Information processing method and information processing system

Abstract

Achieves more secure list verification. [Solution] An information processing method is provided, which includes: performing a first verification to verify whether the value obtained by further encrypting protected information encrypted using a first random number using a second random number is included in a list encrypted using the first and second random numbers; and performing a second verification to verify the authenticity of a zero-knowledge proof indicating that a signature has been attached to the protected information.

Description

Technical Field

[0001] The present disclosure relates to an information processing method and an information processing system.

Background Art

[0002] In recent years, a technique has become widespread in which it is verified whether information about a user is included in a permission list or a block list (hereinafter referred to as list verification), and based on the result of the verification, it is determined whether or not to provide a service to the user.

[0003] Also, for example, as disclosed in Non-Patent Document 1, a technique for protecting information of both a user and a service provider in list verification has been developed.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the technique disclosed in Non-Patent Document 1, it is not guaranteed that the information about the user is truly the user's own.

Means for Solving the Problems

[0006] According to one aspect of the present disclosure, an information processing method is provided, including: a processor performing a first verification to verify whether a value obtained by further encrypting information to be protected encrypted using a first random number with a second random number is included in a list encrypted using the first random number and the second random number; and performing a second verification to verify the authenticity of a zero-knowledge proof indicating that a signature is given to the information to be protected.

[0007] Also, according to another aspect of the present disclosure, an information processing system is provided, including: a first verification unit configured to verify whether a value obtained by further encrypting information to be protected encrypted using a first random number with a second random number is included in a list encrypted using the first random number and the second random number; and a second verification unit configured to verify the authenticity of a zero-knowledge proof indicating that a signature is given to the information to be protected.

Brief Description of the Drawings

[0008] [Figure 1] It is a diagram for explaining the outline of the prior art. [Figure 2] It is a diagram for explaining the outline of the prior art. [Figure 3] It is a diagram for explaining the outline of the prior art. [Figure 4] It is a diagram for explaining the outline of the prior art. [Figure 5] It is a diagram for explaining the outline of the prior art. [Figure 6] It is a diagram for explaining the outline of the prior art. [Figure 7] It is a diagram for explaining the outline of the prior art. [Figure 8] It is a diagram for explaining the outline of the prior art. [Figure 9] It is a diagram for explaining the outline of the prior art. [Figure 10] It is a sequence diagram showing an example of the processing flow in the prior art. [Figure 11]This is a sequence diagram showing the processing flow using personal information x to which a signature has been attached. [Figure 12] One of the images in this disclosure<STEP:7´> This is a schematic diagram to explain the topic. [Figure 13] This is a sequence diagram showing an example of the processing flow according to the same embodiment. [Figure 14] According to the same embodiment<STEP:7´´> This is a schematic diagram to explain the topic. [Figure 15] This sequence diagram shows an example of the processing flow using a zero-knowledge proof π generated based on the signature σ and digitized personal information according to the same embodiment. [Figure 16] This is a block diagram showing the functional configuration of the information processing system 1 according to the same embodiment. [Figure 17] This figure shows an example of the UI according to the same embodiment. [Figure 18] This sequence diagram shows the flow of using other services with VC according to the same embodiment. [Figure 19] This is a sequence diagram showing an example of a typical SSO authentication process. [Figure 20] This sequence diagram shows an example of the processing flow when an information processing method according to one embodiment of this disclosure is applied to SSO. [Figure 21] This is a block diagram showing an example of the hardware configuration of the information processing device 90 according to the same embodiment. [Modes for carrying out the invention]

[0009] Preferred embodiments of this disclosure will be described in detail below with reference to the attached drawings. In this specification and the drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant descriptions will be omitted.

[0010] Furthermore, in this specification and drawings, when describing multiple identical components to distinguish them, letters or other symbols may be added to the end of the reference numerals. On the other hand, when there is no need to distinguish multiple identical components, the letters or other symbols may be omitted, and a description common to all identical components may be provided.

[0011] The explanation will be given in the following order. 1. Embodiment 1.1. Background 1.2. Processing Details 1.3. Example of Functional Configuration 1.4.UI example 1.5. Variations 2. Hardware Configuration Example 3. Summary

[0012] <1. Embodiments> <<1.1.Background>> As mentioned above, technologies have been developed to protect information from both users and service providers in list validation.

[0013] For example, Non-Patent Document 1 discloses a technology that verifies whether a password is included in a "list of weak passwords" without the user disclosing the password itself to the service provider, and without the service provider disclosing the "list of weak passwords" itself to the user.

[0014] To demonstrate the advantages of the information processing method according to one embodiment of this disclosure, we will first describe the outline of the prior art disclosed in Non-Patent Document 1.

[0015] Figures 1 to 9 are diagrams illustrating the overview of the prior art.

[0016] First, let's describe the problem setting with reference to Figure 1. Figure 1 shows examples of personal information 60 managed by user 15 and a blocklist 70 managed by service provider 25.

[0017] Personal information 60 is an example of protected information according to this embodiment. Personal information 60 may be, for example, information relating to a My Number card, social security number, driver's license, passport, password, etc., or it may be information such as name, date of birth, etc. as shown in the figure.

[0018] Furthermore, the block list 70 is an example of a list according to this embodiment. In this example, the block list 70 may be a list that includes multiple pieces of personal information as elements.

