Information processing device

Abstract

This information processing device comprises: a determination unit that determines whether or not a digital identity matching requirement information received from a service provider device is held; a request processing unit that, if it is determined that the digital identity is not held, transmits a digital identity request including the requirement information to an issuer device, and receives the digital identity from the issuer device; and a presentation unit that presents the digital identity to the service provider device.

Description

Information processing device

[0001] The present invention relates to Self-Sovereign Identity (SSI) technology.

[0002] Self-sovereign identity (SSI) technology is being considered, which allows users to manage their own identifiers and identities and control who receives them, without relying on a centralized identity provider (IdP) or the like (e.g., Non-Patent Documents 1 and 2).

[0003] In the world of SSI, there are three parties: Holders, such as users who manage / hold their own digital identities (W3C DID, VC, etc.) in digital identity wallets; Issuers, who certify attribute information, qualification information, etc. from Holders and issue them as attribute / qualification certificates (e.g., VCs (Verifiable Credentials)); and Verifiers, who verify the Holder's attributes, qualifications, etc. by requesting and receiving attribute / qualification certificates containing the Holder's identity information necessary for providing services from the Holder, and make decisions on providing services, etc.

[0004] W3C DID, https: / / www.w3.org / TR / did-core / W3C VC, https: / / www.w3.org / TR / vc-data-model / DIF Presentation Exchange, https: / / identity.foundation / presentation-exchange / DIF Issue Credential, https: / / github.com / decentralized-identity / waci-didcomm / blob / main / issue_credential / README.mdDIF Credential Manifest, https: / / identity.foundation / credential-manifest /

[0005] For example, in the specification of DIF Presentation Exchange (Non-Patent Document 3), the Verifier notifies the Holder of the requirements for the VC / VP (Verifiable Presentation) that the Holder wants to send in the Presentation Definition, and the Holder is expected to select a VC that meets the requirements from among the VCs it owns, convert it into a VP as necessary, and then present it to the Verifier.

[0006] However, since it is assumed that the requirements for VCs differ for each Verifier, it is not always the case that a Holder owns a VC that meets those requirements. Therefore, if a Holder does not own a VC that meets the requirements, the Holder must separately execute the VC issuance process via the Issuer, which poses a problem of low convenience when using the service.

[0007] The present invention has been made in consideration of the above points, and aims to provide a technology for automatically acquiring a digital identity when a Holder does not possess a digital identity that meets the requirements notified by a Verifier.

[0008] According to the disclosed technology, an information processing device is provided that includes: a determination unit that determines whether a digital identity that matches requirement information received from a service provider device is held; a request processing unit that, if it is determined that the digital identity is not held, sends a digital identity request including the requirement information to an issuer device and receives the digital identity from the issuer device; and a presentation unit that presents the digital identity to the service provider device.

[0009] According to the disclosed technology, when a Holder does not possess a digital identity that meets the requirements notified by a Verifier, a technology is provided for automatically acquiring the digital identity.

[0010] It is a block diagram of a communication system according to an embodiment of the present invention. It is a block diagram of a user terminal 100 according to an embodiment of the present invention. It is a flowchart for explaining the operation of the user terminal 100. It is a block diagram of an information processing device 400 according to an embodiment of the present invention. It is a diagram showing an example of the hardware configuration of the device.

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In this specification, "A / B" means "A or B," unless otherwise clearly indicated from the context. Also, "A or B" includes A only, B only, and "A and B." Also, in this specification, "user" includes not only a person but also a device, unless otherwise clearly indicated from the context.

[0013] Below, as a technology related to this embodiment, we will explain a mechanism in which, if a Holder does not have a digital identity that meets the requirements requested by a Verifier, the Holder automatically obtains one from an Issuer and presents it to the Verifier.

[0014] In this embodiment, the user terminal 100 is described as performing the operations according to the present invention, but the operations according to the present invention can be performed not only by the user terminal 100 but also by a general information processing device. Examples of information processing devices other than the user terminal 100 include physical servers, virtual machines on the cloud, chips such as integrated circuits, SIMs, etc. In other words, the technology according to the present invention is applicable not only to cases where a digital identity wallet is deployed in the user terminal 100, but also to cases where a digital identity wallet is deployed in the cloud, a digital identity wallet is mounted on a chip or SIM, etc.

