Information disclosure method, information disclosure system, transmission terminal, and verification terminal

Abstract

Provided is an information disclosure method for disclosing transaction information in an information disclosure system that includes a transmission terminal and a verification terminal, wherein the information disclosure method includes: an encrypted VC generation step in which the transmission terminal generates an encrypted item, from a transaction VC which includes items (hereinafter referred to as transaction items) related to one or more pieces of transaction information, by using an encryption key of an attribute-based encryption for each transaction item to encrypt the transaction item and a conditional expression input by a sender with respect to said transaction item, and generates an encrypted VC which includes one or more encrypted items; and an encrypted VC decryption step in which the verification terminal generates a decrypted VC by using a decryption key of the attribute-based encryption to decrypt each encrypted item included in the encrypted VC. In the encrypted VC decryption step, if attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the relevant encrypted item, a transaction item corresponding to the encrypted item is acquired, and a decrypted VC which includes the acquired transaction item is generated.

Description

Information disclosure method, information disclosure system, transmission terminal, verification terminal

[0001] The present invention relates to verifiable credentials.

[0002] Research and development into verifiable credentials (VC) is currently underway. In the verifiable credential framework, trust is built among three stakeholders: issuer, holder, and verifier. The holder, who holds the VC issued by the issuer, presents information based on that VC to the verifier. The verifier verifies that the information is based on the credential issued by the legitimate issuer by verifying the signature. The holder may disclose all items contained in the VC to the verifier as information based on the VC, or may disclose only a few necessary items (hereinafter referred to as verifiable presentation (VP)).

[0003] One of the VCs that allows selective disclosure is SD-JWT (see Non-Patent Document 1). In SD-JWT, disclosure items are listed using the symbol "~" after the issuer-signed JWT. On the other hand, items that are not to be disclosed are not listed. This allows SD-JWT to achieve selective disclosure.

[0004] When implementing supply chain management using VC, it is conceivable that tags recording VC or VP will be attached to products before distribution. In this case, it is necessary to identify in advance the players involved in distribution who will read the tags, and record only the items that can be disclosed on the tags.

[0005] SD-JWT-based Verifiable Credentials (SD-JWT VC), [online], [Retrieved May 17, 2024], Internet<URL: https: / / datatracker.ietf.org / doc / draft-ietf-oauth-sd-jwt-vc / >

[0006] However, there may be multiple verifiers, and the players may change from time to time. Therefore, it is difficult to realize supply chain management using VC simply by selecting and recording the items that can be disclosed in advance in tags.

[0007] Therefore, an object of the present invention is to provide a verifiable qualification information technology that can selectively disclose items depending on the attributes of the verifier.

[0008] One aspect of the present invention is an information disclosure method for disclosing transaction information in an information disclosure system including a sending terminal and a verification terminal, the method including an encrypted VC generation step in which the sending terminal generates encrypted items from a transaction VC including one or more transaction information items (hereinafter referred to as transaction items) by encrypting the transaction items and a conditional expression entered by the sender for the transaction items using an encryption key of attribute-based encryption for each transaction item, thereby generating an encrypted VC including one or more encrypted items; and an encrypted VC decryption step in which the verification terminal generates a decrypted VC by decrypting each encrypted item included in the encrypted VC using a decryption key of the attribute-based encryption, and the encrypted VC decryption step obtains the transaction item corresponding to the encrypted item if the attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the encrypted item, and generates a decrypted VC including the obtained transaction items.

[0009] According to the present invention, it is possible to selectively disclose items depending on the attributes of the verifier.

