PROGRAM, INFORMATION PROCESSING APPARATUS, AND INFORMATION PROCESSING METHOD

Abstract

To provide a program, an information processing device, and an information processing method for implementing a wallet that allows stored information to be used regardless of the state of communication connection while ensuring the authenticity of the stored information.SOLUTION: A program causes a computer to implement a certification object acquisition function of acquiring certification object information, which is authority information for exercising the authority that a user has or the user's identity confirmation information, an issuing function of issuing an electronic certificate, which is the electronic certificate of the certification object information and can be used offline, a first determination function of determining determination conditions for determining the validity of the electronic certificate by a user device based on the certification object information, and a transmitting function of transmitting the electronic certificate and determination condition information indicating the determination conditions to the user device in an online state.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a program, an information processing device, and an information processing method. [Background technology]

[0002] Conventionally, wallet technology (hereinafter simply referred to as "wallet") that stores authority information indicating the authority held by a user, such as account information for a specified payment method, or user identity verification information is known (for example, Patent Document 1 below). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2020 / 202311 Summary of the Invention [Problem to be solved by the invention]

[0004] There is a demand for the information stored in a wallet to be available regardless of the state of communication connection while ensuring the authenticity of the information. However, a wallet that stores information in an online environment must be online to be used. On the other hand, for a wallet that can be used offline, it is difficult to continuously ensure the authenticity of the stored information, since it is difficult to update the information used to prove the authenticity of the stored information, i.e., the digital certificate.

[0005] Therefore, in order to solve the above problems, the present invention aims to provide a program, an information processing device, and an information processing method for realizing a wallet that allows the stored information to be used regardless of the state of the communication connection while ensuring the authenticity of the stored information. [Means for solving the problem]

[0006] A program according to one embodiment of the present invention causes a computer to implement the following: a certification subject acquisition function for acquiring certification subject information, which is authority information for exercising the authority a user has or user identity verification information; an issuance function for issuing an electronic certificate for the certification subject information that can be used in an offline state; a first determination function for determining judgment conditions for judging the validity of the electronic certificate by a user device based on the certification subject information; and a transmission function for transmitting the electronic certificate and judgment condition information indicating the judgment conditions to a user device that is online.

[0007] An information processing device according to one embodiment of the present invention includes a certification subject acquisition unit that acquires certification subject information, which is authority information for exercising the authority a user has or user identity verification information, an issuing unit that issues an electronic certificate for the certification subject information, which is usable in an offline state, a first determination unit that determines a judgment condition for determining the validity of the electronic certificate by a user device based on the certification subject information, and a transmitting unit that transmits the electronic certificate and judgment condition information indicating the judgment condition to a user device in an online state.

[0008] An information processing method according to one embodiment of the present invention involves a computer acquiring certification subject information, which is authority information for exercising the authority a user has or identity verification information for the user, issuing an electronic certificate for the certification subject information that can be used in an offline state, determining judgment conditions for judging the validity of the electronic certificate by a user device based on the certification subject information, and transmitting the electronic certificate and judgment condition information indicating the judgment conditions to a user device that is online. Effect of the Invention

[0009] According to the present invention, it is possible to realize a wallet that ensures the authenticity of the stored information and allows the stored information to be used regardless of the state of communication connection. [Brief description of the drawings]

[0010] [Figure 1]FIG. 2 is a diagram for explaining an example of the system configuration of a wallet system according to the present embodiment. [Diagram 2] FIG. 1 is a diagram for explaining an example of an overview of a wallet system according to an embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram for explaining an example of an overview of a wallet system according to an embodiment of the present invention. [Figure 4] FIG. 1 is a diagram for explaining an example of an overview of a wallet system according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a server device according to the present embodiment. [Figure 6] FIG. 4 is a diagram illustrating an example of the operation of the server device according to the embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a hardware configuration of a server device and a user device according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] A preferred embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described with reference to the accompanying drawings. In each drawing, the same reference numerals denote the same or similar configurations.

[0012] In the present invention, "part", "means", "apparatus" or "system" does not simply mean physical means, but also includes cases where the functions of the "part", "means", "apparatus" or "system" are realized by software. In addition, the functions of one "part", "means", "apparatus" or "system" may be realized by a combination of two or more physical means, devices or software modules, and the functions of two or more "parts", "means", "apparatus" or "systems" may be realized by one physical means, device or software module.

