Data management system and information processing method using confidential data

Abstract

To make it possible to suppress security risks and enable safe and easy integration with external services.SOLUTION: A data management system has a function for managing a database for storing concealed data encrypted on the basis of a probabilistic encryption method using a user private key, connecting with a client terminal and a service provision system, and generating a trust region in a storage device. Upon receipt of a request from the client terminal indicating utilization of a service using the concealed data, the data management system acquires the concealed data from the database, stores the concealed data in the trust region, decrypts the acquired concealed data, uses the decrypted concealed data to generate, in the trust region, transmission data to be transmitted to the service provision system in order to utilize the service, encrypts the transmission data, in the trust region, to a format that can be decrypted by the service provision system, and transmits the encrypted transmission data to the service provision system.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a system and an information processing method for executing processing while confidential information such as personal information is kept secret. [Background technology]

[0002] In December 2016, the Basic Act on the Promotion of Public and Private Data Utilization was promulgated and put into effect, promoting the appropriate use of public and private data related to individuals by various entities. In May 2017, the revised Act on the Protection of Personal Information came into effect, establishing provisions for anonymously processed information and sensitive personal information, and establishing a foundation for the protection and use of personal data, which is accelerating the use of personal data. However, security incidents such as leaks of personal data are increasing year by year, and consumer concerns regarding the use of data are growing.

[0003] Against this background, technologies have been developed that place emphasis on preventing leakage of personal data. For example, Patent Document 1 describes a technology for managing data using searchable encryption technology. The technology described in Patent Document 1 prevents information leakage to server administrators, allows the DB server to search data without decryption, and enables the user's terminal to decrypt the search results. In this case, search / decryption is possible only from the user's terminal that has the key (hereinafter referred to as the user private key).

[0004] The technology described above is highly effective in terms of protecting personal information because it allows the user's private key for search / decryption to be managed separately from the confidential information. For example, if the key and confidential information are stored on the same server, a malicious third party may gain unauthorized access to both the key and the confidential information, potentially allowing the encrypted data to be decrypted.

[0005] By separating the user private key and the confidential information, server administrators and businesses that provide systems utilizing Patent Document 1 (hereinafter referred to as service providers) can provide a variety of systems without seeing the confidential information managed by users who use the systems utilizing Patent Document 1. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-123614 [Patent Document 2] Japanese Patent Application Publication No. 2018-097034 Summary of the Invention [Problem to be solved by the invention]

[0007] The system using Patent Document 1 has a problem in that it is difficult to link with external services, because linking with external services requires decrypted confidential information.

[0008] One possible way to achieve this is for the external service to hold the user's private key for decrypting the confidential information. However, providing the user's private key to all external services used by the user would impose a heavy burden on the service provider and the external service provider and would also lead to a decrease in security. Therefore, this method is not suitable for practical use.

[0009] Another possible method is to store the user's private key on a server that manages confidential information, and the server decrypts the confidential information and transmits it to an external service. However, this method poses a significant security risk because the key and confidential information are not stored separately, significantly reducing the effectiveness of the technology in Patent Document 1.

[0010] The present invention aims to provide a system that reduces security risks and enables safe and easy collaboration with external services. [Means for solving the problem]

[0011] A representative example of the invention disclosed in the present application is as follows: That is, a data management system includes at least one computer having an arithmetic unit and a storage device, manages a first database storing secret data encrypted based on a probabilistic encryption scheme using a user private key, and is connected to a client terminal that registers the secret data in the data management system and a service providing system that provides any service, the arithmetic unit has a function for generating a secure and logically isolated trust area in the storage device, when the data management system receives a request from the client terminal instructing use of the service using the secret data, acquires at least one of the secret data from the first database and stores it in the trust area, decrypts the acquired secret data in the trust area, uses the decrypted secret data to generate first transmission data to be transmitted to the service providing system for using the service, encrypts the first transmission data in the trust area into a format decodable by the service providing system, and transmits the encrypted first transmission data to the service providing system. [Effects of the Invention]

