6-6. Variation 6] For example, in Modification 4, not only the first private key but also login information may be restored. The private key recovery system 1 of Modification 4 includes a login information recording unit 105. When it is determined that login information is not stored in the user terminal 30, the login information recording unit 105 records login information managed by the second service in the user terminal 30. The login information recording unit 105 may generate new login information or may reuse the login information stored in the first database DB1 as is. The login information recording unit 105 records the login information in the user terminal 30 by transmitting the login information to the user terminal 30.

[0140] The login information recording unit 105 may be realized by the user terminal 30, instead of the first server 10. In this case, the login information recording unit 105 is realized by the control unit 31. The login information recording unit 105 may acquire login information from the first server 10 and record it in the data storage unit 300. If the login information is managed in the second database DB2 (for example, if the login information is included in the file name of the backup file), the login information recording unit 105 may acquire login information from the second server 20 and record it in the data storage unit 300.

[0141] When it is determined that the login information is not stored in the user terminal 30, the private key recovery system 1 of the sixth modification records the login information managed by the second service in the user terminal 30. This allows the login information to be restored even if the user loses it, so the private key recovery system 1 can improve user convenience.

[0142] [6-7. Variation 7] For example, the login information may be information that allows the user to simply log in to the first service. The private key recovery system 1 of the seventh modification includes a login execution unit 106. When the login information is stored in the user terminal 30, the login execution unit 106 executes login to the first service by simpler processing than when the login information is not stored in the user terminal 30.

[0143] For example, if login information is not stored in the user terminal 30, the login execution unit 106 executes login to the first service based on the first user account and first password entered by the user. The login execution unit 106 determines whether the first user account and first password entered by the user exist in the first database DB1. If the first user account and first password entered by the user do not exist in the first database DB1, the login execution unit 106 does not permit login to the first service, and if the first user account and first password entered by the user exist in the first database DB1, the login execution unit 106 permits login to the first service. The login execution unit 106 may permit login to the first service on the condition of authentication other than authentication using the first user account and first password.

[0144] For example, if login information is stored in the user terminal 30, the login execution unit 106 executes login to the first service based on the login information without requesting the user to input at least one of the first user account and the first password. In this case, biometric authentication may be executed in the user terminal 30 instead of inputting at least one of the first user account and the first password. The login execution unit 106 determines whether the login information received from the user terminal 30 exists in the first database DB1. If the login information received from the user terminal 30 does not exist in the first database DB1, the login execution unit 106 does not permit login to the first service, and if the login information received from the user terminal 30 exists in the first database DB1, the login execution unit 106 permits login to the first service. If biometric authentication is executed, the login execution unit 106 permits login to the first service on the condition that the biometric authentication is successful.

[0145] When login information is stored in the user terminal 30, the private key recovery system 1 of the seventh modification executes login to the first service by a simpler process than when login information is not stored in the user terminal 30. This enables the private key recovery system 1 to reduce the operational burden on the user for login.

[0146] [6-8. Variation 8] For example, as explained somewhat in Modification 7, the login execution unit 106 may execute login to the first service based on login information stored in the user terminal 30 and login information managed by the first service. Modification 8 takes as an example a case where login information is managed in the first database DB1. Note that the login information may be stored in a database other than the first database DB1, a computer other than the first server 10, or an information storage medium. In this case, the other database, computer, or information storage medium is assumed to be under the management of the operator of the first service.

[0147] For example, the login executing unit 106 determines whether the login information received from the user terminal 30 exists in the first database DB1. If the login information does not exist in the first database DB1, the login executing unit 106 does not permit the login, and if the login information exists in the first database DB1, the login executing unit 106 permits the login. That is, the login executing unit 106 determines whether the login information received from the user terminal 30 matches the login information stored in the first database DB1. If they do not match, the login executing unit 106 does not permit the login, and if they match, the login executing unit 106 permits the login.

[0148] The private key recovery system 1 of the eighth modification executes login to the first service based on login information stored in the user terminal 30 and login information managed by the first service. This enables the private key recovery system 1 to enhance security for logging in to the first service.