[0019] The service provider 25 verifies whether the personal information 60 is included in the blocklist 70, and provides the service to the user 15 only if the personal information 60 is not included in the blocklist 70.

[0020] The service provider 25 may be, for example, a financial institution such as a bank. In this case, the block list 70 may be an AML / CFT (Anti Money Laundering / Countering the Financing of Terrorism) list.

[0021] If a service provider 25, such as a bank or other financial institution, finds that a user's 15 personal information 60 is included in an AML / CFT list, it can prevent money laundering, terrorist financing, etc., by refraining from providing the service.

[0022] Here, we consider a scenario where list verification is performed without disclosing the contents of both the personal information 60 and the block list 70 to the other party.

[0023] To achieve the above, in the prior art, first, as shown in Figure 2, personal information 60 is digitized using a hash function or the like, and the digitized personal information 62 is obtained. In addition, each piece of personal information included in the blocklist 70 is digitized, and the digitized blocklist 72 is obtained. <step:1>.

[0024] VALUE "23" is an example of a numerical value obtained by quantifying personal information 60 ("Shiro TANAKA", "1993 / 07 / 20"). VALUE "12" is an example of a numerical value obtained by quantifying personal information included in blocklist 70 ("Ichiro SATO", "1989 / 05 / 30"). VALUE "105" is an example of a numerical value obtained by quantifying personal information included in blocklist 70 ("Jiro SUZUKI", "1963 / 01 / 24"). Also, VALUE "57" is an example of a numerical value obtained by quantifying personal information included in blocklist 70 ("Saburo TAKAHASHI", "2002 / 11 / 01").

[0025] The quantification described above can be achieved, for example, by using a hash function to convert each piece of personal information into a point (value) on an elliptic curve. While the actual converted value is approximately 2 to the power of 256, the examples above are used for ease of understanding.

[0026] In the prior art, the grouping of the digitized block list 72 is then performed, as shown in Figure 3. <step:2>.

[0027] In the example shown in Figure 3, each VALUE in the numerically represented blocklist 72 is grouped according to the remainder when divided by 4.

[0028] Furthermore, grouping may be performed according to the value of the first m bits of the VALUE (hash value), as will be described later.

[0029] Furthermore, by changing the number used to divide VALUE, such as the aforementioned 'm', it is possible to adjust the trade-off between processing performance and information protection.

[0030] In the prior art, the user 15 then specifies the group, as shown in Figure 4. <step:3>In this example, user 15 specifies the group by providing service provider 25 with the remainder "3" obtained by dividing the digitized personal information 62 by 4.

[0031] By designating groups as described above, the service provider 25 can determine that if user 15's digitized personal information 62 is included in the digitized blocklist 72, the remainder belongs to group "3".

[0032] Furthermore, the larger the number used to divide the quantified personal information, the greater the number of groups and the fewer elements each group will have. Consequently, a larger number allows the service provider to obtain more information. Therefore, the number used to divide the quantified personal information must meet the established data protection requirements.

[0033] In the prior art, as shown in Figure 5, each element in the group with a remainder of "3" is then encrypted (raised to the power of b) using a random number b, and the information relating to the encrypted group with a remainder of "3" is provided to user 15. <step:4>.

[0034] Since random number b is kept secret from user 15, user 15 cannot decode the elements included in the remainder "3" group. Note that random number b is an example of a second random number according to this embodiment.

[0035] Furthermore, by encrypting and providing (transmitting) only the information pertaining to a specific group from the digitized blocklist 72, improvements in computing and communication performance can be achieved.

[0036] As mentioned above, the larger the number used to divide the digitized personal information, the more groups there will be, and the fewer elements there will be in each group. Therefore, a larger number improves computational and communication performance. Conversely, the smaller the number used to divide the digitized personal information, the lower the computational and communication performance will be. For this reason, the number used to divide the digitized personal information must meet the set performance requirements.

[0037] In the prior art, as shown in Figure 6, personal information 62 is then encrypted (raised to the power of a) using a random number a, and the encrypted personal information is provided to the service provider 25. <step:5>.

[0038] Since the random number a is kept confidential from the service provider 25, the service provider 25 cannot decrypt the digitized personal information 62. Note that the random number a is an example of the first random number according to this embodiment.

[0039] Furthermore, in the prior art, as shown in Figure 7, information relating to the remainder "3" group, encrypted with random number b, is further encrypted using random number a before being provided to the service provider 25. <step:6>.

[0040] In addition, <step:5>and <step:6>The provision of information in this context may be carried out in a single communication.

[0041] In the prior art, as shown in Figure 8, the service provider 25 then further encrypts the personal information encrypted with random number a using random number b. <step:7>.

[0042] In the prior art, as shown in Figure 9, the service provider 25 then verifies whether the personal information encrypted with random numbers a and b is included in the group of the remainder "3" encrypted with random numbers a and b. <step:8>。

[0043] The above described the overview of the prior art with reference to FIGS. 1 to 9. Subsequently, with reference to FIG. 10, the processing flow in the prior art will be described in more detail.

[0044] In the case of an example shown in FIG. 10, first, the user terminal 10 transmits the first m bits of H ´ , b , i ,

[0048] , i , ´ , i , , (x) to the service server 20 (S101).