[0012] According to one aspect of the present invention, it is possible to suppress security risks and realize safe and easy collaboration with external services. Problems, configurations, and effects other than those described above will become clear from the following description of the embodiment. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a computer system according to a first embodiment. [Figure 2] FIG. 2 illustrates an example of a hardware configuration of a client terminal according to the first embodiment. [Figure 3] FIG. 2 illustrates an example of a hardware configuration of a data management server according to the first embodiment. [Figure 4] FIG. 2 illustrates an example of a functional configuration of a client terminal according to the first embodiment. [Figure 5]FIG. 2 illustrates an example of a functional configuration of a data management server according to the first embodiment. [Figure 6A] 10 is a sequence illustrating an example of a flow of processing executed in the computer system of the first embodiment. [Figure 6B] 10 is a sequence illustrating an example of a flow of processing executed in the computer system of the first embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of registration information according to the first embodiment. [Figure 8] FIG. 2 is a diagram showing an example of searchable encrypted registration information according to the first embodiment. [Figure 9] FIG. 2 is a diagram showing an example of searchable encrypted registration information (TEE) according to the first embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of decrypted searchable encrypted registration information (TEE) according to the first embodiment. [Figure 11] FIG. 10 is a diagram illustrating an example of the configuration of a computer system according to a second embodiment. [Figure 12] FIG. 10 is a diagram illustrating an example of a functional configuration of a data management server according to a second embodiment. [Figure 13] FIG. 10 is a diagram illustrating an example of a functional configuration of a client terminal according to a second embodiment. [Figure 14] FIG. 10 is a diagram illustrating an example of a functional configuration of a client terminal according to a second embodiment. [Figure 15] FIG. 10 illustrates an example of a functional configuration of a temporary data management server according to a second embodiment. [Figure 16A] 10 is a sequence illustrating an example of a flow of processing executed in a computer system according to a second embodiment. [Figure 16B] 10 is a sequence illustrating an example of a flow of processing executed in a computer system according to a second embodiment. [Figure 17] FIG. 10 is a diagram illustrating an example of registration data according to the second embodiment. [Figure 18] 10 is a sequence illustrating an example of a flow of processing executed in a computer system according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the spirit or intent of the present invention.

[0015] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0016] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order. [Example]

[0017] The configuration of a computer system according to a first embodiment will be described with reference to FIGS.

[0018] FIG. 1 is a diagram illustrating an example of the configuration of a computer system according to a first embodiment.

[0019] The computer system of the first embodiment is configured from a data management server 100, a client terminal 101, and an external service 102. The number of client terminals 101 and external services 102 included in the computer system may be two or more.

[0020] The data management server 100 is communicably connected to a client terminal 101 and an external service 102 via a network 103. The network 103 may be, for example, a wide area network (WAN) or a local area network (LAN). The network connection method may be either wired or wireless.

[0021] The external service 102 is an external system that provides various services such as an electronic signature verification service, a face matching service, an email transmission service, a file server service, etc. The present invention is not limited to the types of services provided by the external service 102.

[0022] The client terminal 101 is a terminal operated by a user administrator, and performs functions such as browsing and searching registered information, checking the processing results of the external service 102, and managing the overall status.

[0023] The data management server 100 manages registration information and generates and shares information to be transmitted to the external service 102. The data management server 100 performs encryption (searchable encryption) to generate data that can be searched without decryption.

[0024] FIG. 2 is a diagram illustrating an example of a hardware configuration of the client terminal 101 according to the first embodiment.

[0025] The client terminal 101 is an information processing device such as a personal computer, a smartphone, or a server device, and includes a CPU 201, a main memory device 202, a secondary memory device 203, a network interface 204, an input device 205, and a display device 206. The main memory device 202 is, for example, a dynamic random access memory (DRAM), and the secondary memory device 203 is, for example, a hard disk drive (HDD), a solid state drive (SSD), or the like. The input device 205 is, for example, a keyboard, a mouse, a touch panel, or the like.

[0026] The client terminal 101 may be realized as a virtual computer.

[0027] FIG. 3 is a diagram illustrating an example of a hardware configuration of the data management server 100 according to the first embodiment.

[0028] The data management server 100 is an information processing device such as a personal computer, a smartphone, or a server device, and includes a CPU 301, a main memory device 302, a secondary memory device 303, a network interface 304, an input device 305, and a display device 306. The main memory device 302 is, for example, a DRAM, and the secondary memory device 303 is, for example, an HDD or SSD. The input device 305 is, for example, a keyboard, a mouse, or a touch panel.

[0029] The CPU 301 included in the data management server is a CPU with TEE functionality, and can generate a TEE trusted area 310 in the storage area of ​​the main storage device 302. A CPU equipped with Intel SGX (Software Guard Extensions) (Intel is a registered trademark, the same applies hereinafter) is considered.

