Information processing device, information processing method, and information processing program

Abstract

To provide portable and verifiable certificates with authentication information.SOLUTION: An information processing device, which is an information processing device as a certificate issuer, includes: an authentication processing unit configured to perform authentication on a user; an issuance unit configured to issue a portable and verifiable certificate with authentication information that stores certificate information regarding user attributes and authority and authentication information indicating an authentication method performed for the user; and a provision unit configured to provide the user with the portable and verifiable certificate with authentication information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] A technology has been disclosed that verifies that the same device is used when purchasing and issuing an electronic ticket. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6285474 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned conventional technology, if the issuer and verifier are different, they must manage common permissions and attributes. If there is no need to manage common permissions and attributes between the issuer and verifier even if they are different, it would be possible to provide a portable and verifiable certificate with authentication information.

[0005] The present application has been made in view of the above, and aims to provide a portable and verifiable certificate with authentication information. [Means for solving the problem]

[0006] The information processing device according to the present application is an information processing device as a certificate issuer, and includes an authentication processing unit that performs authentication for a user, an issuing unit that issues a portable and verifiable certificate with authentication information that stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed for the user, and a providing unit that provides the portable and verifiable certificate with authentication information to the user. The authentication processing unit performs FIDO authentication on the user, and the issuing unit issues the portable and verifiable certificate with authentication information, which stores the certificate information and the authentication information including an authentication public key used for FIDO authentication of the user. It is characterized by: [Effects of the Invention]

[0007] According to one aspect of the embodiment, a portable and verifiable certificate with authentication information can be provided. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is an explanatory diagram showing an overview of an information processing method according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram showing an overview of a portable and verifiable certificate with authentication information. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration of an information processing system according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of the configuration of a terminal device according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of the configuration of a server device of an issuer according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of the user information database. [Figure 7] FIG. 7 is a diagram illustrating an example of the history information database. [Figure 8] FIG. 8 is a diagram illustrating an example of the certificate database. [Figure 9] FIG. 9 is a diagram illustrating an example of the configuration of a server device of a verifier according to the embodiment. [Figure 10] FIG. 10 is a flowchart showing a processing procedure according to the embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of a hardware configuration. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an information processing device, an information processing method, and an information processing program according to the present application (hereinafter referred to as "embodiments") will be described in detail with reference to the drawings. Note that the information processing device, the information processing method, and the information processing program according to the present application are not limited to these embodiments. Furthermore, the same components in the following embodiments will be denoted by the same reference numerals, and duplicated descriptions will be omitted.

[0010] [1. Overview of information processing method] First, an overview of an information processing method performed by an information processing device according to an embodiment will be described with reference to Fig. 1. Fig. 1 is an explanatory diagram showing an overview of an information processing method according to an embodiment. Note that Fig. 1 explains an example in which a portable and verifiable certificate with authentication information is provided.

[0011] 1, an information processing system 1 according to the embodiment includes a terminal device 10, a server device 100, and a server device 200. The terminal device 10, the server device 100, and the server device 200 are connected to each other via a network N (see FIG. 3) in a wired or wireless manner so as to be able to communicate with each other. In this embodiment, the terminal device 10 cooperates with the server device 100.

[0012] The terminal device 10 is a smart device such as a smartphone or tablet terminal used by a user U, and is a portable terminal device capable of communicating with any server device via a wireless communication network such as 4G (Generation (4G)) or LTE (Long Term Evolution) networks. The terminal device 10 has a screen such as a liquid crystal display with a touch panel function, and accepts various operations on displayed data such as content, such as tapping, sliding, and scrolling, performed by the user U with a finger or a stylus. An operation performed on an area of ​​the screen where content is displayed may be considered an operation on the content. The terminal device 10 may be not only a smart device, but also an information processing device such as a desktop PC (Personal Computer) or a notebook PC.

[0013] Server device 100 and server device 200 are information processing devices that work in conjunction with each user U's terminal device 10 and provide each user U's terminal device 10 with API (Application Programming Interface) services for various applications (hereinafter referred to as apps), etc., as well as various data, and are realized by a computer, a cloud system, etc.

[0014] Furthermore, the server device 100 and the server device 200 may be information processing devices that provide some kind of online web service to the terminal device 10 of each user U. For example, the server device 100 and the server device 200 may provide services such as internet connection, search services, SNS (Social Networking Service), electronic commerce (EC), electronic payment, online games, online banking, online trading, hotel and ticket reservations, video and music distribution, news, maps, route searches, route guidance, line information, operation information, and weather forecasts as web services. In practice, the server device 100 and the server device 200 may cooperate with various servers that provide the above-mentioned web services and act as an intermediary for the web services or may be responsible for processing the web services.

[0015] The server device 100 and the server device 200 can acquire user information about the user U. For example, the server device 100 and the server device 200 acquire information about the attributes of the user U, such as the gender, age, and area of ​​residence of the user U. The server device 100 and the server device 200 then store and manage the information about the attributes of the user U together with identification information (such as a user ID) that indicates the user U.

[0016] The server devices 100 and 200 also acquire various types of history information (log data) indicating the behavior of the user U from the terminal device 10 of the user U or from various servers based on the user ID, etc. For example, the server devices 100 and 200 acquire a location history, which is a history of the user U's location and date and time, from the terminal device 10. The server devices 100 and 200 also acquire a search history, which is a history of search queries entered by the user U, from a search server (search engine). The server devices 100 and 200 also acquire a browsing history, which is a history of content viewed by the user U, from a content server. The server devices 100 and 200 also acquire a purchase history (payment history), which is a history of the user U's product purchases and payment processes, from an e-commerce server or a payment processing server. The server devices 100 and 200 may also acquire a listing history, which is a history of the user U's listings on the marketplace, and a sales history from the e-commerce server or a payment processing server. Furthermore, the server device 100 and the server device 200 acquire a posting history, which is a history of posts made by the user U, from a posting server that provides a word-of-mouth posting service or an SNS server.

[0017] In this embodiment, user U is a potential certificate holder. The terminal device 10 serves as an authenticator that authenticates user U. The authenticator may be implemented in the same device as the FIDO client (built-in authenticator), or may be implemented in a device physically different from the FIDO client (external authenticator). The server device 100 serves as an issuer that issues a certificate to user U. The server device 200 serves as a verifier that verifies the certificate issued to user U.

[0018] [1-1. Verifiable Certificate] Currently, various proposals have been made regarding verifiable credentials (VC). A verifiable certificate (VC) is a certificate that is digitally tamper-proofed by signing it. A certificate is a concept that uses a driver's license or health insurance card digitally. A certificate is a certificate that [issuer] certifies information about the attributes and characteristics of a certain [subject]. For example, it certifies information about how the certificate was obtained and the restrictions on the certificate (such as how long it is valid).

[0019] A verifiable certificate (VC) is used by the [owner] when it is presented to the [verifier]. The [verifier] can verify that the certificate has not been tampered with by verifying the signature with the [issuer]'s public key. At this time, the [owner] is authenticated if necessary. The W3C (World Wide Web Consortium) has recommended a data model for verifiable certificates (VC) (URL: https: / / www.w3.org / TR / vc-data-model).

[0020] However, currently, services that utilize regular verifiable certificates (VC) have the following issues: For example, they are based on the premise that the verifier trusts the issuer, and regular verifiable certificates (VC) do not exchange information about how the issuer has verified the holder.

[0021] Therefore, the issuer issues a regular verifiable certificate (VC) after authenticating and verifying the holder's identity, but the verifier cannot know whether the issuer authenticated the holder using a password (PW) or FIDO authentication, or whether the issuer verified the holder's identity in person.

[0022] In addition, the issued normal verifiable certificate (VC) can be used by anyone as long as they can use the wallet, so the verifier cannot know whether the person (holder) who presented the normal verifiable certificate (VC) is the person authenticated by the issuer.

[0023] Therefore, in this embodiment, authentication information such as FIDO authentication, face-to-face identity verification, and delivery confirmation via SMS is carried as a certificate, not limited to a verifiable certificate (VC), and can be verified by any third party.

[0024] A typical verifiable certificate (VC) uses information about the user's attributes and identity, but the certificate in this embodiment differs from a typical verifiable certificate (VC) in that it can use not only the user's attributes and identity, but also their authority and qualifications.