[0045] x is personal information of the user 15 (e.g., password, etc.). H[[ID=1​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​The first m bit of ) is the H received in step S101 ´ y such that the first m bits of (x) match i " against" h i =H(y i ) b The process of calculating is not necessarily required. These processes are means to improve performance, as mentioned above, and are not essential components of list verification. The service server 20 samples a random number b and simply, h i =H(y i ) b You may also calculate this.

[0049] Based on the result of the calculation in step S102, the service server 20 determines {h i } i The following is sent to the user terminal 10 (S103).

[0050] User terminal 10 samples a random number a and calculates the following equations (1) and (2) (S104).

[0051]

number

[0052] Furthermore, user terminal 10 shuffles the following formula (3) to obtain the following formula (4) (S105).

[0053]

number

[0054] Next, the user terminal 10 sends the result of the calculation of formula (1) and formula (4) to the service server 20 (S106).

[0055] In this way, by shuffling the order of elements in an encrypted list using random numbers a and b before transmission, it is possible to prevent the inference of information from the original order and ensure security.

[0056] The service server 20 receives the result of the calculation of the above formula (1) in step S106 and then determines h ´b Calculate and in step S106, include h in formula (4) received ´b Verify whether there is a value that matches (S107).

[0057] The processing flow in the prior art has been described above. According to the processing flow described above, it is possible to verify whether or not personal information 60 is included in the blocklist 70 while keeping the personal information 60 and the blocklist 70 confidential from the other party.

[0058] However, the prior art does not have a configuration to authenticate whether password x is truly user 15's personal information. Therefore, a malicious user 15 could use someone else's personal information x ´ If this is used, the service server 20 may overlook it.

[0059] To avoid the situation described above, one possible solution is to have a third party sign the personal information x.

[0060] Figure 11 is a sequence diagram showing the processing flow using signed personal information x.

[0061] In the example shown in Figure 11, first, the user terminal 10 sends an authentication request containing personal information x to the authentication device 30 (S201).

[0062] The authentication device 30 is an information processing device operated by a third party different from the user 15 and the service provider 25.

[0063] The authentication device 30 performs authentication based on the authentication request received in step S201, and if authentication is successful, it returns the signature σ for the personal information x to the user terminal 10 (S202).

[0064] Meanwhile, the service server 20 samples a random number b and h i =H(y i ) b Calculate (S203), {h i } i Send this to user terminal 10 (S204).

[0065] Next, the user terminal 10 performs steps S205 and S206. Steps S205 and S206 are equivalent to steps S104 and S105 shown in Figure 10.

[0066] The user terminal 10 sends the result of the calculation in formula (1) above, and in addition to formula (4) above, the signature σ to the service server 20 (S207).

[0067] The service server 20 receives the result of the calculation of the above formula (1) in step S207 and then determines h ´b Calculate and include h in formula (4) received in step S207 ´b Verify whether there is a match between the values ​​(S208).

[0068] Furthermore, the service server 20 verifies the authenticity of signature σ (S209).

[0069] The above describes the processing flow using personal information x to which signature σ has been attached.

[0070] While the processing flow described above can guarantee that personal information x truly belongs to user 15, there is a possibility that personal information x could be leaked from the signature σ, leaving security concerns.

[0071] The technical concept of one embodiment of this disclosure was conceived with the above-mentioned points in mind, and aims to achieve more secure list verification.

[0072] To this end, one of the features of an information processing method according to one embodiment of the present disclosure is that it verifies the authenticity of a zero-knowledge proof indicating that a signature has been attached to protected information.

[0073] The following describes in detail an information processing method according to one embodiment of this disclosure.

[0074] <<1.2. Processing Details>> As described above, in the information processing method according to this embodiment, it is proven by zero-knowledge proof that a signature has been affixed to the protected information.

[0075] A zero-knowledge proof is a technique for proving a fact without providing the other party with any knowledge other than that fact itself.

[0076] The user terminal 10 (an example of a proofing device) according to this embodiment may generate zero-knowledge proofs π using an algorithm such as zk-SNARK (Zero-Knowledge Succinct Non-interactive Arguments of Knowledge).

[0077] Figure 12 shows an embodiment of this plan.<STEP:7´> This is a schematic diagram illustrating the present embodiment.<STEP:7´> This is the prior art shown in Figure 8. <step:7>It corresponds to this.

[0078] In this example,<STEP:7´> Then, on the service provider 25 side, personal information encrypted with random number a is further encrypted using random number b, while on the user 15 side, a zero-knowledge proof π is generated based on the signature σ, and the generated zero-knowledge proof π is presented to the service provider 25 side.

[0079] <STEP:7´> The zero-knowledge proof π generated in this process may be data indicating that the signature σ was assigned to personal information 60 (an example of protected information).

[0080] <STEP:7´> The zero-knowledge proof π generated in the following<STEP:8´> This is verified by the service provider 25.

[0081] Furthermore, according to this embodiment<STEP:1´> ~<STEP:6´> Regarding this, except for the fact that a signature σ is attached to personal information 60, the prior art <step:1> ~ <step:6>Since it can be equivalent to the above, a detailed explanation will be omitted.

[0082] Next, with reference to Figure 13, an example of the processing flow in this embodiment will be described in detail.

[0083] Note that the processes in steps S301 to S306 shown in Figure 13 may be equivalent to the processes in steps S201 to S206 shown in Figure 11, so a detailed explanation is omitted.

[0084] After steps S301 to S306, the user terminal 10 generates a zero-knowledge proof π based on the signature σ (S307).