[0010] 1 is a block diagram showing the configuration of an information disclosure system 10. FIG. 1 is a block diagram showing the configuration of a transmitting terminal 100. FIG. 2 is a block diagram showing the configuration of a verification terminal 200. FIG. 3 is a block diagram showing the configuration of a VC generation device 300. FIG. 4 is a block diagram showing the configuration of a key generation device 400. FIG. 5 is a sequence diagram showing the operation of the information disclosure system 10. FIG. 6 is a sequence diagram showing the operation of the information disclosure system 10. FIG. 7 is a block diagram showing the configuration of a transmitting terminal 100. FIG. 8 is a block diagram showing the configuration of a verification terminal 200. FIG. 9 is a block diagram showing the configuration of a VC disclosure device 500. FIG. 10 is a sequence diagram showing the operation of the information disclosure system 10. FIG. 11 is a block diagram showing the configuration of an information disclosure system 11. FIG. 12 is a block diagram showing the configuration of a transmitting terminal 101. FIG. 13 is a block diagram showing the configuration of a verification terminal 201. FIG. 14 is a block diagram showing the configuration of a VC generation device 301. FIG. 15 is a block diagram showing the configuration of a key generation device 401. FIG. 16 is a block diagram showing the configuration of a second VC generation device 600. FIG. 17 is a sequence diagram showing the operation of the information disclosure system 11. 1 is a sequence diagram showing the operation of the information disclosure system 11. FIG. 1 is a sequence diagram showing the operation of the information disclosure system 11. FIG. 2 is a block diagram showing the configuration of the sending terminal 101. FIG. 3 is a block diagram showing the configuration of the verification terminal 201. FIG. 4 is a block diagram showing the configuration of the VP disclosure device 501. FIG. 5 is a sequence diagram showing the operation of the information disclosure system 11. FIG. 6 is a diagram showing an example of the functional configuration of a computer that realizes each device in an embodiment of the present invention.

[0011] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

[0012] <Technical Background> In an embodiment of the present invention, items included in a VC that are to be selectively disclosed are encrypted using attribute-based encryption, and a VC or VP containing the encrypted items is presented to a verifier. Since the items that can be decrypted vary depending on the attributes of the verifier, selective disclosure according to the attributes of the verifier becomes possible.

[0013] The following describes attribute-based encryption used in embodiments of the present invention. Attribute-based encryption is encryption that can introduce conditional expressions and attribute information into ciphertext and decryption keys, respectively. Examples of such encryption include narrow-sense attribute-based encryption, functional encryption, and intelligent encryption, which provides similar functionality to these encryptions.

[0014] The encryption / decryption procedure using attribute-based encryption used in the embodiment of the present invention is as follows.

[0015] (Generation of Encryption Key and Decryption Key) (1) The sender requests the key generator to generate an encryption key.

[0016] (2) The key generator generates an encryption key and provides it to the sender. For example, the key generator generates a master key and then uses the master key to generate a public key as an encryption key.

[0017] (3) The recipient requests the key generator to generate a decryption key, and provides the key generator with the recipient's own attribute information required for generating the decryption key.

[0018] (4) The key generator generates a decryption key based on the provided attribute information and provides it to the recipient. For example, the key generator uses a master key to generate a private key containing the attribute information as the decryption key.

[0019] (Generation and Decryption of Ciphertext) (5) The sender generates ciphertext by encrypting the plaintext and the conditional expression using the encryption key. Here, the conditional expression is a logical expression that specifies the conditions for the attributes that can be decrypted.

[0020] (6) The recipient decrypts the ciphertext using the decryption key. If the attribute information included in the decryption key satisfies the conditional expression included in the ciphertext, the recipient can obtain the plaintext (i.e., decryption is successful). On the other hand, if the attribute information included in the decryption key does not satisfy the conditional expression included in the ciphertext, the recipient cannot obtain the plaintext (i.e., decryption fails).

[0021] It is assumed that the method of describing attribute information and conditional expressions in the attribute-based encryption used in the embodiment of the present invention is agreed upon in advance among the sender, receiver, and key generator. For example, the sender may inform the receiver and key generator of the description method determined by the sender, the key generator may inform the sender and receiver of the description method determined by the key generator, or the description method determined by an industry group related to the supply chain may be used.