[0025] [1-2. Certificate Issuance and Verification] As shown in Fig. 1, a user U uses a terminal device 10 to request the issuance of a certificate from a server device 100, which is an issuer, via a network N (see Fig. 3) (step S1). Here, it is assumed that the user U has already been registered with the server device 100, which is an issuer. Therefore, a description of the registration process will be omitted.

[0026] In response to a request for issuance of a certificate from user U, server device 100, which is the issuer, requests terminal device 10, which is the authenticator, to authenticate the user (step S2). At this time, server device 100, which is the issuer, sends a challenge along with " / " as a request for user authentication. The challenge is a random string of characters 16 or more in length used to verify the validity of the signature.

[0027] The terminal device 10, which is the authenticator, performs user verification of the user U using a predetermined authentication method such as biometric authentication, and if the user's identity is confirmed, transmits a FIDO assertion (proof of identity authentication) to the server device 100, which is the issuer (step S3). The assertion is a statement that includes information on a challenge (signed challenge) signed by the authenticator.

[0028] For example, the terminal device 10 performs user verification based on biometric information acquired from the user U. The biometric information may be any one of fingerprints, veins, face, iris, and voiceprint, or a combination thereof. Furthermore, behavioral information relating to predetermined movements such as gestures may be used instead of the biometric information. In practice, the means for verifying identity is not limited to biometric authentication. For example, the terminal device 10 may verify identity through authentication using a token that generates a one-time password.

[0029] Then, if the terminal device 10, which is the authenticator, confirms the identity of the user as a result of user verification, it signs the challenge with the private key on the authenticator side (the private key of the holder) to generate an assertion, and sends the assertion to the server device 100, which is the issuer.

[0030] If the issuer, server device 100, successfully verifies the FIDO assertion, it issues a portable and verifiable certificate with authentication information (portable VC: pVC) to user U's terminal device 10 as a certificate (step S4).

[0031] For example, the server device 100, which is the issuer, identifies the public key (holder's public key) to be used from the key identifier included in the assertion, and verifies the signature using that public key (holder's public key). If the signature verification is successful, the server device 100 issues a portable and verifiable certificate with authentication information (pVC) signed with its own private key (issuer's private key) to the terminal device 10 of the user U. The terminal device 10 of the user U stores the portable and verifiable certificate with authentication information (pVC) internally. As a result, the user U (terminal device 10) becomes the holder of the portable and verifiable certificate with authentication information (pVC). The portable and verifiable certificate with authentication information (pVC) can be used as a verifiable certificate (VC) or an electronic ticket.

[0032] When the terminal device 10 of the user U, who is the holder, needs to present a certificate to the verifier, it presents the portable and verifiable certificate with authentication information (pVC) to the server device 200, which is the verifier (step S5). At this time, the terminal device 10 may present the portable and verifiable certificate with authentication information (pVC) to the server device 200, which is the verifier, via the network N (see FIG. 3), or may present it indirectly to the server device 200, which is the verifier, by presenting it to a camera, sensor, or terminal device, etc., which can cooperate with / communicate with the server device 200, which is the verifier.

[0033] The server device 200, which is the verifier, verifies the presented portable and verifiable certificate with authentication information (pVC) (step S6). For example, the server device 200, which is the verifier, verifies the signature of the portable and verifiable certificate with authentication information (pVC) using the public key of the issuer.

[0034] If the server device 200, which is the verifier, successfully verifies the portable and verifiable certificate with authentication information (pVC), it performs FIDO authentication on the user U, who is the holder, based on the contents of the portable and verifiable certificate with authentication information (pVC), in the same manner as the server device 100, which is the issuer (step S7). If the FIDO authentication is successful, the server device 200, which is the verifier, may provide a product or service to the terminal device 10 of the user U, who is the holder, in response to the presentation of the portable and verifiable certificate with authentication information (pVC). For example, the server device 200, which is the verifier, may permit the user U, who has presented the portable and verifiable certificate with authentication information (pVC), to enter a facility or event venue.

[0035] [1-3. Portable and verifiable certificate with authentication information] In this embodiment, the server device 100, which is the issuer, issues a portable and verifiable certificate with authentication information (pVC) as the certificate. Fig. 2 is an explanatory diagram showing an overview of the portable and verifiable certificate with authentication information.

[0036] As shown in Figure 2, a portable and verifiable certificate with credentials (pVC) contains certificate information related to "attributes and privileges" and authentication information related to "authentication / identity verification context." Certificate information related to "attributes and privileges" indicates not only information about the attributes and identity of user U, but also information about user U's privileges and qualifications. Authentication information related to "authentication / identity verification context" indicates information such as whether user U was FIDO authenticated, whether his / her identity was verified in person, or whether delivery was confirmed via SMS.

[0037] In this embodiment, the server device 100, which is the issuer, performs FIDO authentication on the user U, and therefore stores information indicating that the user U has been FIDO authenticated in the authentication information related to the "authentication / identification context."

[0038] In addition, the issuer, server device 100, also stores the holder's public key (public key used for the holder's FIDO authentication) for the domain authenticated when the certificate was issued in the authentication information related to the "authentication / identification context."

[0039] The server device 100, which is the issuer, signs the portable and verifiable certificate with authentication information (pVC) with the issuer's private key. That is, the server device 100, which is the issuer, signs the entire certificate, including the certificate information related to "attributes and privileges" and the authentication information related to "authentication / identification context," with the issuer's private key.

[0040] When a signed, portable and verifiable certificate with authentication information (pVC) is presented, the server device 200, which is the verifier, verifies the signature using the issuer's public key and confirms the authenticity of the portable and verifiable certificate with authentication information (pVC).

[0041] Furthermore, the server device 200, which is the verifier, performs FIDO authentication, which is the authentication method indicated in the authentication information related to the "authentication / identification context." As a result, the server device 200, which is the verifier, performs authentication on the holder, user U, using the same authentication method as at the time of issuance. In other words, the verifier performs the same FIDO authentication on the holder as on the issuer. At this time, when the server device 200, which is the verifier, receives a FIDO assertion signed with the holder's private key, it verifies the holder's signature with the holder's public key stored in the authentication information related to the "authentication / identification context."

[0042] This makes it possible to realize a mechanism that enables the same "WebAuthn" (FIDO authentication) to be implemented for certificate users (holders) across origins (cross-origin) such as issuers and verifiers. Furthermore, when granting access to a server at a different origin to a web application running at one origin, it is possible to implement FIDO authentication for web application users by having the web application present a portable and verifiable certificate with credentials (pVC) along with the request.

[0043] The portable and verifiable certificate with authentication information (pVC) of this embodiment verifies that the holder is the same person at the time of issuance and at the time of use, and even if the issuer and verifier are different, there is no need for both to manage common permissions and attributes.

[0044] The portable and verifiable certificate with authentication information (pVC) according to this embodiment can also be used as an electronic ticket. For example, at the time of purchase, the ticket seller authenticates the user with FIDO, then includes the authentication information and public key and signs the ticket. Then, upon entering the venue, the user presents the ticket to a business (which may be in a different domain from the ticket seller), and the business verifies the authenticity of the ticket using the ticket seller's public key and then requests FIDO authentication from the user. At this time, possession of the private key corresponding to the public key stored in the presented ticket can be confirmed, confirming the purchaser's identity.

[0045] This eliminates the need for a common reference resource between ticket sellers and businesses, making it difficult to copy or counterfeit. In principle, the entry system could be implemented offline. It also provides stronger assurance of identity when exercising authority.

[0046] [1-4. Updating the holder's public key] This section explains what happens if the FIDO authentication public key (holder's public key) is updated during verification.

[0047] For example, passports and driver's licenses are issued every few years and are generally not renewed by police stations during that time. On the other hand, the FIDO authentication public key (holder's public key) according to this embodiment is a key closely tied to the device, so it is expected that the key will be changed when changing the model, etc., or that an additional key will be required when a new device is acquired in addition to the current device. Therefore, the following options are available as countermeasures.

[0048] (1) When the FIDO authentication public key (holder's public key) changes, the server device 100, which is the issuer, reissues a new portable and verifiable certificate with authentication information (pVC).