[0015] (System Configuration Example) A configuration example of a communication system according to this embodiment is shown in Fig. 1. As shown in Fig. 1, this communication system includes a user terminal 100, an issuer search device 200, an issuer 310, and a verifier 320.

[0016] The user terminal 100 has a digital identity processing function 110. A digital identity wallet is also installed in the user terminal 100, and therefore, in Fig. 1, "Wallet" is written to indicate that the digital identity wallet is installed in the user terminal 100.

[0017] The issuer search device 200 is a device that searches for issuers. However, it is optional to provide the issuer search device 200 outside the user terminal 100. Instead of providing the issuer search device 200 outside the user terminal 100, the user terminal 100 may have a function similar to that of the issuer search device 200 inside.

[0018] The Issuer 310 is a device that issues digital identities. The Verifier 320 is a device that provides services, verifies digital identities received from Holders (such as the user terminal 100), and makes decisions about providing services based on the verification results.

[0019] The digital identity processing function 110 of the user terminal 100 processes requests, presentations, communications, etc. regarding digital identities.

[0020] (Processing Procedure) The processing procedure of the communication system in this embodiment will be explained in accordance with the step numbers (S1, etc.) in Fig. 1. In the processing procedure explained below, the processing operations in the user terminal 100 are basically processing operations performed by the digital identity processing function 110. Furthermore, it is assumed that the digital identity in this embodiment includes both or either an identifier (e.g., W3C DID) and an attribute / credentials (e.g., W3C VC), but the digital identity is not limited to one that includes the identifier or the attribute / credentials.

[0021] <S1, S2> In S1, the user terminal 100 accesses the verifier 320 to use the service provided by the verifier 320.

[0022] In S2, the verifier 320 transmits a digital identity presentation request including requirement information for the requested digital identity (e.g., VC / VP) to the user terminal 100. The user terminal 100 receives the digital identity presentation request.

[0023] <S3> In S3, the user terminal 100 searches for the digital identity (e.g., VC) requested by the verifier 320, but does not hold it.

[0024] <S4> Next, S4 will be described. S4 is an optional step, and it is not necessary to execute S4.

[0025] In S4, the user terminal 100 displays confirmation information on a display, for example, to ask the user (person) whether it is OK to newly acquire the digital identity requested by the verifier 320.

[0026] If the result of the confirmation is that acquisition is permitted, the user terminal 100 confirms with the user which user identifier (e.g., DID) the digital identity should be linked to and issued. If the user requests linking to a new user identifier (e.g., DID), the user terminal 100 may automatically perform a process to create a user identifier.

[0027] In S4, the form in which the user identifier (e.g., DID) to be linked to the digital identity (e.g., VC) is confirmed with the user each time the process of S4 is performed is one example. For example, the confirmation process may be omitted by setting in advance in the user terminal 100 the user identifier (e.g., DID) to be linked when a new digital identity is issued.

[0028] <S5> In S5, the user terminal 100 identifies an issuer that can issue a digital identity that meets the requirements, based on the digital identity requirement information (e.g., DIF presentation definition, etc.) requested by the verifier 320. Here, it is assumed that the issuer 310 is identified. Below, the processing in S5 when the issuer search device 200 is used will be described.

[0029] The user terminal 100 transmits an issuer search request (including the digital identity requirement information received from the verifier 320) to the issuer search device 200.

[0030] Upon receiving the issuer search request, the issuer search device 200 searches for issuers that can issue digital identities that meet the requirements, and responds to the user terminal 100 with a list of search results that include issuer identifiers and communication destination information for sending the digital identity request.

[0031] To enable the above search, the issuer search device 200 includes a database (DB) that stores, for example, "issuer identifiers," "communication destination information," and "requirements information for issuable digital identities" in association with each other. This DB may be located outside the issuer search device 200.

[0032] "Digital identity requirement information" includes, for example, the format (format such as JSON Web Token, signature algorithm such as EdDSA, W3C VC format, etc.), the name / type of the certificate (e.g., My Number, driver's license, student ID, employee ID, etc.), and property information contained in the certificate (e.g., for My Number, personal identification number, name, address, age, expiration date, issuer, etc.).

[0033] In addition, in S5, if the issuer search device 200 is not used, for example, information on issuers that can issue digital identities indicated in the requirements information, and information such as the access URL / API for sending a digital identity issuance request to that issuer, is stored in advance in the user terminal 100 (e.g., a wallet database, etc.), and a search is performed within the user terminal 100.