[0013] <1. System configuration>

[0014] An example of the system configuration of a wallet system 1 according to this embodiment will be described with reference to FIG.

[0015] The wallet system 1 is a system for realizing secure use of authority information of a user's authority or personal identification information, independent of the state of communication connection. Specifically, the wallet system 1 stores the user's account information or the user's personal identification information (hereinafter collectively referred to as "certification target information") using wallet technology (hereinafter simply referred to as "wallet"). The wallet system 1 uses electronic certificate technology to ensure the authenticity of the certification target information stored in the wallet, while allowing the certification target information and its electronic certificate to be used even when the user device 200 of the user is offline.

[0016] The authority information may be, for example, (a) account information for using services provided by a service provider, (b) token information (e.g., a digital ticket) indicating authority to receive various services, or (c) license information indicating permission to use various services.

[0017] The account information is information about an account held by a user. This account includes, for example, a right to use a service (a so-called user account) or a financial account in the user's name. The account information includes, for example, identification information for identifying a user or an account (e.g., a user ID or an account number) and / or authentication information associated with this identification information (e.g., a password or a security code).

[0018] For example, if the user is a corporation, the identity verification information may be the corporation's registration information and / or the corporation information registered in the public institution device of another public institution. For example, if the user is an individual, the identity verification information may be personal information for verifying the individual's identity, image information such as a driver's license or My Number card, and / or the user's biometric information. Possible user personal information includes, for example, the user's name, date of birth, sex, address, telephone number, and / or individual number.

[0019] A digital certificate is a certificate that electronically certifies that the information to be certified is genuine by the person concerned or a trusted third party (for example, a certification authority described later). In other words, a digital certificate may be a certificate that electronically certifies that the information to be certified has a certain degree of authenticity. This authenticity may, for example, indicate that the information has been issued by a legitimate authority. Furthermore, the authenticity may, for example, indicate that false input, rewriting, erasure, and confusion have been prevented, and further, may indicate that the responsibility for issuance is clearly located from the perspective of a third party. A digital certificate may be, for example, a certificate in accordance with the format of the X.509 standard, and may include an issuer or a person in charge of issuance, a subject (for example, a user, an operator of the server device 100, or a certification authority), a public key of the subject, an expiration date of the digital certificate, a digital signature of the issuer or a person in charge of issuance, and the like. This digital signature may, for example, be at least a part of the information to be certified that has been encrypted by a private key that is paired with the public key of the subject.

[0020] As shown in Fig. 1, the wallet system 1 includes a server device 100, a user device 200 used by a user, a first service providing device 300a used by a first service provider, and a second service providing device 300b used by a second service provider. The first service provider and the second service provider are also collectively referred to as "service providers" unless there is a particular need to distinguish between them. Furthermore, the first service providing device 300a and the second service providing device 300b are also collectively referred to as "service providing device 300" unless there is a particular need to distinguish between them.

[0021] [Server device]

[0022] The server device 100 is an information processing device capable of communicating with the user device 200, the service providing device 300, and the external system 400 via the first network N1. The server device 100 issues an electronic certificate by executing a predetermined program (hereinafter also referred to as a "server program"), and provides the issued electronic certificate to a wallet application (described below) installed in the user device 200. The server device 100 may also provide the user with a wallet function (hereinafter also referred to as an "online wallet") that stores the issued electronic certificate and makes it available in an online state.

[0023] [User device]

[0024] The user device 200 is an information processing device used by a user, and is, for example, a terminal device such as a smartphone or a laptop. When the user device 200 is online, it can be communicatively connected to the server device 100 via the first network N1. When the user device 200 is online, it can be communicatively connected to the service providing device 300 via the first network N1, and when offline, it can be communicatively connected to the service providing device 300 via the second network N2. That is, the online state refers to a state in which communication connection with the first network N1 is possible, and the offline state refers to a state in which communication connection with the first network N1 is impossible. The user device 200 may be any device that can communicate with these devices and has an input / output function for a user, and may be, for example, a drone, a vehicle, an in-vehicle device, a home appliance, or a wearable device. By executing a specific program (hereinafter also referred to as the "user program"), user device 200 connects to server device 100 and transmits and receives the certification subject information and electronic certificate themselves, or information related to these, displays this information to the user on a screen, and accepts requests for certification subject information or electronic certificates from users.