[0085] The zero-knowledge proof π generated in step S307 is data that shows that the signature σ has been assigned to personal information x (an example of protected information).

[0086] The user terminal 10 sends the result of the calculation of formula (1) above, and the zero-knowledge proof π generated in step S307 in addition to formula (4) above, to the service server 20 (S308).

[0087] The service server 20 receives the result of the calculation of the above formula (1) in step S308 and then determines h ´b Calculate and include h in the formula (4) received in step S308 ´b Verify whether there is a match between the values ​​(S309).

[0088] Furthermore, the service server 20 verifies the authenticity of the zero-knowledge proof π received in step S308 (S310).

[0089] According to the zero-knowledge proof π based on signature σ, as explained with reference to Figures 12 and 13, the signature σ itself is kept secret from the service server 20, eliminating the possibility of personal information x being leaked from the signature σ, while simultaneously proving that the signature σ is attached to personal information x.

[0090] Next, we will describe another example of the zero-knowledge proof π according to this embodiment.

[0091] Figure 14 shows an embodiment of this product.<STEP:7´´> This is a schematic diagram illustrating the present embodiment.<STEP:7´´> This is the prior art shown in Figure 8. <step:7>It corresponds to this.

[0092] In this example,<STEP:7´´> Then, on the service provider 25 side, personal information encrypted with random number a is further encrypted using random number b, while on the user 15 side, a zero-knowledge proof π is generated based on the signature σ and the digitized personal information 62, and the generated zero-knowledge proof π is presented to the service provider 25 side.

[0093] <STEP:7´´> The zero-knowledge proof π generated in this case may be data that, in addition to the signature σ being assigned to personal information 60 (an example of protected information), further demonstrates that the personal information encrypted using a random number a is a value correctly calculated from personal information 60.

[0094] <STEP:7´´> The zero-knowledge proof π generated in the following<STEP:8´´> This is verified by the service provider 25.

[0095] Furthermore, according to this embodiment<STEP:1´´> ~<STEP:6´´> Regarding this, except for the fact that a signature σ is attached to personal information 60, the prior art <step:1> ~ <step:6>Since it can be equivalent to the above, a detailed explanation will be omitted.

[0096] Next, with reference to Figure 15, an example of the processing flow using the signature σ and the zero-knowledge proof π generated based on the digitized personal information according to this embodiment will be described in detail.

[0097] Note that the processes in steps S401 to S406 shown in Figure 15 may be equivalent to the processes in steps S201 to S206 shown in Figure 11, so a detailed explanation is omitted.

[0098] After steps S401 to S406, the user terminal 10 generates the zero-knowledge proof π (S407).

[0099] The zero-knowledge proof π generated in step S407 is π←Prove((vk, h ´ It is expressed as (x, σ, a)), and that the signature σ is attached to the personal information x (Verify(vk; x, σ) = accept), and h ´ It is correct that it is calculated from personal information x (h ´ = H(x) a ) indicates.

[0100] The user terminal 10 sends the result of the calculation of formula (1) above, and the zero-knowledge proof π generated in step S407 in addition to formula (4) above, to the service server 20 (S408).

[0101] The service server 20 receives the result of the calculation of the above formula (1) in step S408 and then determines h ´b Calculate and include h in formula (4) received in step S408 ´b Verify whether there is a value that matches (S409).

[0102] Furthermore, the service server 20 verifies the authenticity of the zero-knowledge proof π received in step S408 (Verify(σ, (vk, h ´ ))(S410).

[0103] According to the zero-knowledge proof π explained with reference to Figures 14 and 15, user 15 possesses the personal information x of another person. ´ Using this method makes it possible to detect this, enabling more secure list verification.

[0104] <<1.3. Example of Functional Configuration>> Next, we will describe an example of the functional configuration of the information processing system 1 that implements the information processing method according to this embodiment. Figure 16 is a block diagram showing the functional configuration of the information processing system 1 according to this embodiment.

[0105] As shown in Figure 16, the information processing system 1 according to this embodiment includes a user terminal 10, a service server 20, and an authentication device 30.

[0106] (User terminal 10) User terminal 10 is an information processing device used by user 15, and is an example of a certification device according to this embodiment.

[0107] As shown in Figure 16, the user terminal 10 includes a processing unit 110, a display unit 120, a communication unit 130, and the like.

[0108] (Processing step 110) The processing unit 110 performs list verification in cooperation with the service server 20. The processing unit 110 is an example of a certification unit according to this embodiment.

[0109] Furthermore, the processing unit 110 sends an authentication request containing the information to be protected to the authentication device 30 and performs control to obtain a signature for the information to be protected.

[0110] Furthermore, the processing unit 110 controls the display of information by the display unit 120.

[0111] The functions of the processing unit 110 are realized through the cooperation of various processors and memory.

[0112] (Display section 120) The display unit 120 displays various types of information in accordance with the control of the processing unit 110. For this purpose, the display unit 120 is equipped with various types of displays.

[0113] (Communications Section 130) The communication unit 130 communicates information with other information processing devices via the network, in accordance with the control of the processing unit 110.

[0114] (Service Server 20) The service server 20 is an information processing device operated by the service provider 25, and is an example of a verification device according to this embodiment.

[0115] As shown in Figure 16, the service server 20 includes a processing unit 210, a service provision unit 220, a communication unit 230, and the like.