[0049] (2) The update or addition of a FIDO authentication public key (holder's public key) may be made by a request from the holder to the issuer. In this case, the server device 100, which is the issuer, performs identity verification and authentication using the currently registered FIDO authentication public key (holder's public key).

[0050] In addition, when only the FIDO authentication public key (holder's public key) is updated and the contents of the certificate remain unchanged, instead of the server device 100, which is the issuer, reissuing the portable and verifiable certificate with authentication information (pVC), the server device 200, which is the verifier, may inquire of the server device 100, which is the issuer, about a new authentication public key 2 (currently held by the holder) from the authentication public key 1 registered in the portable and verifiable certificate with authentication information (pVC). For example, the server device 200, which is the verifier, may be provided with an API and may cooperate with the server device 100, which is the issuer, to check several generations (past) of FIDO authentication public keys (holder's public keys) based on the key update history, etc.

[0051] (3) Alternatively, the issuer may issue a portable and verifiable certificate with authentication information (key update pVC) indicating an update of the FIDO authentication public key (holder's public key), and the holder may present the key update pVC to the verifier along with the original portable and verifiable certificate with authentication information (original pVC).

[0052] [2. Example of information processing system configuration] Next, a configuration of an information processing system 1 including a server device 100 according to an embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the configuration of the information processing system 1 according to an embodiment. As shown in Fig. 3, the information processing system 1 according to an embodiment includes a terminal device 10 and a server device 100. These various devices are connected to each other via a network N so as to be able to communicate with each other via a wired or wireless connection. The network N is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network) such as the Internet.

[0053] Furthermore, the number of devices included in the information processing system 1 shown in Fig. 3 is not limited to that shown in the figure. For example, in Fig. 3, for the sake of simplicity, only one terminal device 10 is shown, but this is merely an example and is not limiting, and two or more devices may be included.

[0054] The terminal device 10 is an information processing device used by a user U. For example, the terminal device 10 is a smart device such as a smartphone or a tablet terminal, a feature phone, a PC (Personal Computer), a PDA (Personal Digital Assistant), a game console or AV device with a communication function, a car navigation system, a wearable device such as a smart watch or a head-mounted display, smart glasses, etc.

[0055] In addition, the terminal device 10 can connect to the network N via a wireless communication network such as LTE (Long Term Evolution), 4G (4th Generation), or 5G (5th Generation: 5th generation mobile communication system), or via short-range wireless communication such as Bluetooth (registered trademark) or wireless LAN (Local Area Network), and communicate with the server device 100.

[0056] The server device 100 is, for example, a computer such as a PC or a blade server, or a mainframe or a workstation, etc. The server device 100 may be realized by cloud computing.

[0057] 3. Example of the configuration of the terminal device 10 Next, the configuration of the terminal device 10 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example configuration of the terminal device 10. As shown in Fig. 4, the terminal device 10 includes a communication unit 11, a display unit 12, an input unit 13, a positioning unit 14, a sensor unit 20, a control unit 30 (controller), and a storage unit 40.

[0058] (Communications Department 11) The communication unit 11 is connected to a network N (see FIG. 3) by wire or wirelessly, and transmits and receives information to and from the server device 100 via the network N. For example, the communication unit 11 is realized by a NIC (Network Interface Card), an antenna, etc.

[0059] (Display section 12) Display unit 12 is a display device that displays various information such as position information. For example, display unit 12 is a liquid crystal display (LCD) or an organic electro-luminescent display (OLED). Display unit 12 is also a touch panel display, but is not limited to this.

[0060] (Input section 13) The input unit 13 is an input device that accepts various operations from the user U. For example, the input unit 13 has buttons for inputting characters, numbers, etc. The input unit 13 may be an input / output port (I / O port), a USB (Universal Serial Bus) port, etc. If the display unit 12 is a touch panel display, a part of the display unit 12 functions as the input unit 13. The input unit 13 may be a microphone that accepts voice input from the user U. The microphone may be wireless.

[0061] (Positioning unit 14) The positioning unit 14 receives signals (radio waves) transmitted from satellites of a GPS (Global Positioning System), and acquires position information (e.g., latitude and longitude) indicating the current position of the terminal device 10, which is the device itself, based on the received signals. That is, the positioning unit 14 positions the position of the terminal device 10. Note that GPS is merely an example of a GNSS (Global Navigation Satellite System).

[0062] The positioning unit 14 can also measure the position using various methods other than GPS. For example, the positioning unit 14 may measure the position by using various communication functions of the terminal device 10 as an auxiliary positioning means for position correction, etc., as described below.

[0063] (Wi-Fi positioning) For example, the positioning unit 14 uses a Wi-Fi (registered trademark) communication function of the terminal device 10 or a communication network provided by each communication company to measure the position of the terminal device 10. Specifically, the positioning unit 14 performs Wi-Fi communication or the like and measures the distance to a nearby base station or access point, thereby measuring the position of the terminal device 10.

[0064] (Beacon positioning) The positioning unit 14 may also measure the position by using a Bluetooth (registered trademark) function of the terminal device 10. For example, the positioning unit 14 measures the position of the terminal device 10 by connecting to a beacon transmitter connected by the Bluetooth (registered trademark) function.

[0065] (geomagnetic positioning) The positioning unit 14 also measures the position of the terminal device 10 based on a geomagnetic pattern of a structure that has been measured in advance and a geomagnetic sensor that the terminal device 10 has.

[0066] (RFID positioning) Furthermore, for example, if the terminal device 10 has a function of an RFID (Radio Frequency Identification) tag equivalent to a contactless IC card used at station ticket gates, in stores, etc., or has a function of reading an RFID tag, the location where the terminal device 10 was used is recorded together with information on the payment or the like made by the terminal device 10. The positioning unit 14 may obtain such information to determine the location of the terminal device 10. Alternatively, the location may be determined by an optical sensor, an infrared sensor, or the like provided in the terminal device 10.

[0067] The positioning unit 14 may measure the position of the terminal device 10 using one or a combination of the above-mentioned positioning means, as needed.

[0068] (Sensor unit 20) The sensor unit 20 includes various sensors mounted on or connected to the terminal device 10. The connection may be wired or wireless. For example, the sensors may be detection devices other than the terminal device 10, such as wearable devices or wireless devices. In the example shown in FIG. 4, the sensor unit 20 includes an acceleration sensor 21, a gyro sensor 22, a barometric pressure sensor 23, a temperature sensor 24, a sound sensor 25, a light sensor 26, a magnetic sensor 27, and an image sensor (camera) 28.

[0069] The above-described sensors 21 to 28 are merely examples and are not intended to be limiting. That is, the sensor unit 20 may be configured to include some of the sensors 21 to 28, or may include other sensors such as a humidity sensor in addition to or instead of the sensors 21 to 28.

[0070] The acceleration sensor 21 is, for example, a three-axis acceleration sensor, and detects physical movements of the terminal device 10, such as the direction of movement, speed, and acceleration of the terminal device 10. The gyro sensor 22 detects physical movements of the terminal device 10, such as tilt in three axial directions, based on the angular velocity of the terminal device 10. The air pressure sensor 23 detects, for example, the air pressure around the terminal device 10.

[0071] Since the terminal device 10 includes the acceleration sensor 21, the gyro sensor 22, the atmospheric pressure sensor 23, etc., it is possible to measure the position of the terminal device 10 using a technique such as Pedestrian Dead-Reckoning (PDR) that uses these sensors 21 to 23. This makes it possible to obtain indoor position information that is difficult to obtain using a positioning system such as GPS.

[0072] For example, the number of steps, walking speed, and distance walked can be calculated using a pedometer that uses the acceleration sensor 21. In addition, the direction of travel, line of sight, and body tilt of the user U can be determined using the gyro sensor 22. In addition, the altitude and floor on which the terminal device 10 of the user U is located can be determined from the air pressure detected by the air pressure sensor 23.

[0073] The temperature sensor 24 detects, for example, the temperature around the terminal device 10. The sound sensor 25 detects, for example, the sound around the terminal device 10. The light sensor 26 detects the illuminance around the terminal device 10. The magnetic sensor 27 detects, for example, the geomagnetism around the terminal device 10. The image sensor 28 captures an image around the terminal device 10.