[0025] The user program may be, for example, an application program (hereinafter also referred to as a "wallet application") dedicated to the wallet system 1 installed in the user device 200, or a Web browser that is provided as standard in the user device 200, which is a general-purpose terminal device, or a combination thereof. In this embodiment, an example will be described in which the user program is a wallet application. This wallet application provides the user with a wallet function (hereinafter also referred to as a "local wallet") that allows stored information and electronic certificates to be used even in an offline state.

[0026] [network]

[0027] The first network N1 is a wide area communication network, and includes the Internet, a mobile communication network, and a telephone line. The first network N1 may use a wireless communication method using, for example, 3G (3rd Generation), 4G (4th Generation), 5G (5th Generation), or LTE (Long Term Evolution) lines.

[0028] The second network N2 is a communication network for directly connecting the user device 200 and the service providing device 300. The second network N2 includes a network that realizes short-distance wireless communication of about 10 cm using electromagnetic induction such as NFC (Near Field Communication), and short-distance wireless communication of about 10 m such as Bluetooth (registered trademark) and infrared communication.

[0029] [Service providing device]

[0030] The service providing device 300 is an information processing device used by a service provider, so-called SP (Service Provider). In this embodiment, an example will be described in which the first service provider provides a community service in a virtual space, so-called metaverse service, and the second service provider provides an event service in a real space. The first service providing device 300a is a display device installed in a store and outputs the virtual space in the metaverse service. The second service providing device 300b is a gate device that physically controls the entrance and exit of an event held in the real space.

[0031] [External System]

[0032] The external system 400 may be, for example, a public authority system, a certificate authority system, a transaction system, and / or a payment system (including a credit card system or a banking system, etc.) as described above.

[0033] The certification authority system is a system of a certification authority. The certification authority may be a public or private authority, and may be, for example, a TTP (Trusted Third Party) or a certification authority (CA) as a trusted third party. The certification authority may also be, for example, an IdP (Identity Provider (provider of authentication information in SAML authentication)). The certification authority system acquires a request for issuance of an electronic certificate from the server device 100, issues an electronic certificate, and provides the issued electronic certificate to the server device 100.

[0034] A trading system is a system for conducting transactions between users. For example, a trading system mediates or manages transactions between users and product sellers or service providers. For example, a trading system is a system that uses EC (Electronic Commerce), and may be, for example, a system that operates an EC site for selling products.

[0035] <2. Overview>

[0036] An example of an outline of the wallet system 1 will be described with reference to FIGS.

[0037] <2-1. Issuance of electronic certificate>

[0038] First, an example of a process for issuing a digital certificate in the wallet system 1 will be described with reference to Fig. 2. In this example, it is assumed that the user device 200 is in an online state.

[0039] (0) As shown in Fig. 2, the certification subject acquisition unit 111a of the server device 100 acquires certification subject information, which is user authority information and / or identity verification information, from the external system 400. The certification subject acquisition unit 111a may also acquire consent information indicating consent from the user to the acquisition of the certification subject information and its subsequent storage and use in the online wallet and local wallet. The certification subject acquisition unit 111a stores the acquired certification subject information and consent information in the certification subject storage unit 131 for registration in the online wallet.

[0040] (1) The user launches the wallet application of user device 200 to log in, i.e., authenticates the user's account in wallet system 1. (2) If the login is successful, the wallet application of user device 200 requests server device 100 to issue an electronic certificate for the acquired certification subject information. Acquisition unit 111 of server device 100 acquires this issuance request. (3) Based on the acquired issuance request, issuing unit 112 of server device 100 issues an electronic certificate for the certification subject information registered in the online wallet, which is an electronic certificate that can be used in an offline state. Issuance unit 112 stores this issued electronic certificate in certificate storage unit 133 in association with the certification subject information, in order to register the electronic certificate in the online wallet in association with the certification subject information.