[0022] Furthermore, when the recipient requests the key generator to generate a decryption key, the recipient provides the key generator with a VC that includes attribute information according to the above-described method as an item (hereinafter referred to as attribute item) as its own attribute information required for generating the decryption key. If the issuer's signature is attached to the VC, the key generator can generate the decryption key after verifying the signature and confirming the reliability of the attribute item included in the VC.

[0023] First Embodiment An information disclosure system 10 is a system that discloses transaction information.

[0024] [Configuration of Information Disclosure System 10] The configuration of the information disclosure system 10 will be described below with reference to Figs. 1 to 5. Fig. 1 is a block diagram showing the configuration of the information disclosure system 10. Fig. 2 is a block diagram showing the configuration of the sending terminal 100. Fig. 3 is a block diagram showing the configuration of the verification terminal 200. Fig. 4 is a block diagram showing the configuration of the VC generation device 300. Fig. 5 is a block diagram showing the configuration of the key generation device 400.

[0025] 1, the information disclosure system 10 includes a transmitting terminal 100, a verification terminal 200, a VC generating device 300, and a key generating device 400. The transmitting terminal 100, the verification terminal 200, the VC generating device 300, and the key generating device 400 are each connected to a network 900. The network 900 may be any network configured so that the transmitting terminal 100, the verification terminal 200, the VC generating device 300, and the key generating device 400 can communicate with each other, and the Internet, for example, can be used.

[0026] 2, the transmitting terminal 100 includes a key generation request unit 110, a VC generation request unit 120, an encrypted VC generation unit 130, a VC registration unit 140, a transmission / reception unit 180, and a recording unit 190. The transmission / reception unit 180 is a component for transmitting and receiving information necessary for processing by the transmitting terminal 100 via the network 900. The recording unit 190 is a component for appropriately recording information necessary for processing by the transmitting terminal 100. The recording unit 190 records, for example, an encryption key for attribute-based encryption. The transmitting terminal 100 is a terminal corresponding to the holder of a VC (hereinafter referred to as a transaction VC) that includes items related to transaction information.

[0027] 3, the verification terminal 200 includes a VC generation request unit 210, a key generation request unit 220, a VC acquisition unit 230, an encrypted VC decryption unit 240, a transmission / reception unit 280, and a recording unit 290. The transmission / reception unit 280 is a component for transmitting and receiving information necessary for processing by the verification terminal 200 via the network 900. The recording unit 290 is a component for appropriately recording information necessary for processing by the verification terminal 200. The recording unit 290 records, for example, a decryption key for attribute-based encryption. The verification terminal 200 is a terminal corresponding to the verifier of the transaction VC.

[0028] 4, the VC generating device 300 includes a first VC generating unit 310, a second VC generating unit 320, a transmitting / receiving unit 380, and a recording unit 390. The transmitting / receiving unit 380 is a component for transmitting and receiving information necessary for the processing of the VC generating device 300 via a network 900. The recording unit 390 is a component for appropriately recording information necessary for the processing of the VC generating device 300. The VC generating device 300 is a device equivalent to a VC issuer.

[0029] 5, the key generation device 400 includes a first key generation unit 410, a second key generation unit 420, a transmission / reception unit 480, and a recording unit 490. The transmission / reception unit 480 is a component for transmitting and receiving information required for processing by the key generation device 400 via a network 900. The recording unit 490 is a component for appropriately recording information required for processing by the key generation device 400. The key generation device 400 is a device equivalent to a key generator in attribute-based encryption.

[0030] [Operation of Information Disclosure System 10] Here, the operation of the information disclosure system 10 will be described with reference to Fig. 6 to Fig. 9. Specifically, the operation of the information disclosure system 10 in three situations, (1) key generation, (2) encrypted VC generation, and (3) encrypted VC decryption, will be described.

[0031] (1) Key Generation The operation of the information disclosure system 10 during key generation will be described below with reference to Figures 6 to 7. Figures 6 and 7 are example sequence diagrams showing the operation of the information disclosure system 10.