[0034] In addition, in S5, if there are multiple issuers that satisfy the requirements, for example, the user (person) selects one from among them, or the user terminal 100 may automatically select one based on the user's selection setting (e.g., selecting the first one in the list).

[0035] Alternatively, "search auxiliary information" may be additionally transmitted to the issuer search device 200 during issuer search. The search auxiliary information may be, for example, an identifier of the university to which the user belongs. By using such an identifier as search auxiliary information, it is possible to prevent a situation in which, for example, when a student ID card is requested by a verifier, identifiers of multiple universities to which the user does not belong are returned.

[0036] <S6> In S6, the user terminal 100 transmits a digital identity request to the issuer 310 based on the information about the issuer 310 acquired in S5. The digital identity request includes a user identifier to be linked to the digital identity and requirement information for the digital identity.

[0037] As a specific example, in S6, when the user terminal 100 sends a VC issuance request conforming to the DIF Credential Manifest specification to the Issuer 310, the user terminal 100 converts the VC requirement information received from the Verifier 320 into the Credential Application format and sends it.

[0038] In addition, if the Issuer 310 needs to identify the user when issuing a digital identity to the user terminal 100, a user authentication process may be performed between the Issuer 310 and the user before the process of S6.

[0039] <S7> In S7, the issuer 310 issues the requested digital identity and transmits the digital identity to the user terminal 100. The user terminal 100 that receives the digital identity stores the digital identity.

[0040] The user terminal 100 may convert the received digital identity (e.g., VC) into information to be presented to the verifier 320 (e.g., VP).

[0041] <S8> In S8, the user terminal 100 presents (transmits) a digital identity (for example, VC / VP) to the verifier 320.

[0042] In addition, in S8, the communication between the user terminal 100 and the verifier 320 established in S1 may be maintained and processed continuously, or the communication established in S1 may be disconnected, and the communication may be re-established using the same procedure as S1, and then the digital identity received from the issuer 310 may be presented.

[0043] The functional configuration and operation of the user terminal 100 will be described in more detail below.

[0044] (Functional Configuration and Operation of User Terminal 100) Fig. 2 shows an example of the functional configuration of the user terminal 100. The configuration shown in Fig. 2 may be considered to be the configuration of the digital identity processing function 110 or wallet in the user terminal 100.

[0045] 2 shows an example in which a VC is used as a digital identity, and an example in which the user terminal 100 has the function of the issuer search device 200.

[0046] 2, the user terminal 100 includes a VC holding unit 11, a VC search unit 12, a service request unit 13, a VC presentation unit 14, an issuer DB 15, an issuer search unit 16, a VC issuance request unit 17, and a communication unit 18. Note that the VC presentation unit 14 may also perform VP conversion, and is therefore referred to as a VC ( / VP conversion) presentation unit 14 in FIG.

[0047] An example of the operation of the user terminal 100 having the above configuration will be described with reference to the flowchart in Fig. 3. In the following description, the communication unit 18 is used for communication between the functional units of the user terminal 100 and the issuer 310 / verifier 320.

[0048] In S101 , the service request unit 13 transmits a service provision request to the verifier 320 .

[0049] In S102, the service request unit 13 receives a VC (or VP) presentation request including requirement information from the verifier 320.

[0050] The VC holding unit 11 is a functional unit for holding VCs held by the user terminal 100. In S103, the VC search unit 12 searches the VC holding unit 11 to check whether a VC that meets the requirements is held.

[0051] If the result of the determination in S103 is Yes (VC is held), the process proceeds to S107, and if No (VC is not held), the process proceeds to S104.

[0052] In S104, the issuer search unit 16 searches the issuer DB 15 for an issuer that can issue a VC that satisfies the requirements based on the requirements information. Note that instead of using the issuer DB 15, or in addition to using the issuer DB 15, the issuer search unit 16 may send a search request to the issuer search device 200.

[0053] In S105, the VC issuance request unit 17 sends a VC issuance request including a user identifier and requirement information to the issuer 310 found in S104. When requesting a VC that can be issued anonymously, the user identifier does not need to be included. Note that information on whether the requested VC is a VC that can be issued anonymously is held, for example, in "requirements information for issuable digital identities" in the DB in the issuer search device 200 (or the issuer DB 15).