[0041] (4a) The usage history acquiring unit 111b of the server device 100 acquires usage history information from the user device 200. The usage history information may be, for example, information indicating at least one of the user's usage history of the user device 200 and the usage history of a wallet function that stores certification target information and an electronic certificate in the user device 200, i.e., a local wallet. (4b) The transaction history acquiring unit 111d of the server device 100 acquires transaction history information indicating the user's transaction history from an external system 400 (e.g., a transaction system, etc.). The transaction history information may be, for example, information indicating the history of transactions between users in a virtual space provided by the first service providing device 300a.

[0042] (5) Based on the above acquired certification subject information, usage history information, and transaction history information, the first determination unit 113a of the server device 100 determines determination conditions for determining the validity of the electronic certificate in the user device 200. In addition, the second determination unit 113b of the server device 100 determines permission conditions for permitting the user device 200 to update the validity of the electronic certificate, based on the certification subject information.

[0043] (6) The granting unit 112a of the server device 100 grants validity points to the issued electronic certificate, which decrease over time. The granting unit 112a stores the granted validity points as validity information indicating the validity of the electronic certificate in the validity storage unit 134. The validity information may be, for example, information indicating the expiration date of the electronic certificate or the validity points of the electronic certificate.

[0044] (7) The transmission unit 121 of the server device 100 transmits the electronic certificate, the judgment condition information indicating the determined judgment condition, and the permission condition information indicating the determined permission condition to the wallet application of the user device 200. The transmission unit 121 may also transmit the certification target information to the wallet application. Upon receiving this information, the wallet application of the user device 200 stores the information in a user storage unit (not shown) of the user device 200 in association with each other in order to register the information in the local wallet.

[0045] <2-2. Updating the validity of electronic certificates>

[0046] Next, an example of a process for updating the validity of an electronic certificate in the wallet system 1 will be described with reference to Fig. 3. In this example, it is assumed that the user device 200 is in an online state.

[0047] (0) As shown in Fig. 2, the usage history acquiring unit 111b of the server device 100 acquires the latest usage history information from the user device 200 in a cyclic or event-driven manner. Also, the transaction history acquiring unit 111d of the server device 100 acquires the latest transaction history information from the external system 400 in a cyclic or event-driven manner.

[0048] (1) The user starts the wallet application of the user device 200 and logs in, that is, authenticates the user's account in the wallet system 1. (2) If the login is successful, the wallet application of the user device 200 judges whether the electronic certificate is valid or not based on the judgment condition information and the validity information. (3) If the wallet application judges that the electronic certificate is invalid, it requests the server device 100 to update the validity of the electronic certificate. The acquisition unit 111 of the server device 100 acquires this update request. (4) In response to this update request, the detection unit 114 of the server device 100 detects unauthorized use of at least one of the user device 200 and the wallet function in the user device 200, that is, the local wallet, based on the latest usage history information acquired above. (5) If unauthorized use is not detected by the detection unit 114, the update unit 112b of the server device 100 updates the validity as requested. Specifically, the update unit 112b extends the expiration date or adds validity points.

[0049] (6) The transmitter 121 of the server device 100 transmits validity information reflecting the updated validity to the user device 200, and transmits an instruction to update the validity of the electronic certificate stored in the local wallet. (7) The wallet application of the user device 200 updates the validity of the electronic certificate based on the transmitted validity information.

[0050] <2-3. Use of authority information and electronic certificates>

[0051] Next, an example of a process of using authority information and an electronic certificate in the wallet system 1 will be described with reference to Fig. 4. In this example, it is assumed that the user device 200 is in an offline state. Also, in this example, an example of the use of authority information and an electronic certificate when a user uses a metaverse service provided by a first service provider will be described.

[0052] (1) As shown in FIG. 4, when using the metaverse service provided by the first service providing device 300a, the wallet application of the user device 200 judges whether the electronic certificate is valid based on the judgment condition information and the validity information. (2) In order to use the metaverse service provided by the first service providing device 300a, the user device 200 requests login to the metaverse service including the account information of the metaverse service and the electronic certificate. (3) The first service providing device 300a executes account authentication of the user in the metaverse service based on the account information and the electronic certificate. (4) If the account authentication is successful, that is, if the login is successful, the first service providing device 300a may verify whether the electronic signature included in the electronic certificate can be decrypted by the public key included in the electronic certificate to verify whether the electronic certificate is valid. (5) If the result of this verification indicates that the electronic certificate is valid, the first service providing device 300a provides the metaverse service to the first user. (6) The first service providing device 300a may request the server device 100 to inquire about the public key included in the acquired electronic certificate. The acquisition unit 111 of the server device 100 acquires this query request. (7) The verification unit 115 of the server device 100 verifies whether the public key of the queried electronic certificate is valid based on the query request. (8) The transmission unit 121 of the server device 100 transmits the result of the query to the first service providing device 300a.