[0032] First, the generation of an encryption key will be described with reference to FIG.

[0033] In S110, key generation request unit 110 of transmitting terminal 100 generates a key generation request from data for encryption key generation input by the sender, and transmitting / receiving unit 180 of transmitting terminal 100 transmits the key generation request to key generating device 400. Transmitting / receiving unit 480 of key generating device 400 receives the key generation request.

[0034] In S410, first key generation unit 410 of key generation device 400 generates an encryption key using the key generation request received in S110, and transmission / reception unit 480 of key generation device 400 transmits the encryption key to transmitting terminal 100. Transmission / reception unit 180 of transmitting terminal 100 receives the encryption key.

[0035] Next, the generation of the decryption key will be described with reference to FIG.

[0036] In S210, the VC generation request unit 210 of the verification terminal 200 generates a VC generation request from data for VC generation input by the verifier, including one or more items related to his or her own attribute information (hereinafter referred to as attribute items), and the transmission / reception unit 280 of the verification terminal 200 transmits the VC generation request to the VC generating device 300. The transmission / reception unit 380 of the VC generating device 300 receives the VC generation request. Here, the VC generation request includes one or more attribute items, and it is assumed that the attribute items comply with a description method agreed upon in advance among the transmitting terminal 100, the verification terminal 200, and the key generating terminal 400, as explained in <Technical Background>.

[0037] In S310, the first VC generation unit 310 of the VC generation device 300 generates a VC including an attribute item (hereinafter referred to as an attribute VC) using the VC generation request received in S210, and the transmission / reception unit 380 of the VC generation device 300 transmits the attribute VC to the verification terminal 200. The transmission / reception unit 280 of the verification terminal 200 receives the attribute VC. Here, the attribute VC includes one or more attribute items.

[0038] In S220, the key generation request unit 220 of the verification terminal 200 generates a VP (hereinafter referred to as a proof VP) for proving the attribute information of the verifier using the attribute VC received in S310, and generates a key generation request including the proof VP, and the transmission / reception unit 280 of the verification terminal 200 transmits the key generation request to the key generation device 400. The transmission / reception unit 480 of the key generation device 400 receives the key generation request.

[0039] In S420, the second key generation unit 420 of the key generation device 400 generates a decryption key based on the attribute information of the verifier using the key generation request received in S220, and the transmission / reception unit 480 of the key generation device 400 transmits the decryption key to the verification terminal 200. The transmission / reception unit 280 of the verification terminal 200 receives the decryption key. Here, the decryption key includes the attribute information of the verifier.

[0040] If the VC generating device 300 transmits a signature together with the attribute VC in S310, the verification terminal 200 transmits a key generation request including the proof VP and the signature in S220. Then, in S420, the second key generating unit 420 of the key generating device 400 generates a decryption key only if the verification of the signature is successful.

[0041] (2) Generation of Encrypted VC The operation of the information disclosure system 10 when generating an encrypted VC will be described below with reference to Fig. 8. Fig. 8 is an example of a sequence diagram showing the operation of the information disclosure system 10.

[0042] In S120, the VC generation request unit 120 of the transmitting terminal 100 generates a VC generation request from data for VC generation input by the sender, including one or more items related to transaction information (hereinafter referred to as transaction items), and the transmitting / receiving unit 180 of the transmitting terminal 100 transmits the VC generation request to the VC generating device 300. The transmitting / receiving unit 380 of the VC generating device 300 receives the VC generation request. Here, the VC generation request includes one or more transaction items.

[0043] In S320, the second VC generation unit 320 of the VC generation device 300 generates a VC including trading items (hereinafter referred to as trading VC) using the VC generation request received in S120, and the transmission / reception unit 380 of the VC generation device 300 transmits the trading VC to the transmitting terminal 100. The transmission / reception unit 180 of the transmitting terminal 100 receives the trading VC. Here, the trading VC includes one or more trading items.