[0116] (Processing unit 210) The processing unit 210 performs list verification in cooperation with the user terminal 10.

[0117] The processing unit 210 is an example of a first verification unit that verifies whether the value obtained by further encrypting the protected information, which has been encrypted using a first random number, using a second random number, is included in the list encrypted using the first and second random numbers.

[0118] Furthermore, the processing unit 210 is an example of a second verification unit that verifies the authenticity of a zero-knowledge proof indicating that the signature was attached to the protected information.

[0119] The processing unit 210 receives the protected information encrypted using the first random number, the list encrypted using the first and second random numbers, and the zero-knowledge proof from the user terminal 10 via the communication unit 230.

[0120] Furthermore, the processing unit 210 encrypts the list using a second random number and transmits the list encrypted using the second random number to the user terminal 10 via the communication unit 230.

[0121] (Service Provision Department 220) The service provision unit 220 decides whether or not to provide the service based on the results of the verification (first verification) performed by the processing unit 210 to determine whether the value obtained by further encrypting the protected information encrypted using the first random number and the second random number is included in the list encrypted using the first and second random numbers, and the results of the verification of the authenticity of the zero-knowledge proof (second verification).

[0122] For example, the service provider 220 may provide the service if, in the first verification, it is determined that the protected information encrypted using the first random number and the second random number is not included in the blocklist encrypted using the first random number and the second random number, and if, in the second verification, the authenticity of the zero-knowledge proof is confirmed.

[0123] (Communications Section 230) The communication unit 230 communicates information with other information processing devices via the network, in accordance with the control of the processing unit 210.

[0124] (Authentication device 30) The authentication device 30 is an information processing device operated by a third party different from the user 15 and the service provider 25.

[0125] As shown in Figure 16, the authentication device 30 includes an authentication unit 310, a communication unit 320, and the like.

[0126] (Authentication section 310) The authentication unit 310 performs authentication based on an authentication request containing protected information transmitted from the user terminal 10, and if the authentication is successful, it affixes a signature to the protected information.

[0127] (Communications Department 330) The communication unit 330 communicates information with other information processing devices via the network, in accordance with the control of the authentication unit 310.

[0128] The above describes an example of the functional configuration of the information processing system 1 according to this embodiment. Note that the above functional configuration, as explained with reference to Figure 16, is merely an example, and the functional configuration of the information processing system 1 according to this embodiment is not limited to this example.

[0129] For example, the user terminal 10, service server 20, and authentication device 30 may further include an operation reception unit for receiving operations from the operator, an audio input unit for receiving audio, an audio output unit for outputting audio, and so on.

[0130] Furthermore, for example, the service server 20 and the authentication device 30 may further include a display unit for displaying information.

[0131] The functional configuration of the information processing system 1 according to this embodiment can be flexibly modified according to specifications, operation, etc.

[0132] <<1.4. UI (User Interface) Examples>> Next, we will describe an example of the UI according to this embodiment. Figure 17 is a diagram showing an example of the UI according to this embodiment.

[0133] When user 15 requests the service, the processing unit 110 of the user terminal 10 works in cooperation with the service server 20 to display on the display unit 120 a request for the provision of protected information (in this example, an image of the driver's license), as shown on the left side of Figure 17.

[0134] If user 15 takes a photo of their driver's license, the processing unit 110 works with the service server 20 to perform the list verification described above and displays the status of the list verification (labeled "Authentication" in Figure 17) on the display unit 120, as shown in the center of Figure 17.

[0135] Furthermore, once the list verification is complete and the protected information is not included in the blocklist (or is included in the allowlist), and the authenticity of the zero-knowledge proof is confirmed, the processing unit 110 displays a button or the like on the display unit 120 to start the service, as shown on the right side of Figure 17.

[0136] From this point onward, the processing unit 110 continues to control the UI related to the service in cooperation with the service provision unit 220 of the service server 20.

[0137] <<1.5. Variant Example>> Next, we will describe some modifications of this embodiment.

[0138] In Figures 13 and 15, the service server 20 samples a random number b, and h i =H(y i ) b An example of how to calculate this was given. On the other hand, the service server 20, similar to the example shown in Figure 10, "H ´ (y i The first m bit of the H received from user terminal 10 ´ y such that the first m bits of (x) match i " against" h i =H(y i ) b You may also calculate this.

[0139] This makes it possible to balance the trade-off between information protection and performance.

[0140] For example, if m=0, the protected information of user 15 will not be leaked to the service provider 25 at all, but performance may be reduced. Note that if the value of m is set to 1 or greater, the calculation time will be approximately halved compared to the case where m=0. m This is the result.

[0141] Therefore, the service server 20 may optimize by keeping m small (for example, m ≤ 5, etc.) when the information to be protected is highly sensitive and the list size is small, and by increasing m (for example, m ≈ 20, etc.) when the information to be protected is not highly sensitive and the list size is large.

[0142] When implementing the above control, the user terminal 10 recognizes that the signature σ has been assigned to the personal information x, h ´ In addition to the fact that it is correctly calculated from personal information x, H ´ Generate a zero-knowledge proof π that further proves that (x) is correctly calculated from personal information x.

[0143] Furthermore, although the above example illustrates a case where the list validation results are used only for services provided by service server 20, the list validation results may also be used for other services provided by other service servers 50 that are different from service server 20.