[0030] The TEE trusted area 310 is a hardware area from which information cannot be read even if the administrator authority of the computer is stolen.

[0031] The data management server 100 may be realized as a virtual computer, or may be realized as a data management system made up of multiple computers.

[0032] FIG. 4 is a diagram illustrating an example of the functional configuration of the client terminal 101 according to the first embodiment.

[0033] The client terminal 101 has, as its functional configuration, a searchable encryption unit 400 and a decryption unit 401. Each functional unit is realized by the CPU 201 executing a program stored in the main storage device 202. The client terminal 101 also holds a user private key 410.

[0034] The client terminal 101 has functions and information not shown, but functions and information not directly related to the present invention are omitted.

[0035] The user private key 410 is a private key set for the user administrator who uses the client terminal 101. The user private key 410 is used for searchable encryption and its decryption. The user private key 410 is a private key that can be added, deleted, and updated. Since the user private key 410 is a private key assigned to the user administrator, the client terminal 101 holds as many user private keys 410 as there are user administrators that it uses. Furthermore, each user private key 410 has a different value from other user private keys 410. The user private key 410 is described in Patent Document 2, so a detailed description thereof will be omitted.

[0036] The searchable encryption unit 400 performs "searchable encryption" that allows data to be searched while remaining encrypted. Specifically, the searchable encryption unit 400 performs encryption using a probabilistic encryption method that uses a mask based on a hash value and the output value of a homomorphic function, and generates searchable encrypted data (secret data). A method for generating searchable encrypted data is disclosed in, for example, Patent Document 1.

[0037] The decryption unit 401 decrypts the encrypted processing results and the like received from the data management server 100 .

[0038] FIG. 5 is a diagram illustrating an example of a functional configuration of the data management server 100 according to the first embodiment.

[0039] The data management server 100 has, as its functional configuration, a TEE trust region processing unit 500 and an encrypted DB unit 501. Each functional unit is realized by the CPU 301 executing a program stored in the main storage device 302.

[0040] The data management server 100 has functions and information not shown, but functions and information not directly related to the present invention are omitted.

[0041] The TEE trusted area 310 stores a user private key 530, searchable encrypted registration information (TEE) 531, and transmission information 532. In addition, in an area other than the TEE trusted area 310, searchable encrypted registration information 533 is stored.

[0042] The TEE trust realm processing unit 500 runs on the TEE trust realm 310, from which information cannot be read even by a server administrator who has administrator authority over the server OS or a cyber attacker who has seized that administrator authority through a cyber attack. In other words, the TEE trust realm processing unit 500 can execute plaintext processing of confidential information and various key information while ensuring confidentiality from the server administrator and cyber attackers.

[0043] The TEE trust region processing unit 500 includes an encryption unit 510, a searchable encryption unit 511, a decryption unit 512, and a transmission information generation unit 513. The TEE trust region processing unit 500 also manages a user private key 530, searchable encrypted registration information (TEE) 531, and transmission information 532.

[0044] The user private key 530 is a private key that can be used only in the TEE trust area 310. The user private key 530 is a private key that has the same properties as the user private key 410 that the client terminal 101 possesses.

[0045] The searchable encrypted registration information (TEE) 531 stores searchable encrypted registration data extracted from the searchable encrypted registration information 533 held by the encrypted DB unit 501 .

[0046] The transmission information 532 stores data in a predetermined data format for use by each external service 102. The data includes, for example, the sender and recipient addresses, subject, and message body used in an email.

[0047] The encryption unit 510 encrypts data using a basic encryption technique such as AES. The searchable encryption unit 511 performs searchable encryption on the data. The decryption unit 512 decrypts encrypted data such as encrypted processing results. The transmission information generation unit 513 generates data in a data format that can be used by the external service 102.

[0048] The encrypted DB unit 501 includes a data registration unit 520. The encrypted DB unit 501 also manages searchable encrypted registration information 533.

[0049] Searchable encrypted registration information 533 stores registration data consisting of searchable encrypted data values.

[0050] The data registration unit 520 registers the data in the searchable encrypted registration information 533 .

[0051] The following describes the processing executed by the computer system of Example 1. In Example 1, the processing will be described taking as an example a use case in which an email transmission service is used as the external service 102.