[0044] In S130, the encrypted VC generation unit 130 of the sending terminal 100 generates encrypted items from the transaction VC received in S320 by encrypting the transaction items and the conditional expressions entered by the sender for the transaction items using an encryption key for each transaction item, and generates an encrypted VC including the encrypted items. Here, the encrypted VC includes one or more encrypted items. Also, the encrypted items include conditional expressions corresponding to the encrypted transaction items.

[0045] In S140, the VC registration unit 140 of the sending terminal 100 registers the encrypted VC generated in S130 in a tag to be used in the transaction. Then, the sender attaches the tag to the product to be traded.

[0046] In S140, the sending terminal 100 may register the signature together with the encrypted VC in the tag.

[0047] (3) Decryption of Encrypted VC The operation of the information disclosure system 10 when decrypting an encrypted VC will be described below with reference to Fig. 9. Fig. 9 is an example of a sequence diagram showing the operation of the information disclosure system 10.

[0048] In S230, the VC acquisition unit 230 of the verification terminal 200 reads the encrypted VC from the tag attached to the product received by the verifier, and acquires the encrypted VC.

[0049] In S240, the encrypted VC decryption unit 240 of the verification terminal 200 generates a decrypted VC by decrypting each encrypted item included in the encrypted VC from the encrypted VC acquired in S230 using the decryption key. For each encrypted item included in the encrypted VC, if the attribute information included in the decryption key satisfies the conditional expression included in the encrypted item, the decryption is successful, whereas if the attribute information included in the decryption key does not satisfy the conditional expression included in the encrypted item, the decryption fails. Therefore, if the attribute information included in the decryption key for each encrypted item included in the encrypted VC satisfies the conditional expression included in the encrypted item, the encrypted VC decryption unit 240 of the verification terminal 200 acquires transaction items corresponding to the encrypted item and generates a decrypted VC including the acquired transaction items. In other words, the verifier can confirm only the transaction information included in the encrypted items that were successfully decrypted.

[0050] If the sending terminal 100 registered a signature together with the encrypted VC in S140, the verification terminal 200 also acquires the signature in S230. Then, in S240, the encrypted VC decryption unit 240 of the verification terminal 200 verifies the signature and then generates a decrypted VC.

[0051] According to an embodiment of the present invention, it is possible to selectively disclose items depending on the attributes of the verifier.

[0052] <Modification> Instead of the encrypted VC, information required to acquire the encrypted VC may be registered in a tag, and the encrypted VC may be acquired from a predetermined device using this information.

[0053] [Configuration of information disclosure system 10] The configuration of the information disclosure system 10 will be described below with reference to Fig. 1, Figs. 10 to 11, Figs. 4 to 5, and Fig. 12. Fig. 1 is a block diagram showing the configuration of the information disclosure system 10. Fig. 10 is a block diagram showing the configuration of the sending terminal 100. Fig. 11 is a block diagram showing the configuration of the verification terminal 200. Fig. 4 is a block diagram showing the configuration of the VC generating device 300. Fig. 5 is a block diagram showing the configuration of the key generating device 400. Fig. 12 is a block diagram showing the configuration of the VC publishing device 500.

[0054] 1, the information disclosure system 10 includes a sending terminal 100, a verification terminal 200, a VC generation device 300, a key generation device 400, and a VC publishing device 500. The sending terminal 100, the verification terminal 200, the VC generation device 300, the key generation device 400, and the VC publishing device 500 are each connected to a network 900. The network 900 may be any network configured so that the sending terminal 100, the verification terminal 200, the VC generation device 300, the key generation device 400, and the VC publishing device 500 can communicate with each other, and the Internet, for example, may be used. The information disclosure system 10 differs from the information disclosure system 10 of the first embodiment in that it further includes a VC publishing device 500.

[0055] 10, the transmitting terminal 100 includes a key generation request unit 110, a VC generation request unit 120, an encrypted VC generation unit 130, a VC registration request unit 145, a transmitting / receiving unit 180, and a recording unit 190. The transmitting terminal 100 differs from the transmitting terminal 100 of the first embodiment in that it includes a VC registration request unit 145 instead of the VC registration unit 140.