[0054] In S 106 , the VC issuance request unit 17 receives a VC that satisfies the requirements from the issuer 310 and stores the VC in the VC storage unit 11 .

[0055] In S107, the VC presenting unit 14 transmits to the verifier 320 a VC that satisfies the requirements (or a VP converted from a VC that satisfies the requirements).

[0056] (Other Configuration Examples) Fig. 4 shows a configuration example of an information processing device 400 in this embodiment. The user terminal 100 described so far is an example of the information processing device 400. As shown in Fig. 4, the information processing device 400 includes a determination unit 410, an issuer search unit 420, a request processing unit 430, and a presentation unit 440. The determination unit 410 includes a storage unit 411 and a search unit 412.

[0057] The determining unit 410 determines whether or not the verifier 320 holds a digital identity that matches the requirement information received from the service provider device. Note that the verifier 320 is an example of a service provider device.

[0058] If it is determined that the digital identity is not held, the request processing unit 430 sends a digital identity request including the requirement information to the issuer device and receives the digital identity from the issuer device. Note that Issuer 310 is an example of an issuer device. The presentation unit 440 presents the digital identity to the service provider device.

[0059] Furthermore, the issuer search unit 420 may identify an issuer device capable of issuing the digital identity by searching a database held by the information processing device 400 or by sending a search request to an external issuer search device. The issuer search device 200 is an example of an issuer search device.

[0060] The storage unit 411 in the determination unit 410 is a functional unit for storing the digital identity received by the request processing unit 430. The search unit 412 searches the information stored in the storage unit 411 to check whether or not there is a digital identity that matches the requirement information.

[0061] (Hardware Configuration Example) Any of the devices described in this embodiment (information processing device, user terminal, issuer search device, issuer device, service provider device, etc.) can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0062] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0063] Fig. 5 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 5 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. The computer may further include a GPU.

[0064] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0065] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0066] As described above, the technology described in this embodiment enables a holder to automatically acquire a digital identity that satisfies the requirements requested by a verifier from an issuer when the holder does not possess such a digital identity. This improves the convenience of using services under self-sovereign identity management.

[0067] The following additional notes are provided regarding the above-described embodiments.

[0068] <Additional Notes> (Additional Item 1) An information processing device comprising: a determination unit that determines whether a digital identity that matches requirement information received from a service provider device is held; a request processing unit that, when it is determined that the digital identity is not held, sends a digital identity request including the requirement information to an issuer device and receives the digital identity from the issuer device; and a presentation unit that presents the digital identity to the service provider device. (Additional Item 2) The information processing device of Additional Item 1, further comprising: an issuer search unit that identifies an issuer device that can issue the digital identity by searching a database held by the information processing device or by sending a search request to an external issuer search device. (Additional Item 3) The information processing device of Additional Item 1 or 2, wherein the determination unit comprises: a storage unit for holding the digital identity received by the request processing unit; and a search unit that checks whether a digital identity that matches the requirement information exists by searching information held in the storage unit.

[0069] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0070] DESCRIPTION OF SYMBOLS 11 VC holding unit 12 VC search unit 13 Service request unit 14 VC presentation unit 15 Issuer DB 16 Issuer search unit 17 VC issuance request unit 18 Communication unit 100 User terminal 110 Digital identity processing function 200 Issuer search device 310 Issuer 320 Verifier 400 Information processing device 410 Determination unit 411 Holding unit 412 Search unit 420 Issuer search unit 430 Request processing unit 440 Presentation unit 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device comprising: a determination unit that determines whether a digital identity that matches requirement information received from a service provider device is held; a request processing unit that, if it is determined that the digital identity is not held, sends a digital identity request including the requirement information to an issuer device and receives the digital identity from the issuer device; and a presentation unit that presents the digital identity to the service provider device.

2. The information processing device according to claim 1, further comprising an issuer search unit that identifies an issuer device capable of issuing the digital identity by searching a database held by the information processing device or by sending a search request to an external issuer search device.

3. An information processing device as described in claim 1 or 2, wherein the determination unit comprises: a storage unit for storing a digital identity received by the request processing unit; and a search unit for searching the information stored in the storage unit to confirm whether or not there is a digital identity that matches the requirement information.

Images