[0052] It is assumed that a user administrator provides a service and registers information (registration data) about users who use the service in the data management server 100. That is, one piece of registration data (record) for one user is registered in the searchable encrypted registration information 533. Assume that the user administrator is responsible for sending emails to users. When sending emails to several people, the user administrator can use an SMTP server that the user administrator manages. However, sending a large number of emails at once places a heavy load on the SMTP server, which may cause a failure. Therefore, the user administrator may use an external service 102 that sends emails in bulk. In this case, secure information exchange between the data management server 100, which manages registration data including email addresses, and the external service 102 is required.

[0053] The data management server 100 of the first embodiment ensures the confidentiality of registered data, generates data that is necessary for sending emails in bulk and that is in a data format that can be used by the external service 102, and transmits the data to the external service 102. Specific processing will be described below.

[0054] 6A and 6B are sequences showing an example of the flow of processing executed in the computer system of the first embodiment.

[0055] The client terminal 101 uses the user private key 410 to perform searchable encryption on the registration data to be registered in the data management server, and generates searchable encrypted registration data (step S601).

[0056] The client terminal 101 registers the searchable encrypted registration data in the data management server 100 (step S602).

[0057] Here, the registered data and the searchable encrypted registered data will be described with reference to FIGS.

[0058] 7 is a diagram showing an example of registration information according to the first embodiment. The registration information 700 stores records each including a management ID 701, a name 702, an email address 703, and a flag 704. One record is the registration data for one user. Note that the columns included in the record are merely examples and are not intended to be limiting.

[0059] The management ID 701 is a column that stores the ID of a record in the registration information 700. The name 702 and email address 703 are columns that store the name and email address of the user.

[0060] Flag 704 is a column that stores a flag indicating whether or not an email is eligible for bulk sending. If an email is eligible for bulk sending, "1" is stored in flag 704, and if an email is not eligible for bulk sending, "0" is stored in flag 704. The initial value of flag 704 is "0."

[0061] 8 is a diagram showing an example of the searchable encrypted registration information 533 according to the first embodiment. The record structure of the searchable encrypted registration information 533 is the same as the record of the registration information 700. However, each column stores searchable encrypted data values.

[0062] When sending an email to a user, the user administrator operates the client terminal 101 to obtain the searchable encrypted registration information 533 from the data management server 100. The decryption unit 401 of the client terminal 101 decrypts the searchable encrypted registration information 533. The user administrator assigns a flag of "1" to any registration data stored in the plaintext registration information 700. The client terminal 101 registers a flag of "1" in the data management server 100 for the record of the user to whom emails are to be sent in bulk, and transmits an integration request instructing integration with the external service 102 (step S610). The flag searchably encrypted by the searchable encryption unit 400 is registered in the data management server 100.

[0063] The encrypted DB unit 501 of the data management server 100 extracts records in which a flag "1" is registered from the searchable encrypted registration information 533, and generates searchable encrypted registration information (TEE) 531 (step S611). For example, the searchable encrypted registration information (TEE) 531 as shown in FIG. 9 is generated.

[0064] The encrypted DB unit 501 of the data management server 100 stores the searchable encrypted registration information (TEE) 531 in the TEE trusted area 310 (step S612).

[0065] The decryption unit 512 of the TEE trust region processing unit 500 decrypts the searchable encrypted registration information (TEE) 531 using the user private key 530 (step S613). When the searchable encrypted registration information (TEE) 531 shown in Fig. 9 is decrypted, the result shown in Fig. 10 is obtained.

[0066] The transmission information generation unit 513 of the TEE trust region processing unit 500 generates transmission information 532 using the decrypted searchable encrypted registration information (TEE) 531 (step S614).

[0067] Specifically, the transmission information generation unit 513 generates transmission information 532 in a data format that can be used by the linked external service 102. For example, for one piece of registration data in the decrypted searchable encrypted registration information (TEE) 531, one piece of transmission data is generated that is made up of sender and recipient addresses, a subject, and a message body used to send an email.

[0068] The transmission information generating unit 513 may include data values ​​of all columns included in the registration data in the transmission data, or may include data values ​​of a predetermined column included in the registration data in the transmission data.

[0069] The TEE trust realm processing unit 500 transmits a request including the transmission information 532 to the external service 102 (step S615).

[0070] It is desirable that the communication between the data management server 100 and the external service 102 be encrypted using, for example, TLS (Transport Layer Security) / SSL (Secure Sockets Layer) or the like. By encrypting the communication, only encrypted information is sent and received on the communication path from the client terminal 101 to the external service 102, thereby improving security.