[0074] The above-mentioned air pressure sensor 23, temperature sensor 24, sound sensor 25, light sensor 26, and image sensor 28 can detect the air pressure, temperature, sound, and illuminance, respectively, and capture images of the surroundings, thereby detecting the environment and situation around the terminal device 10. Furthermore, the accuracy of the location information of the terminal device 10 can be improved based on the environment and situation around the terminal device 10.

[0075] (control unit 30) The control unit 30 includes, for example, a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM, input / output ports, etc., and various other circuits. The control unit 30 may also be configured with hardware such as an integrated circuit, for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 30 includes a transmitting unit 31, a receiving unit 32, and a processing unit 33.

[0076] (Transmitter 31) The transmission unit 31 can transmit, for example, various information input by the user U using the input unit 13, various information detected by each sensor 21 to 28 mounted on or connected to the terminal device 10, and location information of the terminal device 10 measured by the positioning unit 14 to the server device 100 via the communication unit 11.

[0077] (Receiving unit 32) The receiving unit 32 can receive various types of information provided by the server device 100 and requests for various types of information from the server device 100 via the communication unit 11.

[0078] In this embodiment, the transmitting unit 31 transmits a certificate issuance request to the server device 100, which is the issuer. The receiving unit 32 receives a user authentication request from the server device 100, which is the issuer, in response to the certificate issuance request. When user authentication is performed in response to the user authentication request from the server device 100, which is the issuer, the transmitting unit 31 transmits the authentication result to the server device 100, which is the issuer. The receiving unit 32 receives a portable and verifiable certificate with authentication information from the server device 100, which is the issuer, that stores certificate information related to the user's attributes and privileges, and authentication information indicating the authentication method performed on the user.

[0079] In addition, when FIDO authentication is performed on a user using an authentication device in response to a user authentication request from the issuer, server device 100, the transmission unit 31 signs a FIDO assertion with the user's private signing key as the authentication result and transmits it to the issuer, server device 100.

[0080] Furthermore, when the authentication public key used for user authentication is changed, the receiving unit 32 receives a newly reissued portable and verifiable certificate with authentication information.

[0081] Furthermore, the transmitting unit 31 may transmit to the server device 100, which is the issuer, a request to update or add an authentication public key used for authenticating a user.

[0082] When the public authentication key used to authenticate the user has changed since the portable and verifiable certificate with authentication information was issued, the presentation unit 34 presents the original portable and verifiable certificate with authentication information to the server device 200, which is the verifier, and also presents another portable and verifiable certificate with authentication information that indicates the update of the public authentication key used to authenticate the user.

[0083] (Processing unit 33) The processing unit 33 controls the entire terminal device 10, including the display unit 12. For example, the processing unit 33 can output various information transmitted by the transmitting unit 31 and various information received from the server device 100 by the receiving unit 32 to the display unit 12 for display.

[0084] The processing unit 33 may also perform authentication processing as an authenticator. For example, the processing unit 33 may perform user verification for the user U using a predetermined authentication means such as biometric authentication.

[0085] (Presentation part 34) The presenting unit 34 presents to the verifier a portable and verifiable certificate with authentication information that stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed on the user. For example, the presenting unit 34 may transmit the portable and verifiable certificate with authentication information to the server device 200, which is the verifier, via the communication unit 11, or may output it to the display unit 12 for display. The presenting unit 34 may be a part of the processing unit 33.

[0086] (Storage unit 40) The storage unit 40 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), an optical disk, etc. The storage unit 40 stores various programs, various data, etc.

[0087] In this embodiment, the storage unit 40 stores a portable and verifiable certificate with authentication information that stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed on the user. At this time, the storage unit 40 stores a portable and verifiable certificate with authentication information that stores the certificate information and authentication information including the authentication public key used for the user's FIDO authentication.

[0088] [4. Example of Issuer's Server Device Configuration] Next, the configuration of the server device 100 of the issuer according to the embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the configuration of the server device 100 according to the embodiment. As shown in Fig. 5, the server device 100 includes a communication unit 110, a storage unit 120, and a control unit 130.

[0089] (Communication unit 110) The communication unit 110 is realized by, for example, a network interface card (NIC), etc. The communication unit 110 is also connected to a network N (see FIG. 3) by wire or wirelessly.

[0090] (Storage unit 120) The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as an HDD, an SSD, an optical disk, etc. As shown in FIG. 5 , the storage unit 120 has a user information database 121, a history information database 122, and a certificate database 123.

[0091] (User Information Database 121) The user information database 121 stores user information about the user U. For example, the user information database 121 stores various information such as the attributes of the user U. FIG. 6 is a diagram showing an example of the user information database 121. In the example shown in FIG. 6, the user information database 121 has items such as "User ID (Identifier)," "Age," "Gender," "Home," "Workplace," and "Interests."

[0092] The "user ID" indicates identification information for identifying the user U. The "user ID" may be the contact information of the user U (telephone number, email address, etc.), or may be identification information for identifying the terminal device 10 of the user U.

[0093] Furthermore, "age" indicates the age of user U identified by the user ID. Note that "age" may be information indicating the specific age of user U (e.g., 35 years old), or may be information indicating the generation of user U (e.g., 30s). Alternatively, "age" may be information indicating the date of birth of user U, or may be information indicating the generation of user U (e.g., born in the 1980s). Furthermore, "gender" indicates the gender of user U identified by the user ID.

[0094] Furthermore, "home" indicates the location information of the home of user U identified by the user ID. In the example shown in FIG. 6, "home" is illustrated as an abstract code such as "LC11," but it may also be latitude and longitude information, etc. Furthermore, for example, "home" may also be the name of an area or an address.

[0095] Furthermore, "workplace" indicates location information of the workplace (school in the case of a student) of user U identified by the user ID. In the example shown in FIG. 6, "workplace" is illustrated as an abstract code such as "LC12," but it may also be latitude and longitude information, etc. Furthermore, for example, "workplace" may also be the name of a region or an address.

[0096] Furthermore, "interests" indicate the interests of user U identified by the user ID. In other words, "interests" indicate subjects in which user U identified by the user ID is highly interested. For example, "interests" may be search queries (keywords) that user U input into a search engine. In the example shown in FIG. 6, each user U has one "interest," but there may be multiple "interests."

[0097] For example, in the example shown in FIG. 6, the age of user U identified by user ID "U1" is "20s" and the gender is "male." Furthermore, for example, the home address of user U identified by user ID "U1" is "LC11." Furthermore, for example, the workplace of user U identified by user ID "U1" is "LC12." Furthermore, for example, the user U identified by user ID "U1" is interested in "sports."

[0098] 6, abstract values ​​such as "U1", "LC11", and "LC12" are used for illustration, but "U1", "LC11", and "LC12" are assumed to store information such as specific character strings and numerical values. Below, abstract values ​​may also be illustrated in diagrams relating to other information.

[0099] The user information database 121 may store various types of information depending on the purpose, without being limited to the above. For example, the user information database 121 may store various types of information related to the terminal device 10 of the user U. The user information database 121 may also store information related to the user U's attributes, such as demographic attributes, psychographic attributes, geographic attributes, and behavioral attributes. For example, the user information database 121 may store information such as name, family structure, hometown (hometown), occupation, job title, income, qualifications, type of residence (detached house, apartment, etc.), whether or not the user has a car, commuting time, commuting route, commuter pass area (station, line, etc.), frequently used stations (other than the station nearest to home or workplace), extracurricular activities (location, time zone, etc.), hobbies, interests, lifestyle, etc.

[0100] (History Information Database 122) The history information database 122 stores various information related to history information (log data) that indicates the behavior of the user U. Fig. 7 is a diagram showing an example of the history information database 122. In the example shown in Fig. 7, the history information database 122 has items such as "user ID," "location history," "search history," "browsing history," "purchase history," and "posting history."

[0101] "User ID" indicates identification information for identifying user U. "Location history" indicates the location history, which is the history of user U's location and movements. "Search history" indicates the search history, which is the history of search queries entered by user U. "Browsing history" indicates the browsing history, which is the history of content viewed by user U. "Purchase history" indicates the purchase history, which is the history of purchases made by user U. "Posting history" indicates the posting history, which is the history of posts made by user U. "Posting history" may also include questions about user U's possessions.