[0144] In this case, the service server 20 may issue VCs (Verifiable Credentials) indicating whether the information to be protected is included in the list or not.

[0145] Figure 18 is a sequence diagram showing the flow of using other services with VC according to this embodiment.

[0146] In the example shown in Figure 18, first, the user terminal 10, the service server 20, and the authentication device 30 cooperate to perform the list verification shown in Figure 13 or Figure 15 (S501).

[0147] Based on the results of the list verification in step S501, the service server 20 issues a VC to the user terminal 10 indicating whether the protected information is included in the allow list or not included in the block list (S502).

[0148] The user terminal 10 presents the VC issued in step S502 to the other service server 50 (S503).

[0149] Other service servers 50 verify the VC presented in step S503 (S504).

[0150] If the authenticity of the VC is confirmed in step S504, the other service server 50 provides services to the user terminal 10 (S505).

[0151] The above describes the flow of using other services with VC according to this embodiment.

[0152] Next, we will explain the application of the list verification method according to this embodiment to SSO (Single Sign-On).

[0153] SSO (Social Sign-On) is a technology that allows users to log in to other services using an account they already have for a particular service, such as a Social Networking Service (SNS).

[0154] Here, we consider a scenario where a service incorporating SSO wants to perform user verification using a blocklist maintained by the service itself, in addition to SSO authentication.

[0155] In this case, by applying the information processing method according to this embodiment, it becomes possible to confirm that user 15 has passed SSO authentication while also confirming that user 15 is not included in the blocklist without receiving any protected information.

[0156] Figure 19 is a sequence diagram showing an example of a typical SSO authentication flow.

[0157] In the example shown in Figure 19, first, the user terminal 10 sends a service request to the service server 20 (S601).

[0158] In step S601, the service server 20, having received the service usage request, sends an ID (identifier) ​​token request to the SSO server 55 (S602).

[0159] In step S602, the SSO server 55, having received the ID token request, sends a personal information provision request to the user terminal 10 (S603).

[0160] In step S603, the user terminal 10, having received a request for personal information, provides the personal information to the SSO server 55 (S604).

[0161] In step S604, the SSO server 55, having received the personal information, performs authentication based on the personal information, and if authentication is successful, generates an ID token (S605).

[0162] Next, the SSO server 55 sends the ID token generated in step S605 to the service server 20 (S606).

[0163] In step S606, the service server 20 receives the ID token and verifies it (S607).

[0164] If the service server 20 confirms the authenticity of the ID token in step S607, it provides the service to the user terminal 10 (S608).

[0165] The above describes an example of a typical SSO authentication process. Next, we will explain the processing flow when the information processing method according to this embodiment is applied to SSO.

[0166] Figure 20 is a sequence diagram showing an example of the processing flow when the information processing method according to this embodiment is applied to SSO.

[0167] In the example shown in Figure 20, first, the user terminal 10 sends a service request to the service server 20 (S701).

[0168] In step S701, the service server 20, having received the service usage request, sends an ID token request to the SSO server 55 (S702).

[0169] In step S702, the SSO server 55, having received the ID token request, sends a personal information provision request to the user terminal 10 (S703).

[0170] In step S703, the user terminal 10, having received a request for personal information, provides the personal information to the SSO server 55 (S704).

[0171] In step S604, the SSO server 55, having received the personal information, performs authentication based on the personal information. If authentication is successful, it affixes a signature to the personal information (S705). In other words, SSO performs the same processing as the authentication device 30.

[0172] Furthermore, the SSO server 55 works in cooperation with the service server 20 to perform the list verification shown in Figure 13 or Figure 15 (S706). In other words, in this example, the SSO server 55 operates as a certification device.

[0173] If, in step S706, the service server 20 confirms that the personal information is not included in the blocklist and that the authenticity of the zero-knowledge proof is recognized, it provides the service to the user terminal 10 (S707).

[0174] The above describes, with an example, the processing flow when applying the information processing method according to this embodiment to SSO.

[0175] Next, we will describe how the information processing method according to this embodiment can be applied to providing services to creators.

[0176] Creators who engage in various creative activities (user 15 being an example) sometimes use pen names or pseudonyms. Therefore, while creators may not want to reveal personal information, including what works they create, service providers 25 may want to verify whether creators have sufficient experience in their creative activities.

[0177] Therefore, by having publishers, online content sharing sites, etc., certify creators' creative activities with signatures, and then conducting list verification based on those signatures, creators can prove their achievements without disclosing their personal information.

[0178] <2. Hardware Configuration Example> Next, an example of a hardware configuration common to the user terminal 10, service server 20, authentication device 30, other service server 50, and SSO server 55 according to one embodiment of this disclosure will be described. Figure 21 is a block diagram showing an example of the hardware configuration of an information processing device 90 according to one embodiment of this disclosure. The information processing device 90 may be a device having a hardware configuration equivalent to that of the above-mentioned devices.

[0179] As shown in Figure 21, the information processing device 90 includes, for example, a processor 871, a ROM 872, a RAM 873, a host bus 874, a bridge 875, an external bus 876, an interface 877, an input device 878, an output device 879, a storage device 880, a drive 881, a connection port 882, and a communication device 883. Note that the hardware configuration shown here is just an example, and some of the components may be omitted. Furthermore, the information processing device 90 may include components other than those shown here.