[0056] 11, the verification terminal 200 includes a VC generation request unit 210, a key generation request unit 220, a VC acquisition request unit 235, an encrypted VC decryption unit 240, a transmission / reception unit 280, and a recording unit 290. The verification terminal 200 differs from the verification terminal 200 of the first embodiment in that it includes a VC acquisition request unit 235 instead of the VC acquisition unit 230.

[0057] The VC generating device 300 and the key generating device 400 are the same as the VC generating device 300 and the key generating device 400 of the first embodiment, respectively (see FIGS. 4 and 5).

[0058] 12, the VC publishing device 500 includes a VC registration unit 510, a VC acquisition unit 520, a transmission / reception unit 580, and a recording unit 590. The transmission / reception unit 580 is a component for transmitting and receiving information necessary for the processing of the VC publishing device 500 via the network 900. The recording unit 590 is a component for appropriately recording information necessary for the processing of the VC publishing device 500. The recording unit 590 records, for example, encrypted VC. Note that the function of the VC publishing device 500 may be provided by the sending terminal 100.

[0059] [Operation of Information Disclosure System 10] Here, the operation of the information disclosure system 10 will be described with reference to Figures 6 to 7 and Figures 13 to 14. Specifically, the operation of the information disclosure system 10 in three situations, (1) key generation, (2) encrypted VC generation, and (3) encrypted VC decryption, will be described.

[0060] (1) Key Generation The operation of the information disclosure system 10 when generating a key is the same as the operation of the information disclosure system 10 when generating a key in the first embodiment (see FIGS. 6 and 7).

[0061] (2) Generation of Encrypted VC The operation of the information disclosure system 10 when generating an encrypted VC will be described below with reference to Fig. 13. Fig. 13 is an example of a sequence diagram showing the operation of the information disclosure system 10.

[0062] The operations of steps S120 to S130 are the same as those in the first embodiment, so steps S145 and onwards will be described.

[0063] In S145, the VC registration request unit 145 of the transmitting terminal 100 generates a VC registration request including the encrypted VC generated in S130, and the transmitting / receiving unit 180 of the transmitting terminal 100 transmits the VC registration request to the VC publishing device 500. The transmitting / receiving unit 580 of the VC publishing device 500 receives the VC registration request.

[0064] In S510, the VC registration unit 510 of the VC publishing device 500 registers the encrypted VC included in the VC registration request received in S145 in the data publishing area of ​​the recording unit 590, generates a registration result including information necessary to acquire the encrypted VC, and the transmission / reception unit 580 of the VC publishing device 500 transmits the registration result to the sending terminal 100. The transmission / reception unit 180 of the sending terminal 100 receives the registration result. The information necessary to acquire the encrypted VC can be, for example, a URL. Then, the sender attaches the information necessary to acquire the encrypted VC, for example, as a QR code (registered trademark), to the product to be traded.

[0065] If the sending terminal 100 sends a VC registration request including a signature together with the encrypted VC in S145, the VC publishing device 500 also registers the signature in S510.

[0066] (3) Decryption of Encrypted VC Hereinafter, the operation of the information disclosure system 10 when decrypting the encrypted VC will be described with reference to Fig. 14. Fig. 14 is an example of a sequence diagram showing the operation of the information disclosure system 10.

[0067] In S235, the VC acquisition request unit 235 of the verification terminal 200 reads information necessary to acquire the encrypted VC from the QR code attached to the product received by the verifier, generates a VC acquisition request including the information, and the transmission / reception unit 280 of the verification terminal 200 transmits the VC acquisition request to the VC disclosure device 500. The transmission / reception unit 580 of the VC disclosure device 500 receives the VC acquisition request.