[0102] For example, in the example shown in Figure 7, user U, identified by user ID "U1," moved as shown in "Location History #1," searched as shown in "Search History #1," viewed content as shown in "Viewing History #1," purchased specific products at specific stores as shown in "Purchase History #1," and posted as shown in "Posting History."

[0103] Here, in the example shown in Figure 7, abstract values ​​such as "U1," "Location History #1," "Search History #1," "Browsing History #1," "Purchase History #1," and "Post History #1" are used for the illustration, but "U1," "Location History #1," "Search History #1," "Browsing History #1," "Purchase History #1," and "Post History #1" are assumed to store specific information such as character strings and numbers.

[0104] The history information database 122 is not limited to the above and may store various types of information depending on the purpose. For example, the history information database 122 may store the user U's usage history of a predetermined service. The history information database 122 may also store the user U's store visit history or facility visit history. The history information database 122 may also store the user U's payment history (electronic payment) using the terminal device 10.

[0105] (Certificate Database 123) Certificate database 123 stores various information related to history information (log data) showing the actions of user U. Fig. 8 is a diagram showing an example of certificate database 123. In the example shown in Fig. 8, certificate database 123 has items such as "user ID," "certificate information," "authentication information," "public key," and "certificate."

[0106] "User ID" indicates identification information for identifying user U.

[0107] Furthermore, "certificate information" refers to certificate information related to "attributes and privileges." Certificate information related to "attributes and privileges" is not limited to information related to the attributes and identity of user U, but also includes information related to user U's privileges and qualifications.

[0108] Additionally, "authentication information" indicates authentication information related to the "authentication / identity verification context." Authentication information related to the "authentication / identity verification context" indicates information such as whether user U was FIDO authenticated, whether their identity was verified in person, or whether delivery was confirmed via SMS.

[0109] Furthermore, the "public key" indicates identification information for identifying the public key (holder's public key) used for the user's FIDO authentication. The "public key" may store the holder's public key. The "public key" may also be included in the "authentication information."

[0110] Furthermore, a "certificate" refers to identification information for identifying a portable and verifiable certificate with authentication information that stores certificate information and authentication information. Note that a "certificate" may also store a portable and verifiable certificate with authentication information.

[0111] Here, in the example shown in Figure 8, abstract values ​​such as "U1," "certificate information #1," "authentication information #1," "public key #1," and "certificate #1" are used for the illustration, but "U1," "certificate information #1," "authentication information #1," "public key #1," and "certificate #1" are assumed to store specific information such as character strings and numbers.

[0112] The certificate database 123 may store various types of information depending on the purpose, not limited to the above. For example, the certificate database 123 may store information about a challenge sent when requesting authentication to the user U. The certificate database 123 may also store information about the registration and authentication of the user U, such as an attestation (birth certificate of the terminal / authentication device) and an assertion (authentication proof of the user's identity).

[0113] (control unit 130) Returning to Fig. 5, the explanation will be continued. The control unit 130 is a controller, and is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like, by executing various programs (corresponding to an example of an information processing program) stored in a storage device inside the server device 100 using a storage area such as a RAM as a working area. In the example shown in Fig. 5, the control unit 130 has an acquisition unit 131, an authentication processing unit 132, an issuing unit 133, and a providing unit 134.

[0114] (Acquisition part 131) The acquisition unit 131 acquires a search query input by the user U. For example, when the user U inputs a search query into a search engine or the like to perform a keyword search, the acquisition unit 131 acquires the search query via the communication unit 110. That is, the acquisition unit 131 acquires, via the communication unit 110, the keywords input by the user U into the search box of a search engine, website, or app.

[0115] Furthermore, the acquisition unit 131 acquires user information about the user U via the communication unit 110. For example, the acquisition unit 131 acquires identification information (such as a user ID) indicating the user U, location information of the user U, attribute information of the user U, etc. from the terminal device 10 of the user U. Furthermore, the acquisition unit 131 may acquire the identification information indicating the user U, attribute information of the user U, etc. when registering the user U. Then, the acquisition unit 131 registers the user information in the user information database 121 of the storage unit 120.

[0116] Furthermore, the acquisition unit 131 acquires various types of history information (log data) indicating the behavior of the user U via the communication unit 110. For example, the acquisition unit 131 acquires various types of history information indicating the behavior of the user U from the terminal device 10 of the user U or from various servers based on the user ID or the like. Then, the acquisition unit 131 registers the various types of history information in the history information database 122 of the storage unit 120.

[0117] The acquisition unit 131 also acquires a certificate issuance request from the terminal device 10 of the user U via the communication unit 110.

[0118] (Authentication processing unit 132) The authentication processing unit 132 performs authentication on the user U. In this embodiment, the authentication processing unit 132 performs FIDO authentication on the user U. For example, in response to a certificate issuance request from the terminal device 10 of the user U, the authentication processing unit 132 requests user authentication from the terminal device 10 of the user U, which is an authenticator, and sends a challenge. The challenge is a random string of characters 16 or more characters long for verifying the validity of the signature. When the authentication processing unit 132 receives a challenge signed with the private key of the user U from the terminal device 10 of the user U, the authentication processing unit 132 verifies the signature with the public key of the user U, and if the signature verification is successful, determines that the identity of the user U has been confirmed by FIDO authentication.

[0119] In response to a request from the user to update or add an authentication public key, the authentication processing unit 132 performs identity verification and authentication again using the currently registered authentication public key.

[0120] (Issued 133) If the identity of user U can be confirmed through FIDO authentication, the issuing unit 133 issues a certificate to the terminal device 10 of user U. In this embodiment, the issuing unit 133 issues a portable and verifiable certificate with authentication information that stores certificate information related to the attributes and privileges of user U and authentication information indicating the authentication method performed on user U.

[0121] At this time, the issuing unit 133 issues a portable and verifiable certificate with authentication information that stores certificate information and authentication information including an authentication public key used for FIDO authentication of the user U. In other words, the authentication information includes the authentication public key used for FIDO authentication of the user U.

[0122] Furthermore, the issuing unit 133 signs the entire portable and verifiable certificate with authentication information, which stores the certificate information and authentication information, with the issuer's (itself) private signature key.

[0123] When the authentication public key used for user authentication changes, the issuing unit 133 reissues a new certificate with portable and verifiable authentication information.

[0124] The issuing unit 133 may update or add an authentication public key used for user authentication in response to a request from the user.

[0125] For example, when the authentication processing unit 132 performs identity verification and authentication using the currently registered authentication public key in response to a request from a user to update or add an authentication public key, if the authentication is successful, the issuing unit 133 updates or adds the authentication public key used to authenticate the user.

[0126] In addition, when the authentication public key used for authenticating a user changes, the issuing unit 133 may issue a different portable and verifiable certificate with authentication information indicating the update of the authentication public key used for authenticating a user.

[0127] (Provider 134) The providing unit 134 provides a portable and verifiable certificate with authentication information to the terminal device 10 of the user U via the communication unit 110. That is, the providing unit 134 provides the user U with a portable and verifiable certificate with authentication information.

[0128] [5. Example of Verifier's Server Device Configuration] Next, the configuration of the server device 200 of the verifier according to the embodiment will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the configuration of the server device 200 according to the embodiment. As shown in Fig. 9, the server device 200 includes a communication unit 210, a storage unit 220, and a control unit 230.

[0129] (Communication unit 210) The communication unit 210 is realized by, for example, a network interface card (NIC), etc. The communication unit 210 is also connected to a network N (see FIG. 3) by wire or wirelessly.

[0130] (Storage unit 220) The storage unit 220 is realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as an HDD, an SSD, or an optical disk.

[0131] (control unit 230) The control unit 230 is a controller, and is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like, executing various programs (corresponding to an example of an information processing program) stored in a storage device inside the server device 200 using a storage area such as a RAM as a working area. In the example shown in FIG. 9, the control unit 230 has an acquisition unit 231 and an authentication processing unit 232.