[0071] When the external service 102 receives the request, it executes processing corresponding to the request (step S616) and transmits a response to the data management server 100 (step S617). The response is received by the TEE trust region processing unit 500. In this embodiment, the external service 102 transmits an email to a user designated by the user administrator.

[0072] When the TEE trust region processing unit 500 of the data management server 100 receives the response, it deletes the searchable encrypted registration information (TEE) 531 and the transmission information 532 (step S618).

[0073] The TEE trust region processing unit 500 of the data management server 100 transmits a response to the encrypted DB unit 501 (step S619). The encrypted DB unit 501 of the data management server 100 reflects the response in the searchable encrypted registration information 533 (step S620). Note that the processes of steps S619 and S620 do not necessarily have to be executed.

[0074] The user administrator checks the processing results of the external service 102 using the client terminal 101 as necessary (step S621).

[0075] According to the first embodiment, cooperation with the external service 102 can be realized while keeping the registered data confidential.

[0076] The user private key 530 is stored in the TEE trusted area 310, and the searchable encrypted registration data is decrypted only in the TEE trusted area 310, thereby reducing the risk of information leakage due to cyber attacks and also reducing the risk of information leakage to the service provider.

[0077] The registration data is transmitted and received in an encrypted state between the client terminal 101 and the data management server 100, and between the data management server 100 and the external service 102, thereby ensuring confidentiality.

[0078] Furthermore, when generating transmission data, only the data values ​​required by the external service 102 are extracted and included in the transmission data, thereby further reducing the risk of information leakage.

[0079] In Example 1, a use case of sending emails in bulk was explained as an example, but the same control as in Example 1 can also be used in use cases such as registering documents containing sensitive information such as personal information on an external file server. [Example]

[0080] In the second embodiment, a system corresponding to a use case in which an unspecified number of general users register registration data will be described. The second embodiment will be described below, focusing on the differences from the first embodiment.

[0081] FIG. 11 is a diagram illustrating an example of the configuration of a computer system according to the second embodiment.

[0082] The computer system of the second embodiment differs from the computer system of the first embodiment in that it includes a temporary data management server 1100 and a client terminal 1101 .

[0083] The client terminal 1101 is a terminal operated by a general user who uses the services provided by the user administrator. The hardware configuration of the client terminal 1101 is the same as that of the client terminal 101.

[0084] The temporary data management server 1100 temporarily stores registration data registered by general users. The hardware configuration of the temporary data management server 1100 is the same as that of the data management server 100.

[0085] It is assumed that the data management server 100 and the temporary data management server 1100 are provided by the same service provider, that is, the data management server 100 and the temporary data management server 1100 are provided as a single system.

[0086] FIG. 12 is a diagram illustrating an example of a functional configuration of the data management server 100 according to the second embodiment.

[0087] The TEE trusted domain 310 of the second embodiment differs from the TEE trusted domain 310 of the first embodiment in that it has a private key 1200 generated using a public key infrastructure (PKI). The private key 1200 is shared between the TEE trusted domain 310 and the temporary data management server 1100.

[0088] FIG. 13 is a diagram illustrating an example of the functional configuration of the client terminal 101 according to the second embodiment.

[0089] The client terminal 101 of the second embodiment differs from the client terminal 101 of the first embodiment in that it has the same private key 1200 as the TEE trust area 310 has.

[0090] FIG. 14 is a diagram illustrating an example of the functional configuration of the client terminal 1101 according to the second embodiment.

[0091] The client terminal 1101 has, as a functional configuration, an encryption unit 1300. The encryption unit 1300 is realized by a CPU (not shown) executing a program stored in a main storage device (not shown). The client terminal 1101 also holds a public key 1301.

[0092] The client terminal 1101 has functions and information not shown, but functions and information not directly related to the present invention are omitted.

[0093] The public key 1301 is a key generated using a public key infrastructure. The public key 1301 is shared between the client terminal 1101 and the temporary data management server 1100. The public key 1301 is used to encrypt registration data to be transmitted to the temporary data management server 1100. Note that the present invention is not limited to the key distribution method.

[0094] The encryption unit 1300 encrypts data using a basic encryption technique such as AES (Advanced Encryption Standard).

[0095] FIG. 15 is a diagram illustrating an example of the functional configuration of the temporary data management server 1100 according to the second embodiment.

[0096] The temporary data management server 1100 has, as a functional configuration, an encrypted DB unit 1400. The encrypted DB unit 1400 is realized by a CPU (not shown) executing a program stored in a main storage device (not shown).