[0053] With the above configuration, the wallet system 1 issues an electronic certificate to be certified in the server device 100, and can provide a judgment condition for judging the validity of the electronic certificate to the local wallet of the user device 200. Even in an offline state, the local wallet of the user device 200 can confirm the validity of the electronic certificate using the judgment condition, and then use the electronic certificate for a service provided by a service provider. Therefore, the wallet system 1 realizes a wallet that can ensure the authenticity of the stored certification target information, and allows the stored certification target information to be used regardless of the state of communication connection.

[0054] <3. Functional configuration>

[0055] <3-1. Functional configuration of server device>

[0056] The functional configuration of the server device 100 according to the present embodiment will be described with reference to Fig. 5. As shown in Fig. 5, the server device 100 includes a control unit 110, a communication unit 120, and a storage unit .

[0057] The control unit 110 includes an acquisition unit 111, an issuing unit 112, and a determination unit 113. The control unit 110 may also include a detection unit 114 and / or a verification unit 115, for example.

[0058] [Acquisition Department]

[0059] The acquisition unit 111 acquires various requests and / or various information from the user device 200, the service providing device 300, or the external system 400.

[0060] The acquisition unit 111 includes a certification subject acquisition unit 111a. The certification subject acquisition unit 111a acquires, from the user device 200 or the external system 400, authority information for exercising the authority held by the user or certification subject information which is identity verification information of the user.

[0061] The acquiring unit 111 may include, for example, a usage history acquiring unit 111b. The usage history acquiring unit 111b acquires usage history information from the user device 200.

[0062] The usage history of user device 200 indicated by the usage history information may be, for example, a history of user account authentication for logging in to user device 200 during a predetermined period. Furthermore, the usage history indicated by the usage history information may be a history of user account authentication for logging in to a wallet function (local wallet) in user device 200. The account authentication history may indicate, for example, the total number of authentication failures during a predetermined period, or the maximum number of consecutive authentication failures during a predetermined period.

[0063] The usage history information may be, for example, information indicating the usage history of a service provided by a service provider. Specifically, the usage history information may be a history of user account authentication in a meta service or an event service during a predetermined period of time.

[0064] The acquisition unit 111 may include, for example, a reliability acquisition unit 111c. The reliability acquisition unit 111c acquires reliability information indicating an evaluation of the reliability of a user. The reliability information may indicate the reliability of a user evaluated by the control unit 110 according to, for example, usage history information and / or transaction history information.

[0065] The acquiring unit 111 may include, for example, a transaction record acquiring unit 111d. The transaction record acquiring unit 111d acquires, from the service providing device 300 or the external system 400, transaction record information indicating the transaction record of the user.

[0066] [Publishing Department]

[0067] The issuing unit 112 issues an electronic certificate for the certification target information that can be used in an offline state. The issuing unit 112 may also set an expiration date for the issued electronic certificate, for example. The issuing unit 112 may set the expiration date of the electronic certificate, for example, based on the type of certification target information, trust information, and / or usage history information. The type of this certification target information may be classified, for example, into authority information or identity verification information, and if the certification target information is authority information, it may be further classified into any of the above information (A) to (C).

[0068] As another example, the issuing unit 112 may request the certification authority system to issue a digital certificate for the certification target information, without issuing a digital certificate by itself. The issuing unit 112 may obtain, for example, from the certification authority system, a digital certificate issued by the certification authority system as a response to the issuance request.

[0069] The issuing unit 112 may include an assigning unit 112a. When an electronic certificate is issued, the assigning unit 112a assigns validity points to the electronic certificate, which points decrease over time. The validity points indicate the degree of validity of the electronic certificate. For example, the validity points reach a maximum value when the electronic certificate is issued, and thereafter decrease (decrement) over time. The rate at which the validity points decrease (for example, the number of points decreased per unit period (for example, one day)) may be determined according to the type of certification target. The electronic certificate may be invalidated when the validity points reach 0 points.