[0149] [6-9. Other variations] For example, the above modifications may be combined.

[0150] For example, the case where the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 are realized in the user terminal 30 has been exemplified, but the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 may be realized in a computer other than the user terminal 30 (for example, the first server 10, the second server 20, or a computer of a trusted third party). A mode in which the first restoration key acquisition unit 302, the second restoration key acquisition unit 303, and the private key recovery unit 304 are realized in another computer is also within the scope of the present disclosure.

[0151] For example, the transmitted information, such as transaction information, may be processed only using the first private key, and not using the second private key. In this case, the first server 10 may not include the second processing unit 101. The second private key may not be managed by the first service, or the second private key may not be generated at all. A mode in which the first server 10 does not include the second processing unit 101 is also within the scope of the present disclosure. In other words, a mode in which the second private key is not managed by the first service and a mode in which the second private key is not generated at all are also within the scope of the present disclosure.

[0152] For example, the first authentication does not have to be a condition for the first restoration key acquisition unit 302 to acquire the first restoration key. When the first private key has been deleted from the user terminal 30 but the login information remains, the first restoration key acquisition unit 302 may acquire the first restoration key on the condition that the legitimacy of the login information is confirmed. In this case, the first restoration key acquisition unit 302 may acquire the first restoration key associated with the login information whose legitimacy has been confirmed. When the first private key has been deleted from the user terminal 30 but the login information remains, the user terminal 30 may display the usage registration screen SC1 to proceed with the process of restoring the first private key.

[0153] For example, the second authentication does not have to be a condition for the second restoration key acquisition unit 303 to acquire the second restoration key. If the first private key is lost from the user terminal 30 but the login information remains, the second restoration key acquisition unit 303 may acquire the second restoration key on the condition that the legitimacy of the login information is confirmed and that biometric authentication, not the second user account authentication, is successful.

[0154] For example, a function described as being realized by the first server 10 may be realized by the second server 20, the user terminal 30, or another computer. A process described as being realized by the first server 10 may be shared among multiple computers. A process described as being realized by the second server 20 may be realized by the first server 10, the user terminal 30, or another computer. A process described as being realized by the second server 20 may be shared among multiple computers. A process described as being realized by the user terminal 30 may be realized by the first server 10, the second server 20, or another computer.

[0155] [7. Notes] For example, the private key recovery system can be configured as follows.