[0097] The temporary data management server 1100 holds functions and information not shown, but functions and information not directly related to the present invention are omitted.

[0098] The encrypted DB unit 1400 includes a data registration unit 1410. The encrypted DB unit 1400 also manages encrypted registration information 1420.

[0099] The encrypted registration information 1420 stores registration data consisting of encrypted data values. In this embodiment, one piece of registration data (record) corresponds to one user. The data registration unit 1410 registers the encrypted registration data in the encrypted registration information 1420.

[0100] The processing executed by the computer system of the second embodiment will be explained below.

[0101] In the second embodiment, cooperation with an external service 102 that provides eKYC (electronic Know Your Computer) is assumed. The eKYC method permitted by the Act on Prevention of Transfer of Criminal Proceeds includes confirming the identity of an image on an identification document with an image of the individual's appearance, and confirming the identity of information on an IC chip on an identification document with an image of the individual's appearance. Many businesses have their own proprietary algorithms for identity verification technology used in eKYC.

[0102] In this case, general users need to register their own selfie photos and images of their identification documents, such as their driver's license and My Number card, as registration data in the data management server 100. In the method of distributing user private keys 410 to general users, as in the method of the first embodiment, general users can directly register searchable encrypted registration data in the data management server 100. However, this method places a heavy burden on the user administrator for key management and is undesirable from a security standpoint.

[0103] Therefore, in the second embodiment, a general user encrypts registration data using a general public key cryptography infrastructure and registers it in the temporary data management server 1100. The TEE trusted realm 310 decrypts the encrypted registration data and cooperates with the external service 102. Thereafter, the user administrator decrypts the encrypted registration data, checks the contents of the registration data, performs searchable encryption, and registers it in the data management server 100. This method reduces the burden of key management and also improves security.

[0104] The data management server 100 of the second embodiment transmits encrypted registration data to the external service 102, similarly to the first embodiment.

[0105] 16A and 16B are sequences showing an example of the flow of processing executed in the computer system of the second embodiment.

[0106] The client terminal 1101 transmits a public key sharing request to the temporary data management server 1100 (step S1501).

[0107] When the temporary data management server 1100 receives the public key sharing request, it generates a public key 1301 using a public key infrastructure and transmits it to the client terminal 1101 (step S1502). Note that the method for generating the public key 1301 is not limited.

[0108] The encryption unit 1300 of the client terminal 1101 encrypts the registration data using the public key 1301 to generate encrypted registration data (step S1503).

[0109] 17 is a diagram showing an example of registration data in Example 2. The registration data is composed of a selfie photo 1601 and images of personal identification documents 1602 such as a driver's license and a My Number card.

[0110] The client terminal 1101 registers the encrypted registration data in the temporary data management server 1100 (step S1504).

[0111] The temporary data management server 1100 transmits the encrypted registration data to the data management server 110 (step S1505).

[0112] The decryption unit 512 of the TEE trust region processing unit 500 decrypts the encrypted registration data using the private key 1200, and cooperates with the external service 102. The process of cooperation with the external service 102 is the same as that in the first embodiment. Note that the form may be a push type in which the temporary data management server 1100 sends the data to the data management server 100, or a pull type in which the external service 102 requests the data management server 100.

[0113] After the processing is performed by the external service, the temporary data management server 1100 receives the response (step S1506) and reflects the response content (step S1507).

[0114] After reflecting the response content, the temporary data management server 1100 transmits a registration notification to the client terminal 101 (step S1508).

[0115] When the client terminal 101 receives the registration notification, it transmits a request to share the encrypted registration data to the temporary data management server 1100 (step S1509).

[0116] When the temporary data management server 1100 receives the share request, it transmits the encrypted registration data to the client terminal 101 (step S1510).

[0117] The decryption unit 401 of the client terminal 101 decrypts the encrypted registration data using the private key 1200 (step S1511). At this time, the user administrator may check the contents of the registration data. The user administrator may also perform status management based on the check results.

[0118] The searchable encryption unit 400 of the client terminal 101 performs searchable encryption on the registration data to generate searchable encrypted registration data (step S1512). In addition, the client terminal 101 registers the searchable encrypted registration data in the data management server 100 (step S1513).

[0119] In addition, the data management server 100 may delete the encrypted registration data stored in the temporary data management server 1100 when it obtains encrypted registration data from the temporary data management server 1100, when searchable encrypted registration data is registered, or periodically.