[0132] (Acquisition part 231) The acquisition unit 231 acquires the portable and verifiable certificate with authentication information when the holder presents the portable and verifiable certificate with authentication information, which stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed on the user. For example, the acquisition unit 231 acquires the portable and verifiable certificate with authentication information, which stores certificate information and authentication information including an authentication public key used for the user's FIDO authentication. The acquisition unit 231 may also store the acquired portable and verifiable certificate with authentication information in the storage unit 220.

[0133] (Authentication processing unit 232) The authentication processing unit 232 authenticates the holder using the authentication method indicated in the authentication information. That is, the authentication processing unit 232 authenticates the holder using the same authentication method as that used for the user who requested the issuance of the certificate when it was issued. For example, when the authentication processing unit 232 performs FIDO authentication on the holder, it verifies the holder's signature using the authentication public key used for the user's FIDO authentication.

[0134] In addition, if the authentication public key currently held by the holder is different from the authentication public key registered in the portable and verifiable certificate with authentication information, the authentication processing unit 232 queries the issuer of the portable and verifiable certificate with authentication information for a new authentication public key currently held by the holder from the authentication public keys registered in the portable and verifiable certificate with authentication information (pVC).

[0135] At this time, the authentication processing unit 232 may cooperate with the issuer via an API to check past authentication public keys retroactively.

[0136] In addition, when the public authentication key used to authenticate the user changes after the portable and verifiable certificate with authentication information is issued, the acquisition unit 231 acquires, together with the original portable and verifiable certificate with authentication information, another portable and verifiable certificate with authentication information that indicates the update of the public authentication key used to authenticate the user.

[0137] [6. Processing Procedure] Next, the processing procedures performed by the terminal device 10, the server device 100, and the server device 200 according to the embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing the processing procedures according to the embodiment. Note that the processing procedures shown below are repeatedly executed by the control unit 30 of the terminal device 10, the control unit 130 of the server device 100, and the control unit 230 of the server device 200.

[0138] As shown in FIG. 10, the acquisition unit 131 of the server device 100 acquires a certificate issuance request from the terminal device 10 of the user U via the communication unit 110 (step S101).

[0139] Next, the authentication processing unit 132 of the server device 100 requests user authentication from the terminal device 10 of the user U, which is the authenticator, via the communication unit 110 (step S102). For example, in response to a request for issuance of a certificate from the terminal device 10 of the user U, the authentication processing unit 132 requests user authentication from the terminal device 10 of the user U, which is the authenticator, and transmits a challenge. The challenge is a random character string having a length of 16 characters or more for verifying the validity of the signature.

[0140] Next, the authentication processing unit 132 of the server device 100 receives a FIDO assertion (assertion: authentication proof of identity) from the terminal device 10 of the user U via the communication unit 110 (step S103). For example, when the authentication processing unit 132 receives a challenge signed with the private key of the user U from the terminal device 10 of the user U, the authentication processing unit 132 verifies the signature with the public key of the user U, and if the signature verification is successful, determines that the identity of the user U has been confirmed by FIDO authentication.

[0141] Next, if the identity of user U can be confirmed through FIDO authentication, the issuing unit 133 of the server device 100 issues a portable and verifiable certificate with authentication information that stores certificate information related to the attributes and privileges of user U and authentication information that indicates the authentication method performed on user U (step S104). The authentication information includes an authentication public key used for FIDO authentication of user U. In addition, the issuing unit 133 signs the entire portable and verifiable certificate with authentication information that stores the certificate information and authentication information with the issuer's (itself) signature private key.

[0142] Next, when the holder presents a portable and verifiable certificate with authentication information that stores certificate information regarding the user's attributes and privileges and authentication information indicating the authentication method performed on the user, the acquisition unit 231 of the server device 200 acquires the portable and verifiable certificate with authentication information (step S105).

[0143] Next, the authentication processing unit 232 of the server device 200 verifies the portable and verifiable certificate with authentication information (step S106). For example, the authentication processing unit 232 verifies the signature attached to the portable and verifiable certificate with authentication information using the issuer's public key.

[0144] Next, if the signature verification is successful, the authentication processing unit 232 of the server device 200 performs FIDO authentication on the holder via the communication unit 110, using the same authentication method as indicated in the authentication information (step S107). In this embodiment, the authentication processing unit 232 requests user authentication from the holder's terminal device 10, which is the authenticator, via the communication unit 110, and transmits a challenge. That is, the authentication processing unit 232 performs authentication on the holder using the same authentication method as that performed on the user who requested issuance of the certificate when it was issued. This allows the [verifier] to perform authentication on the [holder who presented the certificate] using the same authentication method as that performed by the [issuer] on the [user U who requested issuance of the certificate].

[0145] Next, the authentication processing unit 232 of the server device 200 receives a FIDO assertion (assertion: authentication proof of identity) from the holder's terminal device 10 via the communication unit 110 (step S108). For example, the authentication processing unit 132 receives a challenge signed with the holder's private key from the holder's terminal device 10 via the communication unit 110.

[0146] Next, the authentication processing unit 232 of the server device 200 verifies the identity of the holder (step S109). For example, the authentication processing unit 132 verifies the signature with the public key of the user U in response to a challenge signed with the private key of the holder, and if the signature verification is successful, determines that the identity of the holder (that is, the holder is user U) has been confirmed by FIDO authentication.

[0147] In this way, by providing a certificate with authentication information that includes the public key of the user that the issuer used when issuing the certificate, the identity of the user can be confirmed at the time of verification using the same public key as when the certificate was issued. This makes it possible to confirm that the user at the time of issuing the certificate is the same as the holder at the time of verification.

[0148] [7. Modifications] The terminal device 10 and the server device 100 described above may be implemented in various different forms other than the above embodiment. Therefore, modifications of the embodiment will be described below.

[0149] In the above embodiment, some or all of the processing executed by the server device 100 may actually be executed by the terminal device 10. For example, the processing may be completed in a stand-alone manner (by the terminal device 10 alone). In this case, the terminal device 10 is assumed to have the functions of the server device 100 in the above embodiment. Furthermore, in the above embodiment, the terminal device 10 is linked to the server device 100, and therefore, from the perspective of the user U, it appears that the processing of the server device 100 is also being executed by the terminal device 10. In other words, from another perspective, the terminal device 10 can also be said to be equipped with the server device 100.

[0150] In the above embodiment, some or all of the processes executed by server apparatus 100 may actually be executed by server apparatus 200. Alternatively, some or all of the processes executed by server apparatus 200 may actually be executed by server apparatus 100. Furthermore, server apparatus 100 and server apparatus 200 may be server apparatuses with the same configuration. That is, the same server apparatus may include both the components of server apparatus 100 shown in FIG. 5 and the components of server apparatus 200 shown in FIG. 9.

[0151] Furthermore, in the above embodiment, the terminal device 10, which is the authenticator, may transmit information about an authentication method such as biometric authentication performed on the user U, to the server device 100, which is the issuer, along with a FIDO assertion. Furthermore, the server device 100, which is the issuer, may store information about the authentication method notified from the terminal device 10, which is the authenticator, in authentication information related to the "authentication / identification context."

[0152] [8. Effects] As described above, the first information processing device (server device 100) according to the present application is an information processing device that acts as a certificate issuer, and includes an authentication processing unit 132 that performs authentication on a user, an issuing unit 133 that issues a portable and verifiable certificate with authentication information that stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed on the user, and a providing unit 134 that provides the portable and verifiable certificate with authentication information to the user.

[0153] The authentication processing unit 132 performs FIDO authentication on the user. The issuing unit 133 issues a portable and verifiable certificate with authentication information that stores certificate information and authentication information including an authentication public key used for FIDO authentication of the user.

[0154] The issuing unit 133 signs the entire portable and verifiable certificate with authentication information, which stores the certificate information and authentication information, with the issuer's signature private key.

[0155] When the authentication public key used for user authentication changes, the issuing unit 133 reissues a new certificate with portable and verifiable authentication information.

[0156] The issuing unit 133 updates or adds an authentication public key used for user authentication in response to a request from the user.

[0157] In response to a request from the user to update or add a public authentication key, the authentication processing unit 132 performs identity verification and authentication using the currently registered public authentication key. If the authentication is successful, the issuing unit 133 updates or adds the public authentication key used for authenticating the user.