[0070] The granting unit 112a may additionally grant validity points depending on, for example, a history of successful authentication of a user's account on the user device 200.

[0071] [Decision section]

[0072] The determination unit 113 determines various conditions for the user device 200 to autonomously control the validity of the digital certificate.

[0073] The determination unit 113 includes a first determination unit 113a. The first determination unit 113a determines a determination condition for the user device 200 to determine the validity of the electronic certificate based on the certification target information. The determination condition may include, for example, that the validity points granted by the granting unit 112a are equal to or greater than a threshold value. With this configuration, the freshness of the information in the electronic certificate can be estimated using the validity points that decrease over time. Therefore, the user device 200 can determine the validity of the electronic certificate based on the validity points, taking into account the freshness of the information in the electronic certificate.

[0074] The first determination unit 113a may determine the judgment condition based on, for example, the usage history information acquired by the usage history acquisition unit 111b. For example, the first determination unit 113a may set the standard (default) judgment condition to "20 or more validity points out of 100 points" and, if the total number of account authentication failures at the time of logging in to the user device 200 exceeds a threshold, change the judgment condition from the standard to "50 or more validity points out of 100 points."

[0075] According to the above configuration, first determination unit 113a can determine the validity of an electronic certificate based on the user's usage history of user device 200 and the usage history of the local wallet in user device 200.

[0076] For example, the first determination unit 113a may determine the determination condition based on the reliability information acquired by the reliability acquisition unit 111c. With this configuration, the user device 200 can autonomously determine the validity of the electronic certificate based on the reliability of the user.

[0077] The first determination unit 113a may determine the determination condition based on, for example, the transaction history information acquired by the transaction history acquisition unit 111d. With this configuration, the user device 200 can autonomously determine the validity of the electronic certificate based on the transaction history of the user.

[0078] The first determination unit 113a may determine a judgment condition for each service provided by one or more service providers. For example, the first determination unit 113a may determine the judgment condition for a metaverse service provided by a first service provider as "effectiveness points are 90 or more out of 100 points," while the first determination unit 113a may determine the judgment condition for an event service provided by a second service provider as "effectiveness points are 70 or more out of 100 points." With this configuration, it is possible to determine the judgment condition according to the characteristics of each of one or more services.

[0079] The determination unit 113 includes a second determination unit 113b. The second determination unit 113b determines a permission condition for permitting the update of validity in the user device 200 based on the certification target information. The permission condition may include successful authentication of the user in the user device 200 (e.g., successful account authentication of the user when logging in to the user device 200). For example, the second determination unit 113b may determine that the standard (default) is no permission condition, and that the account authentication when logging in to the user device 200 or the local wallet is successful when the certification target information is identity verification information. On the other hand, the second determination unit 113b may determine that the standard is unchanged when the certification target information is, for example, token information as in (a). With this configuration, it is possible to determine the permission condition according to the characteristics of the certification target information (e.g., whether or not the information is changed relatively frequently). Furthermore, with this configuration, it is possible to permit the update of validity on the basis that the user authentication in the user device 200 is successful. Therefore, it is possible to permit the update of validity even in an offline state.

[0080] [Detection section]

[0081] The detection unit 114 detects unauthorized use of at least one of the user device 200 and the wallet function (local wallet) in the user device 200 based on the usage history information.

[0082] [Verification Department]

[0083] Based on a request from the service providing device 300 to refer to an electronic certificate, the verification unit 115 verifies the referred electronic certificate (specifically, whether or not the public key included in the electronic certificate is valid, etc.).

[0084] [Communications Department]

[0085] The communication unit 120 transmits and receives various types of information to and from the user device 200, the service providing device 300, or the external system 400 via the first network N1 or the second network N2. The communication unit 120 includes a receiving unit 122. The receiving unit 122 receives various requests and / or various types of information from the user device 200, the service providing device 300, or the external system 400.

[0086] The communication unit 120 includes a transmission unit 121. The transmission unit 121 transmits an electronic certificate and determination condition information indicating the determination condition determined by the first determination unit 113a to the online user device 200. The transmission unit 121 transmits permission condition information indicating the permission condition determined by the second determination unit 113b to the user device 200.