[0068] In S520, the VC acquisition unit 520 of the VC publishing device 500 reads the encrypted VC from the data disclosure area of ​​the recording unit 590 using the information necessary to acquire the encrypted VC included in the VC acquisition request received in S235, generates an acquisition result including the encrypted VC, and the transmission / reception unit 580 of the VC publishing device 500 transmits the acquisition result to the verification terminal 200. The transmission / reception unit 280 of the verification terminal 200 receives the acquisition result.

[0069] In S240, the encrypted VC decryption unit 240 of the verification terminal 200 acquires the encrypted VC from the acquisition result received in S520, and generates a decrypted VC from the encrypted VC by decrypting each encrypted item contained in the encrypted VC using a decryption key.

[0070] In addition, if the sending terminal 100 transmits a VC registration request including a signature together with the encrypted VC in S145, the VC publishing device 500 transmits an acquisition result including the signature in S520. Then, in S240, the encrypted VC decryption unit 240 of the verification terminal 200 verifies the signature and then generates a decrypted VC.

[0071] Second Embodiment An information disclosure system 11 is a system that discloses transaction information.

[0072] [Configuration of information disclosure system 11] Hereinafter, the configuration of the information disclosure system 11 will be described with reference to Figs. 15 to 20. Fig. 15 is a block diagram showing the configuration of the information disclosure system 11. Fig. 16 is a block diagram showing the configuration of the sending terminal 101. Fig. 17 is a block diagram showing the configuration of the verification terminal 201. Fig. 18 is a block diagram showing the configuration of the VC generation device 301. Fig. 19 is a block diagram showing the configuration of the key generation device 401. Fig. 20 is a block diagram showing the configuration of the second VC generation device 600.

[0073] 15, the information disclosure system 11 includes a transmitting terminal 101, a verification terminal 201, a VC generating device 301, a key generating device 401, and a second VC generating device 600. The transmitting terminal 101, the verification terminal 201, the VC generating device 301, the key generating device 401, and the second VC generating device 600 are each connected to a network 900. The network 900 may be any network configured so that the transmitting terminal 101, the verification terminal 201, the VC generating device 301, the key generating device 401, and the second VC generating device 600 can communicate with each other, and the Internet, for example, may be used.

[0074] As shown in FIG. 16, the transmitting terminal 101 includes a key generation request unit 110, a VC generation request unit 121, an encrypted VP generation unit 131, a VP registration unit 141, a transmission / reception unit 180, and a recording unit 190. The transmission / reception unit 180 is a component for transmitting and receiving information necessary for processing by the transmitting terminal 101 via the network 900. The recording unit 190 is a component for appropriately recording information necessary for processing by the transmitting terminal 101. The recording unit 190 records, for example, an encryption key for attribute-based encryption. The transmitting terminal 101 is a terminal corresponding to the holder of a VC (hereinafter referred to as an encrypted VC) that includes items related to encrypted transaction information.

[0075] 17, the verification terminal 201 includes a VC generation request unit 210, a key generation request unit 220, a VP acquisition unit 231, an encrypted VP decryption unit 241, a transmission / reception unit 280, and a recording unit 290. The transmission / reception unit 280 is a component for transmitting and receiving information necessary for processing by the verification terminal 201 via the network 900. The recording unit 290 is a component for appropriately recording information necessary for processing by the verification terminal 201. The recording unit 290 records, for example, a decryption key for attribute-based encryption. The verification terminal 201 is a terminal corresponding to the verifier of the encrypted VC.

[0076] 18, the VC generating device 301 includes a first VC generating unit 310, a VC generation request unit 311, a key generation request unit 312, a second VC generating unit 321, a transmitting / receiving unit 380, and a recording unit 390. The transmitting / receiving unit 380 is a component for transmitting and receiving information necessary for the processing of the VC generating device 301 via a network 900. The recording unit 390 is a component for appropriately recording information necessary for the processing of the VC generating device 301. The VC generating device 301 is a device corresponding to the issuer of a VC.