[0180] (Processor 871) The processor 871 functions, for example, as an arithmetic processing unit or a control unit, and controls the overall operation or part thereof of each component based on various programs recorded in the ROM 872, RAM 873, storage 880, or removable storage medium 901.

[0181] (ROM872, RAM873) ROM872 is a means for storing programs loaded into processor 871 and data used for calculations. RAM873 temporarily or permanently stores, for example, programs loaded into processor 871 and various parameters that change as needed when executing those programs.

[0182] (Host bus 874, bridge 875, external bus 876, interface 877) The processor 871, ROM 872, and RAM 873 are interconnected, for example, via a host bus 874 capable of high-speed data transmission. On the other hand, the host bus 874 is connected to an external bus 876, which has a relatively low data transmission speed, via a bridge 875. The external bus 876 is also connected to various components via an interface 877.

[0183] (Input device 878) The input device 878 may include, for example, a mouse, keyboard, touch panel, buttons, switches, and levers. Furthermore, a remote controller (hereinafter referred to as a remote control) capable of transmitting control signals using infrared or other radio waves may also be used as the input device 878. Additionally, the input device 878 may include audio input devices such as microphones.

[0184] (Output device 879) The output device 879 is, for example, a display device such as a CRT (Cathode Ray Tube), LCD, or organic EL; an audio output device such as a speaker or headphones; a printer, mobile phone, or facsimile, or any other device capable of visually or audibly notifying the user of acquired information. Furthermore, the output device 879 according to this disclosure includes various vibration devices capable of outputting tactile stimuli.

[0185] (Storage 880) Storage 880 is a device for storing various types of data. Examples of storage 880 include magnetic storage devices such as hard disk drives (HDDs), semiconductor storage devices, optical storage devices, or magneto-optical storage devices.

[0186] (Drive 881) The drive 881 is a device that reads information recorded on a removable storage medium 901, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, or writes information to the removable storage medium 901.

[0187] (Removable storage medium 901) The removable storage medium 901 is, for example, DVD media, Blu-ray® media, HD DVD media, various semiconductor storage media, etc. Of course, the removable storage medium 901 may also be, for example, an IC card equipped with a contactless IC chip, or an electronic device, etc.

[0188] (Connection port 882) Connection port 882 is a port for connecting external devices 902, such as a USB (Universal Serial Bus) port, IEEE1394 port, SCSI (Small Computer System Interface), RS-232C port, or optical audio terminal.

[0189] (External connection device 902) External connected devices 902 include, for example, a printer, a portable music player, a digital camera, a digital video camera, or an IC recorder.

[0190] (Communication device 883) The communication device 883 is a communication device for connecting to a network, and is, for example, a communication card for wired or wireless LAN, Bluetooth®, or WUSB (Wireless USB), a router for optical communication, a router for ADSL (Asymmetric Digital Subscriber Line), or a modem for various types of communication.

[0191] <3. Summary> As described above, an information processing method according to one embodiment of the present disclosure includes a processor performing a first verification to verify whether the value obtained by further encrypting the protected information encrypted with a first random number using a second random number is included in a list encrypted using the first and second random numbers, and a second verification to verify the authenticity of a zero-knowledge proof indicating that a signature has been attached to the protected information.

[0192] The above configuration makes it possible to achieve more secure list verification.

[0193] While preferred embodiments of the present disclosure have been described in detail above with reference to the attached drawings, the technical scope of the present disclosure is not limited to such examples. It is clear to any person with ordinary skill in the art of the present disclosure that various modifications or alterations may be conceived within the scope of the technical idea set forth in the claims, and these will naturally also fall within the technical scope of the present disclosure.

[0194] Furthermore, each step of the processing described in this disclosure does not necessarily have to be processed chronologically in the order shown in the flowchart or sequence diagram. For example, each step of the processing for each device may be processed in an order different from the order described, or may be processed in parallel.

[0195] Furthermore, the series of processes performed by each device described in this disclosure may be implemented by a program stored in a non-transitory computer-readable storage medium. Each program is, for example, loaded into RAM when executed by a computer and executed by a processor such as a CPU. The storage medium is, for example, a magnetic disk, an optical disk, a magneto-optical disk, or flash memory. Alternatively, the program may be distributed without using a storage medium, for example, via a network.

[0196] Furthermore, the effects described herein are merely descriptive or illustrative and not limiting. In other words, the technology relating to this disclosure may produce other effects that are obvious to those skilled in the art from the description herein, in addition to or instead of the effects described herein.