[0156] (1) a first recovery key acquisition unit that acquires a first recovery key managed by a first service that uses a first secret key stored in a user terminal of the user; a second restoration key acquisition unit that acquires a second restoration key managed by a second service different from the first service; a private key recovery unit that recovers the first private key based on the first recovery key and the second recovery key; A private key recovery system including: (2) the user terminal includes the first recovery key acquisition unit, the second recovery key acquisition unit, and the private key recovery unit; the first restoration key acquisition unit acquires the first restoration key by downloading the first restoration key from a first server of the first service to the user terminal; the second restoration key acquisition unit acquires the second restoration key by downloading the second restoration key from a second server of the second service to the user terminal; the private key recovery unit recovers the first private key in the user terminal based on the first recovery key and the second recovery key. A private key recovery system according to (1). (3) the first service is a service in which the user conducts transactions related to financial assets; The private key recovery system further includes a first service providing unit that provides the first service to the user by transmitting transaction information regarding the transaction, the transaction information being processed with the first private key, to a blockchain network. A private key recovery system according to (1) or (2). (4) The private key recovery system comprises: a first processing unit that processes a first portion of transmission information transmitted from the user terminal based on the first private key; a second processing unit that processes a second portion of the transmission information, the second portion being different from the first portion, based on a second secret key managed by the first service; a first service providing unit that provides the first service to the user based on the transmission information in which the first portion and the second portion have been processed; The private key recovery system according to any one of (1) to (3), further comprising: (5) the first recovery key acquisition unit acquires the first recovery key associated with the first user account when first authentication is performed for the first user account in the first service. A private key recovery system according to any one of (1) to (4). (6) the second recovery key acquisition unit acquires the second recovery key associated with the second user account when second authentication is performed for the second user account in the second service. A private key recovery system according to any one of (1) to (5). (7) When the user has a plurality of second user accounts in the second service, the second recovery key is associated with the second user account selected by the user from among the plurality of second user accounts; the second recovery key acquisition unit acquires the second recovery key associated with the second user account selected by the user from among the plurality of second user accounts when the second authentication is executed for the second user account selected by the user. (6) A private key recovery system according to (6). (8) the second user account is associated with the second recovery key of the user and the second recovery key of another user different from the user; the second recovery key acquisition unit acquires the second recovery key of the user from among the second recovery key of the user and the second recovery key of another user different from the user; A private key recovery system according to (6) or (7). (9) the second recovery key is managed by the second service selected by the user from among the plurality of second services; the second recovery key acquisition unit acquires the second recovery key managed by the second service selected by the user from among the plurality of second services. A private key recovery system according to any one of (1) to (8). (10) the private key recovery system further includes a storage determination unit that determines whether login information used to log in to the first service is stored in the user terminal; The processes of the first recovery key acquisition unit, the second recovery key acquisition unit, and the private key recovery unit are executed when it is determined that the login information is not stored in the user terminal. A private key recovery system according to any one of (1) to (9). (11) the private key recovery system further includes a presentation unit that, when it is determined that the login information is stored in the user terminal, does not present, to the user terminal, an instruction object for the user to instruct the execution of each of the processes, and, when it is determined that the login information is not stored in the user terminal, presents, to the user terminal, the instruction object; Each of the processes is executed when an operation is performed on the instruction object. (10) A private key recovery system according to (10). (12) the private key recovery system further includes a login information recording unit that records the login information managed by the second service in the user terminal when it is determined that the login information is not stored in the user terminal; A private key recovery system according to (10) or (11). (13) the private key recovery system further includes a login execution unit that, when the login information is stored in the user terminal, executes a login to the first service by a simpler process than when the login information is not stored in the user terminal; A private key recovery system according to any one of (10) to (12). (14) the private key recovery system further includes a login execution unit that executes login to the first service based on the login information stored in the user terminal and the login information managed by the first service; A private key recovery system according to any one of (10) to (13). [Explanation of symbols]

[0157] 1 Private key recovery system, 10 First server, 11, 21, 31 Control unit, 12, 22, 32 Memory unit, 13, 23, 33 Communication unit, 20 Second server, 30 User terminal, 34 Operation unit, 35 Display unit, 100 Data memory unit, 101 Second processing unit, 102 First service providing unit, 103 Memory determination unit, 104 Presentation unit, 105 Login information recording unit, 106 Login execution unit, 200 Data memory unit, 201 Second service providing unit, 300 Data memory unit, 301 First processing unit, 302 First recovery key acquisition unit, 303 Second recovery key acquisition unit, 304 Private key recovery unit, B10, B11, B20, B30, B31, B32, B51, B60, B61, B70, B71 Button, DB1 First database, DB2 Second database, F50 input form, N network, P60 panel, SC1 user registration screen, SC2 authentication completion screen, SC3 generation screen, SC4 backup completion screen, SC5 first authentication screen, SC6 second user account selection screen, SC7 private key recovery screen, SC8 first service screen.

Claims

1. a first restoration key acquisition unit that acquires a first restoration key managed by a first service that uses a first secret key stored in a user terminal of a user; a second restoration key acquisition unit that acquires a second restoration key managed by a second service different from the first service; a private key recovery unit that recovers the first private key based on the first recovery key and the second recovery key; A private key recovery system including:

2. the user terminal includes the first restoration key acquisition unit, the second restoration key acquisition unit, and the private key restoration unit; the first restoration key acquisition unit acquires the first restoration key by downloading the first restoration key from a first server of the first service to the user terminal; the second restoration key acquisition unit acquires the second restoration key by downloading the second restoration key from a second server of the second service to the user terminal; the private key recovery unit recovers the first private key in the user terminal based on the first recovery key and the second recovery key. The private key recovery system according to claim 1 .