[0158] When the authentication public key used for user authentication changes, the issuing unit 133 issues a different portable and verifiable certificate with authentication information indicating the update of the authentication public key used for user authentication.

[0159] The second information processing device (terminal device 10) of the present application is an information processing device on the certificate holder side, and is equipped with a memory unit 40 that stores a portable and verifiable certificate with authentication information that stores certificate information regarding the user's attributes and authority and authentication information that indicates the authentication method performed on the user, and a presentation unit 34 that presents the portable and verifiable certificate with authentication information to a verifier.

[0160] The storage unit 40 stores a portable and verifiable certificate with authentication information, which stores certificate information and authentication information including an authentication public key used for FIDO authentication of a user.

[0161] The second information processing device according to the present application further includes a transmitter 31 that transmits a certificate issuance request to an issuer, and a receiver 32 that receives a user authentication request from the issuer in response to the certificate issuance request. When user authentication is performed in response to the user authentication request from the issuer, the transmitter 31 transmits an authentication result to the issuer. The receiver 32 receives from the issuer a portable and verifiable certificate with authentication information that stores certificate information related to the user's attributes and privileges, and authentication information indicating the authentication method performed on the user.

[0162] When FIDO authentication is performed on a user using an authentication device in response to a user authentication request from an issuer, the transmission unit 31 signs a FIDO assertion with the user's private signing key as the authentication result and transmits it to the issuer.

[0163] When the authentication public key used for user authentication is changed, the receiving unit 32 receives a newly reissued portable and verifiable certificate with authentication information.

[0164] The sending unit 31 sends to the issuer a request for updating or adding an authentication public key used for authenticating a user.

[0165] When the public authentication key used to authenticate the user has changed since the portable and verifiable certificate with authentication information was issued, the presentation unit 34 presents the original portable and verifiable certificate with authentication information to the verifier, and also presents another portable and verifiable certificate with authentication information that indicates the update of the public authentication key used to authenticate the user.

[0166] The third information processing device (server device 200) according to the present application is an information processing device that serves as a certificate verifier, and includes an acquisition unit 231 that acquires a portable and verifiable certificate with authentication information when the certificate holder presents the portable and verifiable certificate with authentication information, which stores certificate information related to the user's attributes and authority and authentication information indicating the authentication method performed on the user, and an authentication processing unit 232 that authenticates the holder using the authentication method indicated in the authentication information.

[0167] The acquisition unit 231 acquires a portable and verifiable certificate with authentication information that stores certificate information and authentication information including an authentication public key used for FIDO authentication of the user. When FIDO authentication is performed on the holder, the authentication processing unit 232 verifies the holder's signature with the authentication public key used for FIDO authentication of the user.

[0168] If the authentication public key currently held by the holder is different from the authentication public key registered in the portable and verifiable certificate with authentication information, the authentication processing unit 232 queries the issuer of the portable and verifiable certificate with authentication information for a new authentication public key currently held by the holder from the authentication public keys registered in the portable and verifiable certificate with authentication information (pVC).

[0169] The authentication processing unit 232 cooperates with the issuer via an API and checks past authentication public keys retroactively.

[0170] When the public authentication key used for user authentication is changed after the portable and verifiable certificate with authentication information is issued, the acquisition unit 231 acquires another portable and verifiable certificate with authentication information that indicates the update of the public authentication key used for user authentication, along with the original portable and verifiable certificate with authentication information.

[0171] By performing any one or a combination of the above-described processes, the information processing device according to the present application can provide a portable and verifiable certificate with authentication information.

[0172] [9. Hardware Configuration] The terminal device 10 and the server device 100 according to the above-described embodiments are realized by a computer 1000 having a configuration as shown in Fig. 11, for example. The following description will be given taking the server device 100 as an example. Fig. 11 is a diagram showing an example of a hardware configuration. The computer 1000 is connected to an output device 1010 and an input device 1020, and has a configuration in which a calculation device 1030, a primary storage device 1040, a secondary storage device 1050, an output I / F (Interface) 1060, an input I / F 1070, and a network I / F 1080 are connected via a bus 1090.

[0173] The arithmetic device 1030 operates based on programs stored in the primary storage device 1040 and the secondary storage device 1050, programs read from the input device 1020, and the like, and executes various processes. The arithmetic device 1030 is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like.

[0174] The primary storage device 1040 is a memory device such as a RAM (Random Access Memory) that temporarily stores data used by the arithmetic device 1030 for various calculations. The secondary storage device 1050 is a storage device in which data used by the arithmetic device 1030 for various calculations and various databases are registered, and is realized by a ROM (Read Only Memory), an HDD (Hard Disk Drive), an SSD (Solid State Drive), a flash memory, or the like. The secondary storage device 1050 may be an internal storage device or an external storage device. The secondary storage device 1050 may also be a removable storage medium such as a USB (Universal Serial Bus) memory or an SD (Secure Digital) memory card. The secondary storage device 1050 may also be cloud storage (online storage), a NAS (Network Attached Storage), a file server, or the like.

[0175] The output I / F 1060 is an interface for transmitting information to be output to an output device 1010 that outputs various types of information, such as a display, a projector, a printer, etc., and is realized by a connector conforming to a standard such as USB (Universal Serial Bus), DVI (Digital Visual Interface), or HDMI (High Definition Multimedia Interface), etc. The input I / F 1070 is an interface for receiving information from various input devices 1020, such as a mouse, a keyboard, a keypad, a button, a scanner, etc., and is realized by a USB, etc.

[0176] Furthermore, the output I / F 1060 and the input I / F 1070 may be wirelessly connected to the output device 1010 and the input device 1020, respectively. That is, the output device 1010 and the input device 1020 may be wireless devices.

[0177] The output device 1010 and the input device 1020 may be integrated into one device, such as a touch panel. In this case, the output I / F 1060 and the input I / F 1070 may also be integrated into one device as an input / output I / F.

[0178] The input device 1020 may be a device that reads information from, for example, an optical recording medium such as a CD (Compact Disc), a DVD (Digital Versatile Disc), or a PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

[0179] The network I / F 1080 receives data from other devices via the network N and sends it to the arithmetic device 1030, and also transmits data generated by the arithmetic device 1030 to other devices via the network N.

[0180] The arithmetic unit 1030 controls the output device 1010 and the input device 1020 via the output I / F 1060 and the input I / F 1070. For example, the arithmetic unit 1030 loads a program from the input device 1020 or the secondary storage device 1050 onto the primary storage device 1040 and executes the loaded program.

[0181] For example, when the computer 1000 functions as the server device 100, the arithmetic unit 1030 of the computer 1000 executes a program loaded onto the primary storage device 1040 to realize the functions of the control unit 130. The arithmetic unit 1030 of the computer 1000 may also load a program acquired from another device via the network I / F 1080 onto the primary storage device 1040 and execute the loaded program. The arithmetic unit 1030 of the computer 1000 may also cooperate with the other device via the network I / F 1080 to call and use the functions and data of a program from another program of the other device.

[0182] [10. Other] Although the embodiments of the present application have been described above, the present invention is not limited to the contents of these embodiments. Furthermore, the above-described components include those that can be easily imagined by a person skilled in the art, those that are substantially the same, and those that are within the scope of so-called equivalents. Furthermore, the above-described components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the spirit of the above-described embodiments.

[0183] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0184] Furthermore, the components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0185] For example, the above-mentioned server device 100 may be realized by multiple server computers, and depending on the function, the configuration can be flexibly changed, such as by calling an external platform using an API (Application Programming Interface) or network computing.

[0186] Furthermore, the above-described embodiments and modifications can be combined as appropriate within the scope of not causing any contradiction in the processing content.