[0087] According to the above configuration, the transmission unit 121 can provide the user device 200 with the electronic certificate of the certification subject information issued by the server device 100 and the judgment conditions for judging the validity of the electronic certificate. Therefore, even when the user device 200 is offline, the user device 200 can use the electronic certificate after confirming the validity of the electronic certificate using the judgment conditions. Therefore, the authenticity of the stored certification subject information can be ensured, and the stored certification subject information can be used regardless of the state of the communication connection.

[0088] When unauthorized use is detected by detection unit 114, transmission unit 121 may transmit an instruction to user device 200 to delete the corresponding electronic certificate or to update the validity of the electronic certificate. With this configuration, when unauthorized use of user device 200 or a local wallet occurs, it becomes possible to take measures such as deleting or substantially invalidating the electronic certificate.

[0089] [Storage]

[0090] The memory unit 130 includes a certification subject memory unit 131, a track record memory unit 132, a certificate memory unit 133, and a validity memory unit 134. The certification subject memory unit 131 stores certification subject information. The track record memory unit 132 stores usage track record information and transaction track record information. The certificate memory unit 133 stores electronic certificates. The validity memory unit 134 stores validity information.

[0091] <4. Example of operation>

[0092] An example of the operation of the server device 100 will be described with reference to Fig. 6. As shown in Fig. 6, the certification subject acquisition unit 111a of the server device 100 acquires certification subject information (S10). The issuing unit 112 of the server device 100 issues an electronic certificate for the certification subject information (S11). The first determining unit 113a of the server device 100 determines judgment conditions for the electronic certificate (S12). The transmitting unit 121 of the server device 100 transmits the electronic certificate and judgment condition information to the user device 200 (S13).

[0093] <5. Hardware configuration>

[0094] 7, an example of a hardware configuration in which the above-mentioned server device 100 and user device 200 are realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into multiple devices.

[0095] As shown in FIG. 7, a computer 800 includes a processor 801, a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811, and a display device 813.

[0096] The processor 801 executes programs stored in the memory 803 to control various processes in the computer 800. For example, each functional unit of the control unit 110 of the server device 100 and a control unit (not shown) of the user device 200 can be realized as a program that is temporarily stored in the memory 803 and operates mainly on the processor 801.

[0097] The memory 803 is a storage medium such as a RAM (Random Access Memory), etc. The memory 803 temporarily stores the program code of the program executed by the processor 801 and data required when the program is executed.

[0098] The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system and various programs for implementing the above-mentioned configurations. In addition, the storage device 805 can also store tables for registering certification subject information, electronic certificates, judgment condition information, and the like, and a DB for managing the tables. Such programs and data are loaded into the memory 803 as necessary, and are referred to by the processor 801.

[0099] The input I / F unit 807 is a device for receiving input from a user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, and a wearable device. The input I / F unit 807 may be connected to the computer 800 via an interface such as a Universal Serial Bus (USB).

[0100] The data I / F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I / F unit 809 is a drive device for reading data stored in various storage media. The data I / F unit 809 may be provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as a USB.

[0101] The communication I / F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with an external device of the computer 800. The communication I / F unit 811 may be provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as a USB.

[0102] The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, and a display of a wearable device. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. In addition, when a touch panel is adopted as the input I / F unit 807, the display device 813 can be configured integrally with the input I / F unit 807.

[0103] The above-mentioned embodiment is an example for explaining the present invention, and is not intended to limit the present invention to the embodiment. In addition, the present invention can be modified in various ways without departing from the gist of the present invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent, and such an embodiment is also included in the scope of the present invention.

[0104] The components of the server device 100 and the user device 200 described in the above embodiment are assumed to realize a predetermined process in cooperation with other hardware by the processor 801 executing a program stored in the storage device 805. In other words, these components are assumed to be software or firmware, and also corresponding hardware, and in both concepts, they are also described as "functions," "means," "parts," "processing circuits," "units," or "modules," and can be interpreted as each of these.