[0197] Furthermore, the following configurations also fall within the technical scope of this disclosure. (1) The processor, A first verification is performed to verify whether the value obtained by further encrypting the protected information encrypted using a first random number using a second random number is included in the list encrypted using the first and second random numbers, A second verification is performed to verify the authenticity of the zero-knowledge proof that the signature was affixed to the aforementioned protected information, including, Information processing methods. (2) The zero-knowledge proof further demonstrates that the protected information encrypted using the first random number is a value correctly calculated from the protected information. The information processing method described in (1) above. (3) The first and second verifications are performed by a verification device. The verification device further includes receiving the protected information encrypted using the first random number and the zero-knowledge proof from the proofing device, The information processing method described in (2) above. (4) The verification device further includes encrypting the list using the second random number and transmitting the list encrypted using the second random number to the certification device. The information processing method described in (3) above. (5) The proofing device further encrypts the list encrypted using the second random number using the first random number, and transmits the list encrypted using the first and second random numbers to the verification device. The information processing method described in (4) above. (6) The proofing device further includes shuffling the order of the elements in the encrypted list using the first random number and the second random number. The information processing method described in (5) above. (7) Based on the results of the first and second verifications, a decision will be made on whether or not to provide the service. Further including, The information processing method described in any one of the above items (1) to (6). (8) The aforementioned list includes a block list, The information processing method described in any one of the above items (1) to (7). (9) The aforementioned block list includes an AML / CFT list, The information processing method described in (8) above. (10) The aforementioned protected information includes the user's personal information, The information processing method described in any one of the items (1) to (9) above. (11) If, in the first verification, it is determined that the protected information encrypted using the first random number and the second random number is not included in the list encrypted using the first random number and the second random number, and if, in the second verification, the authenticity of the zero-knowledge proof is confirmed, then the service is provided, further comprising: The information processing method described in either item (8) or (9) above. (12) The authentication device further includes assigning the signature to the protected information, The information processing method described in any one of the above items (1) to (11). (13) The further includes issuing a VC indicating that the protected information encrypted using the first random number and the second random number is included in or not included in the list encrypted using the first random number and the second random number, The information processing method described in any one of the above items (1) to (12). (14) The aforementioned certification device includes an SSO server, The information processing method described in any one of the above items (3) to (6). (15) A first verification unit verifies whether the value obtained by further encrypting the protected information encrypted using a first random number using a second random number is included in the list encrypted using the first and second random numbers, A second verification unit that verifies the authenticity of a zero-knowledge proof indicating that the signature was attached to the protected information, Equipped with, Information processing system. (16) The zero-knowledge proof further demonstrates that the protected information encrypted using the first random number is a value correctly calculated from the protected information. The information processing system described in (15) above. (17) The system further comprises a proof unit that encrypts the protected information using a first random number and generates the zero-knowledge proof, The information processing system described in (16) above. (18) The aforementioned list includes a block list, An information processing system as described in any one of the items (15) to (17) above. (19) The aforementioned block list includes an AML / CFT list, The information processing system described in (18) above. (20) The aforementioned protected information includes the user's personal information, An information processing system as described in any one of the items (15) to (19) above. [Explanation of Symbols]

[0198] 10 User terminals 110 Processing Unit 20 Service Servers 210 Processing Unit 220 Service Provision Department 30 Authentication device 310 Authentication Department 50 Other service servers 55 SSO Server 60 Personal Information 70 Blocklist < / step:1> < / step:1>

Claims

1. The processor, A first verification is performed to check whether the value obtained by further encrypting the protected information encrypted using a first random number using a second random number is included in the list encrypted using the first and second random numbers, A second verification is performed to verify the authenticity of the zero-knowledge proof that the signature was affixed to the aforementioned protected information, including, Information processing methods.

2. The zero-knowledge proof further demonstrates that the protected information encrypted using the first random number is a value correctly calculated from the protected information. The information processing method according to claim 1.

3. The first and second verifications are performed by a verification device. The verification device further includes receiving the protected information encrypted using the first random number and the zero-knowledge proof from the proofing device, The information processing method according to claim 2.

4. The verification device further includes encrypting the list using the second random number and transmitting the list encrypted using the second random number to the certification device. The information processing method according to claim 3.

5. The proofing device further encrypts the list encrypted using the second random number using the first random number, and transmits the list encrypted using the first and second random numbers to the verification device. The information processing method according to claim 4.

6. The proofing device further includes shuffling the order of the elements in the encrypted list using the first random number and the second random number. The information processing method according to claim 5.

7. Based on the results of the first and second verifications, a decision will be made on whether or not to provide the service. Further including, The information processing method according to claim 1.

8. The aforementioned list includes a block list, The information processing method according to claim 1.

9. The aforementioned block list includes an AML / CFT list. The information processing method according to claim 8.

10. The aforementioned protected information includes the user's personal information, The information processing method according to claim 1.

11. If, in the first verification, it is determined that the protected information encrypted using the first random number and the second random number is not included in the list encrypted using the first random number and the second random number, and if, in the second verification, the authenticity of the zero-knowledge proof is determined, then the service is provided. The information processing method according to claim 8.

12. The authentication device further includes assigning the signature to the protected information, The information processing method according to claim 1.

13. The further includes issuing a VC indicating that the protected information encrypted using the first random number and the second random number is included in or not included in the list encrypted using the first random number and the second random number, The information processing method according to claim 1.

14. The aforementioned certification device includes an SSO server, The information processing method according to claim 3.

15. A first verification unit verifies whether the value obtained by further encrypting the protected information encrypted using a first random number using a second random number is included in the list encrypted using the first and second random numbers, A second verification unit that verifies the authenticity of a zero-knowledge proof indicating that the signature was attached to the protected information, Equipped with, Information processing system.

16. The zero-knowledge proof further demonstrates that the protected information encrypted using the first random number is a value correctly calculated from the protected information. The information processing system according to claim 15.

17. The system further comprises a proof unit that encrypts the protected information using a first random number and generates the zero-knowledge proof, The information processing system according to claim 16.

18. The aforementioned list includes a block list, The information processing system according to claim 15.

19. The aforementioned block list includes an AML / CFT list. The information processing system according to claim 18.

20. The aforementioned protected information includes the user's personal information, The information processing system according to claim 15.

Images