3. the first service is a service in which the user conducts a transaction related to a financial asset; The private key recovery system further includes a first service providing unit that provides the first service to the user by transmitting transaction information regarding the transaction, the transaction information being processed with the first private key, to a blockchain network.

3. The private key recovery system according to claim 1 or 2.

4. The private key recovery system comprises: a first processing unit that processes a first portion of transmission information transmitted from the user terminal based on the first private key; a second processing unit that processes a second portion of the transmission information, the second portion being different from the first portion, based on a second private key managed by the first service; a first service providing unit that provides the first service to the user based on the transmission information in which the first portion and the second portion have been processed; 3. The private key recovery system according to claim 1, further comprising:

5. the first restoration key acquisition unit acquires the first restoration key associated with the first user account when first authentication is performed for the first user account in the first service; 3. The private key recovery system according to claim 1 or 2.

6. the second restoration key acquisition unit acquires the second restoration key associated with the second user account when second authentication is performed for the second user account in the second service.

3. The private key recovery system according to claim 1 or 2.

7. When the user has a plurality of second user accounts in the second service, the second recovery key is associated with the second user account selected by the user from among the plurality of second user accounts; the second recovery key acquisition unit acquires the second recovery key associated with the second user account selected by the user from among the plurality of second user accounts when the second authentication is performed for the second user account selected by the user. The private key recovery system according to claim 6.

8. the second user account is associated with the second recovery key of the user and the second recovery key of another user different from the user; the second recovery key acquisition unit acquires the second recovery key of the user from among the second recovery key of the user and the second recovery key of another user different from the user; The private key recovery system according to claim 6.

9. the second recovery key is managed by a second service selected by the user from among a plurality of second services; the second restoration key acquisition unit acquires the second restoration key managed by the second service selected by the user from the plurality of second services; 3. The private key recovery system according to claim 1 or 2.

10. the private key recovery system further includes a storage determination unit that determines whether login information used to log in to the first service is stored in the user terminal; The processes of the first restoration key acquisition unit, the second restoration key acquisition unit, and the private key recovery unit are executed when it is determined that the login information is not stored in the user terminal.

3. The private key recovery system according to claim 1 or 2.

11. the private key recovery system further includes a presentation unit that, when it is determined that the login information is stored in the user terminal, does not present, to the user terminal, an instruction object for the user to instruct the execution of each of the processes, and, when it is determined that the login information is not stored in the user terminal, presents, to the user terminal, the instruction object; Each of the processes is executed when an operation is performed on the instruction object. The private key recovery system according to claim 10.

12. the private key recovery system further includes a login information recording unit that records the login information managed by the second service in the user terminal when it is determined that the login information is not stored in the user terminal; The private key recovery system according to claim 10.

13. the private key recovery system further includes a login execution unit that, when the login information is stored in the user terminal, executes a login to the first service by a simpler process than when the login information is not stored in the user terminal; The private key recovery system according to claim 10.

14. the private key recovery system further includes a login execution unit that executes login to the first service based on the login information stored in the user terminal and the login information managed by the first service; The private key recovery system according to claim 10.

15. a first restoration key acquisition step of acquiring a first restoration key managed by a first service in which the first secret key stored in the user terminal of the user is used; a second restoration key acquisition step of acquiring a second restoration key managed by a second service different from the first service; a private key recovery step of recovering the first private key based on the first recovery key and the second recovery key; A private key recovery method including:

16. a first restoration key acquisition unit that acquires a first restoration key managed by a first service that uses a first secret key stored in a user terminal of the user; a second restoration key acquisition unit that acquires a second restoration key managed by a second service different from the first service; a private key recovery unit that recovers the first private key based on the first recovery key and the second recovery key; A program that allows a computer to function as a

Images