[0120] According to the second embodiment, it is possible to safely manage the registration data applied for by a general user and realize cooperation with the external service 102. [Example]

[0121] The third embodiment differs from the first embodiment in that the data management server 100 transmits data in response to a request from an external service 102. The third embodiment will be described below, focusing on the differences from the first embodiment.

[0122] The system configuration of the third embodiment is the same as that of the first embodiment. The hardware configuration and functional configuration of the data management server 100 and the client terminal 101 of the third embodiment are the same as those of the first embodiment.

[0123] 18 is a sequence diagram showing an example of the flow of processing executed in the computer system of the embodiment 3. It is assumed that cooperation with the external service 102 has been started by the processing described in the embodiment 1.

[0124] The external service 102 transmits an acquisition request including a search key for searching the searchable encrypted registered data to the TEE trust region processing unit 500 of the data management server 100 (step S1701). The search key is, for example, a login ID used in the login process to the external service 102. The acquisition request includes information on columns to be included in the data.

[0125] The TEE trust region processing unit 500 of the data management server 100 transmits a generation request including a search key to the encrypted DB unit 501 (step S1702). The generation request includes information on columns to be included in the data.

[0126] The encrypted DB unit 501 acquires the searchable encrypted registration data from the searchable encrypted registration information 533, generates the searchable encrypted registration information (TEE) 531 (step S1703), and transmits it to the TEE trust region processing unit 500 (step S1704).

[0127] The decryption unit 512 of the TEE trust region processing unit 500 decrypts the searchable encrypted registration information (TEE) 531 using the user private key 530 (step S1705).

[0128] The transmission information generation unit 513 of the TEE trust region processing unit 500 generates the transmission information 532 using the decrypted searchable encrypted registration information (TEE) 531 (step S1706).

[0129] The TEE trust region processing unit 500 transmits the transmission information 532 to the external service 102 (step S1707).

[0130] If necessary, the external service 102 may transmit a processing result to the TEE trust region processing unit 500. After transmitting the transmission information 532, or when receiving a processing result from the external service 102, the TEE trust region processing unit 500 may delete the searchable encrypted registration information (TEE) 531 and the transmission information 532.

[0131] Possible use cases for the third embodiment include the following: The data management server 100 manages user data of general users as registration data, and the external service 102 performs login processing and application processing for the general users. In this case, after the general user logs in, the external service 102 presents an operation screen for creating government application documents, etc. The external service 102 sends an acquisition request to the data management server 100, which includes, as a search key, the management ID used during the login processing. The data management server 100 generates transmission information 532 including personal information of the general user and sends it to the external service 102. The external service 102 automatically enters values ​​into predetermined fields on the operation screen based on the transmission information 532.

[0132] In the above use case, the work efficiency is improved because the effort required for general users to input information is reduced. Also, the service quality of the external service 102 can be improved because input errors and the like can be reduced. Furthermore, as in the first embodiment, the registration information is transmitted and received in an encrypted state between the client terminal 101 and the data management server 100, and between the data management server 100 and the external service 102, ensuring confidentiality.

[0133] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0134] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0135] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0136] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0137] In the above-described embodiment, the control lines and information lines are shown as those considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0138] 100 Data Management Server 101, 1101 Client terminal 102 External Services 103 Network 110 Data Management Server 201, 301 CPU 202, 302 Main storage 203, 303 Secondary storage device 204, 304 network interfaces 205, 305 Input device 206, 306 Display device 310 TEE Trust Region 400, 511 Searchable Encryption 401, 512 Decoding unit 410, 530 User private key 500 TEE Trusted Region Processing Unit 501, 1400 Encrypted DB section 510, 1300 Encryption section 513 Transmission information generation unit 520, 1410 Data Registration Department 531 Searchable Encrypted Registration Information (TEE) 532 Transmission Information 533 Searchable Encrypted Registration Information 700 Registration Information 1100 Temporary Data Management Server 1200 private key 1301 Public Key 1420 Encrypted Registration Information 1601 Selfie Photos 1602 Identification documents

Claims

1. 1. A data management system comprising: at least one computer having a processing unit and a storage unit; managing a first database that stores secret data encrypted based on a probabilistic encryption scheme using a user private key; a client terminal that registers the confidential data in the data management system and a service providing system that provides an arbitrary service; the computing device has a function for generating a secure and logically isolated trust area in the storage device; The data management system includes: When a request instructing use of the service using the secret data is received from the client terminal, at least one piece of the secret data is acquired from the first database and stored in the trusted area; decrypting the obtained secret data in the trust region; generating, in the trust region, first transmission data to be transmitted to the service providing system in order to use the service, using the decrypted secret data; encrypting the first transmission data in the trust realm into a format that can be decrypted by the service providing system; A data management system that transmits the encrypted first transmission data to the service providing system.