[0105] [Variations]

[0106] Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[0107] [Variation 1]

[0108] Some or all of the functional units included in the control unit 110 of the server device 100 according to the above embodiment may be provided in the user device 200. For example, at least some of the functions of the issuing unit and / or determining unit of the server device 100 may be implemented in a wallet application of the user device 200. [Explanation of symbols]

[0109] 1...wallet system, 100...server device, 110...control unit, 111a...certification subject acquisition unit, 112...issuing unit, 113...determination unit, 113a...first determination unit, 114...detection unit, 115...verification unit, 120...communication unit, 130...storage unit, 200...user device, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I / F unit, 809...data I / F unit, 811...communication I / F unit, 813...display unit.

Claims

1. On the computer, a certification subject acquisition function for acquiring authority information for exercising the authority held by the user or certification subject information which is the user's identity verification information; an issuing function for issuing a digital certificate for the certification subject information that can be used in an offline state; a usage history acquisition function that acquires, from a user device, usage history information indicating at least one of a usage history of the user device and a usage history of a wallet function that stores the certification object information and the electronic certificate in the user device; a first determination function that determines a determination condition for determining the validity of the electronic certificate on the user device of the user based on the certification subject information; a transmission function of transmitting the electronic certificate and judgment condition information indicating the judgment condition to the user device in an online state; The usage history of the user device is a history of account authentication of the user for logging in to the user device, the wallet function usage record is a history of account authentication of the user for logging in to the wallet function, The first determination function determines the judgment condition based on the usage history information. program.

2. The issuing function issues an electronic certificate for the certification target information that can be used to receive one or more services in an offline state; The first determination function determines the judgment condition according to characteristics of the one or more services for each of the one or more services based on the usage history information. The program according to claim 1.

3. a function of assigning validity points to the electronic certificate when the electronic certificate is issued, the validity points decreasing over time, The determination condition includes that the validity points are equal to or greater than a threshold value.

3. The program according to claim 1 or 2.

4. causing the computer to realize a second determination function for determining an authorization condition for authorizing the update of the validity in the user device based on the certification subject information; The transmission function transmits permission condition information indicating the permission condition to the user device.

3. The program according to claim 1 or 2.

5. the authorization condition includes successful authentication of the user at the user device; The program according to claim 4.

6. The computer further realizes a trust acquisition function of acquiring trust information indicating an evaluation of the reliability of the user, The first determination function determines the judgment condition based on the reliability information.

3. The program according to claim 1 or 2.

7. The computer further realizes a transaction history acquisition function for acquiring transaction history information indicating the transaction history of the user, The first determination function determines the judgment condition based on the transaction performance information.

3. The program according to claim 1 or 2.

8. further realizing a detection function of detecting unauthorized use of at least one of the user device and the wallet function based on the usage history information in the computer; the transmission function, when the unauthorized use is detected, transmits to the user device an instruction to delete the electronic certificate or to update the validity of the electronic certificate.

3. The program according to claim 1 or 2.

9. a certification subject acquisition unit that acquires authority information for exercising the authority held by a user or certification subject information which is user identity verification information; an issuing unit that issues a digital certificate for the certification target information that can be used in an offline state; a usage history acquiring unit that acquires, from a user device, usage history information indicating at least one of a usage history of the user device and a usage history of a wallet function that stores the certification subject information and the electronic certificate in the user device; a first determination unit that determines a determination condition for determining the validity of the electronic certificate on the user device of the user based on the certification subject information; a transmission unit that transmits the electronic certificate and judgment condition information indicating the judgment condition to the user device in an online state, The usage history of the user device is a history of account authentication of the user for logging in to the user device, the wallet function usage record is a history of account authentication of the user for logging in to the wallet function, The first determination unit determines the judgment condition based on the usage history information. Information processing device.

10. The computer Obtain authority information for exercising the authority held by the user, or certification subject information which is the user's identity verification information; issuing a digital certificate for the certification subject information that can be used in an offline state; acquiring, from a user device, usage history information indicating at least one of a usage history of the user device and a usage history of a wallet function in the user device that stores the certification subject information and the electronic certificate; determining a judgment condition for judging the validity of the electronic certificate on the user device of the user based on the certification subject information; Transmitting the electronic certificate and judgment condition information indicating the judgment condition to the user device in an online state; The usage history of the user device is a history of account authentication of the user for logging in to the user device, the wallet function usage record is a history of account authentication of the user for logging in to the wallet function, The determination includes determining the judgment condition based on the usage history information. Information processing methods.

Images