[0187] Furthermore, the above-mentioned "section, module, unit" can be read as "means" or "circuit," etc. For example, an acquisition unit can be read as an acquisition means or an acquisition circuit. [Explanation of symbols]

[0188] 1. Information Processing Systems 10 Terminal Equipment 34 Presentation part 100 Server device (issuer) 110 Communications Department 120 Storage section 121 User Information Database 122 Historical Information Database 123 Certificate Database 130 Control Unit 131 Acquisition Department 132 Authentication processing section 133 Publishing Department 134 Provision Department 200 Server device (verifier) 210 Communications Department 220 Storage section 230 Control Unit 231 Acquisition Department 232 Authentication processing section

Claims

1. An information processing device as a certificate issuer, an authentication processing unit that performs authentication on a user; an issuing unit that issues a portable and verifiable certificate with authentication information, the certificate information relating to the user's attributes and privileges and authentication information indicating the authentication method performed on the user; a providing unit that provides the portable and verifiable certificate with authentication information to the user; Equipped with The authentication processing unit performs FIDO authentication on the user, The issuing unit issues the portable and verifiable certificate with authentication information, which stores the certificate information and the authentication information including an authentication public key used for FIDO authentication of the user.

1. An information processing device comprising:

2. The issuing unit signs the entire portable and verifiable certificate with authentication information, which stores the certificate information and the authentication information, with the issuer's private signing key.

2. The information processing apparatus according to claim 1, wherein:

3. The issuing unit reissues the portable and verifiable certificate with authentication information when the authentication public key used for authenticating the user changes.

3. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer.

4. The issuing unit updates or adds an authentication public key used for authenticating the user in response to a request from the user.

4. The information processing device according to claim 1, wherein the information processing device is a computer.

5. the authentication processing unit, in response to a request from the user to update or add an authentication public key, performs identity verification and authentication again using the currently registered authentication public key; If the authentication is successful, the issuing unit updates or adds an authentication public key used for authenticating the user.

5. The information processing apparatus according to claim 4,

6. When the authentication public key used for authenticating the user changes, the issuing unit issues another portable and verifiable certificate with authentication information indicating the update of the authentication public key used for authenticating the user.

6. The information processing device according to claim 1, wherein the information processing device is a computer.

7. An information processing device on the certificate holder side, a storage unit for storing a portable and verifiable certificate with authentication information, the portable and verifiable certificate storing certificate information relating to a user's attributes and privileges and authentication information indicating an authentication method performed on the user; a presentation unit that presents the portable and verifiable certificate with authentication information to a verifier; Equipped with The storage unit stores the portable and verifiable certificate with authentication information, which stores the certificate information and the authentication information including an authentication public key used for FIDO authentication of the user.

1. An information processing device comprising:

8. a transmitter for transmitting a certificate issuance request to an issuer; a receiving unit that receives a user authentication request from the issuer in response to the certificate issuance request; Furthermore, the transmitting unit transmits an authentication result to the issuer when user authentication is performed in response to the user authentication request from the issuer; The receiving unit receives from the issuer a portable and verifiable certificate with authentication information, which stores certificate information relating to the user's attributes and privileges and authentication information indicating an authentication method performed on the user.

8. The information processing apparatus according to claim 7,

9. When FIDO authentication is performed on the user using an authenticator in response to the user authentication request from the issuer, the sending unit signs a FIDO assertion with the user's private signing key as the authentication result and sends the FIDO assertion to the issuer.

9. The information processing apparatus according to claim 8,

10. When the authentication public key used for authenticating the user is changed, the receiving unit receives a newly reissued portable and verifiable certificate with authentication information.

10. The information processing device according to claim 8, wherein the information processing device is a computer.

11. The sending unit sends a request to the issuer to update or add an authentication public key used to authenticate the user.

11. The information processing device according to claim 8, wherein the information processing device is a computer.

12. When the public authentication key used to authenticate the user has changed since the portable and verifiable certificate with authentication information was issued, the presenting unit presents the original portable and verifiable certificate with authentication information to the verifier, and also presents another portable and verifiable certificate with authentication information indicating an update of the public authentication key used to authenticate the user.

12. The information processing device according to claim 7, wherein the information processing device is a computer.

13. An information processing device as a certificate verifier, an acquisition unit that acquires a portable and verifiable certificate with authentication information when the certificate holder presents the portable and verifiable certificate with authentication information, the portable and verifiable certificate storing certificate information related to a user's attributes and privileges and authentication information indicating an authentication method performed on the user; an authentication processing unit that performs authentication on the holder using the authentication method indicated in the authentication information; An information processing device comprising:

14. the acquisition unit acquires the portable and verifiable certificate with authentication information, which stores the certificate information and the authentication information including an authentication public key used for FIDO authentication of the user; When the authentication processing unit performs FIDO authentication on the holder, it verifies the signature of the holder with an authentication public key used for FIDO authentication of the user.

14. The information processing apparatus according to claim 13,

15. When the authentication public key currently held by the holder is different from the authentication public key registered in the portable and verifiable certificate with authentication information, the authentication processing unit inquires of the issuer of the portable and verifiable certificate with authentication information about a new authentication public key currently held by the holder from the authentication public keys registered in the portable and verifiable certificate with authentication information.

15. The information processing device according to claim 13 or 14.

16. The authentication processing unit cooperates with the issuer of the portable and verifiable certificate with authentication information via an API, and checks past public keys for authentication retroactively.

16. The information processing device according to claim 13, wherein the information processing device is a computer.

17. When the public key for authentication used to authenticate the user has changed since the portable and verifiable certificate with authentication information was issued, the acquisition unit acquires another portable and verifiable certificate with authentication information indicating an update of the public key for authentication used to authenticate the user, together with the original portable and verifiable certificate with authentication information.

17. The information processing device according to claim 13, wherein the information processing device is a computer.

18. An information processing method executed by an information processing device as a certificate issuer, comprising: an authentication processing step for authenticating a user; an issuing step of issuing a portable and verifiable certificate with authentication information, the certificate storing certificate information relating to the user's attributes and privileges and authentication information indicating the authentication method performed on the user; a providing step of providing the portable and verifiable certificate with authentication information to the user; Including, In the authentication processing step, FIDO authentication is performed on the user, In the issuing step, the portable and verifiable certificate with authentication information is issued, which stores the certificate information and the authentication information including the authentication public key used for FIDO authentication of the user.

1. An information processing method comprising:

19. An information processing method executed by an information processing device on the certificate holder side, comprising: a management process for storing a portable and verifiable certificate with authentication information, which stores certificate information related to the user's attributes and privileges and authentication information indicating the authentication method performed on the user; a presentation step of presenting the portable and verifiable certificate with authentication information to a verifier; Including, In the management step, the portable and verifiable certificate with authentication information is stored, which stores the certificate information and the authentication information including the authentication public key used for FIDO authentication of the user.

1. An information processing method comprising:

20. An information processing method executed by an information processing device as a certificate verifier, comprising: an acquisition step of acquiring a portable and verifiable certificate with authentication information when the certificate holder presents the portable and verifiable certificate with authentication information, the portable and verifiable certificate storing certificate information related to a user's attributes and privileges and authentication information indicating an authentication method performed on the user; an authentication processing step of authenticating the holder using the authentication method indicated in the authentication information; An information processing method comprising:

21. an authentication procedure for authenticating a user; an issuing procedure for issuing a portable and verifiable certificate with authentication information, the certificate storing certificate information relating to the user's attributes and privileges and authentication information indicating the authentication method performed on the user; a provision step of providing the portable and verifiable certificate with authentication information to the user; An information processing program for causing a computer acting as a certificate issuer to execute the above, In the authentication process, FIDO authentication is performed on the user; In the issuing procedure, the portable and verifiable certificate with authentication information is issued, which stores the certificate information and the authentication information including the authentication public key used for FIDO authentication of the user. An information processing program characterized by:

22. a management procedure for storing a portable and verifiable certificate with authentication information, which stores certificate information related to a user's attributes and privileges and authentication information indicating the authentication method performed on the user; a presentation step of presenting the portable and verifiable certificate with authentication information to a verifier; An information processing program for causing a certificate holder's computer to execute the above, In the management procedure, the portable and verifiable certificate with authentication information is stored, which stores the certificate information and the authentication information including the authentication public key used for FIDO authentication of the user. An information processing program characterized by:

23. an acquisition step of acquiring a portable and verifiable certificate with authentication information when the certificate holder presents the portable and verifiable certificate with authentication information, the portable and verifiable certificate storing certificate information related to a user's attributes and privileges and authentication information indicating an authentication method performed on the user; an authentication processing procedure for authenticating the holder using the authentication method indicated in the authentication information; An information processing program for causing a computer acting as a certificate verifier to execute the above.

Images