2. 2. The data management system according to claim 1, The data management system is characterized in that the user private key is stored in the trusted area.

3. 3. The data management system according to claim 2, Identifying the confidential data to be transmitted from the first database; acquiring a data value necessary for using the service from the identified confidential data; A data management system characterized in that secret data composed of the acquired data values ​​is stored in the trusted region.

4. 3. The data management system according to claim 2, 10. A data management system comprising: a data management unit for managing a data transmission destination, the data management unit being configured to transmit the encrypted first transmission data; a data management unit for deleting the decrypted secret data stored in the trusted area;

5. 2. The data management system according to claim 1, managing a second database that receives registration data encrypted by a public key cryptosystem, the registration data being data for generating secret data from a user; the client terminal holds the user private key and the private key of the public key cryptosystem; The data management system is characterized in that the client terminal decrypts the registered data stored in the second database using a private key of the public key cryptography system, and stores the secret data searchably encrypted using the user private key in the first database.

6. 6. The data management system according to claim 5, A data management system characterized in that the registered data stored in the second database is deleted at a predetermined timing.

7. 2. The data management system according to claim 1, When receiving a request to acquire the secret data from the service providing system, acquire at least one piece of the secret data from the first database and store it in the trusted area; decrypting the obtained secret data in the trust region; generating second transmission data including a data value required by the service providing system in the trust region using the decrypted secret data; encrypting the second transmission data in the trust realm into a format that can be decrypted by the service providing system; a data management system for transmitting the encrypted second transmission data to the service providing system;

8. An information processing method using confidential data executed by a data management system, The data management system includes: at least one computer having a processing unit and a storage unit; managing a first database that stores secret data encrypted based on a probabilistic encryption scheme using a user private key; a client terminal that registers the confidential data in the data management system and a service providing system that provides an arbitrary service; the computing device has a function for generating a secure and logically isolated trust area in the storage device; The information processing method using the secret data includes: a first step of, when the data management system receives a request from the client terminal instructing the use of the service using the secret data, acquiring at least one piece of the secret data from the first database and storing it in the trusted area; a second step in which the data management system decrypts the obtained secret data in the trust region; a third step in which the data management system uses the decrypted secret data to generate first transmission data to be transmitted to the service providing system in the trust area in order to use the service; a fourth step in which the data management system encrypts the first transmission data in the trust realm into a format that can be decrypted by the service providing system; a fifth step in which the data management system transmits the encrypted first transmission data to the service providing system.

9. An information processing method using secret data according to claim 8, 10. An information processing method using secret data, wherein the user private key is stored in the trusted area.

10. An information processing method using secret data according to claim 9, The first step comprises: the data management system identifying the confidential data to be transmitted from the first database; a step in which the data management system acquires a data value required for using the service from the identified secret data; and a step in which the data management system stores secret data composed of the acquired data values ​​in the trust region.

11. An information processing method using secret data according to claim 9, The information processing method using secret data is characterized in that the data management system includes a step of deleting the decrypted secret data stored in the trusted area after transmitting the encrypted first transmission data.

12. An information processing method using secret data according to claim 8, the data management system manages a second database that receives registration data encrypted by a public key cryptosystem, the registration data being data for generating secret data from a user; the client terminal holds the user private key and the private key of the public key cryptosystem; The information processing method using secret data is characterized in that the data management system includes a step in which the client terminal decrypts the registered data stored in the second database using a private key of the public key cryptography system, and stores the secret data searchably encrypted using the user private key in the first database.

13. An information processing method using secret data according to claim 12, An information processing method using secret data, comprising a step in which the data management system deletes the registered data stored in the second database at a predetermined timing.

14. An information processing method using secret data according to claim 8, When the data management system receives a request to acquire the secret data from the service providing system, the data management system acquires at least one piece of the secret data from the first database and stores the acquired data in the trusted area; the data management system decrypting the obtained secret data in the trust region; The data management system generates second transmission data including a data value requested by the service providing system in the trust region using the decrypted secret data; The data management system encrypts the second transmission data in the trust realm into a format that can be decrypted by the service providing system; and a step in which the data management system transmits the encrypted second transmission data to the service providing system.

Images