[0077] 19 , the key generation device 401 includes a first key generation unit 410, a second key generation unit 420, a third key generation unit 421, a transmission / reception unit 480, and a recording unit 490. The transmission / reception unit 480 is a component for transmitting and receiving information necessary for processing by the key generation device 401 via a network 900. The recording unit 490 is a component for appropriately recording information necessary for processing by the key generation device 401. The key generation device 401 is a device equivalent to a key generator in attribute-based encryption.

[0078] 20, the second VC generation device 600 includes a VC generation unit 610, a transmission / reception unit 680, and a recording unit 690. The transmission / reception unit 680 is a component for transmitting and receiving information necessary for the processing of the second VC generation device 600 via a network 900. The recording unit 690 is a component for appropriately recording information necessary for the processing of the second VC generation device 600. The second VC generation device 600 is a device equivalent to the issuer of a VC. Note that the second VC generation device 600 is a higher-level trust anchor of the VC generation device 301.

[0079] [Operation of Information Disclosure System 11] Here, the operation of the information disclosure system 11 will be described with reference to Fig. 21 to Fig. 25. Specifically, the operation of the information disclosure system 11 in three situations will be described: (1) key generation, (2) encrypted VP generation, and (3) encrypted VP decryption.

[0080] (1) Key Generation The operation of the information disclosure system 11 during key generation will be described below with reference to Fig. 21 to Fig. 23. Fig. 21 to Fig. 23 are examples of sequence diagrams showing the operation of the information disclosure system 11.

[0081] First, the generation of an encryption key will be described with reference to FIG.

[0082] In S110, key generation request unit 110 of transmitting terminal 101 generates a key generation request from data for generating an encryption key input by the sender, and transmitting / receiving unit 180 of transmitting terminal 101 transmits the key generation request to key generating device 401. Transmitting / receiving unit 480 of key generating device 401 receives the key generation request.

[0083] In S410, first key generation unit 410 of key generation device 401 generates an encryption key using the key generation request received in S110, and transmission / reception unit 480 of key generation device 401 transmits the encryption key to transmitting terminal 101. Transmission / reception unit 180 of transmitting terminal 101 receives the encryption key.

[0084] Next, the generation of the decryption key used by the verification terminal 201 will be described with reference to FIG.

[0085] In S210, the VC generation request unit 210 of the verification terminal 201 generates a VC generation request from data for VC generation input by the verifier, including one or more items related to his or her own attribute information (hereinafter referred to as attribute items), and the transmission / reception unit 280 of the verification terminal 201 transmits the VC generation request to the VC generating device 301. The transmission / reception unit 380 of the VC generating device 301 receives the VC generation request. Here, the VC generation request includes one or more attribute items, and the attribute items are assumed to conform to a description method agreed upon in advance among the transmitting terminal 101, the verification terminal 201, the VC generating device 301, and the key generating terminal 401, as explained in <Technical Background>.

[0086] In S310, the first VC generation unit 310 of the VC generation device 301 generates a VC including an attribute item (hereinafter referred to as an attribute VC) using the VC generation request received in S210, and the transmission / reception unit 380 of the VC generation device 301 transmits the attribute VC to the verification terminal 201. The transmission / reception unit 280 of the verification terminal 201 receives the attribute VC. Here, the attribute VC includes one or more attribute items.

[0087] In S220, the key generation request unit 220 of the verification terminal 201 generates a VP (hereinafter referred to as a proof VP) for proving the attribute information of the verifier using the attribute VC received in S310, generates a key generation request including the proof VP, and the transmission / reception unit 280 of the verification terminal 201 transmits the key generation request to the key generation device 401. The transmission / reception unit 480 of the key generation device 401 receives the key generation request.

[0088] In S420, the second key generation unit 420 of the key generation device 401 generates a decryption key based on the attribute information of the verifier using the key generation request received in S220, and the transmission / reception unit 480 of the key generation device 401 transmits the decryption key to the verification terminal 201. The transmission / reception unit 280 of the verification terminal 201 receives the decryption key. Here, the decryption key includes the attribute information of the verifier.

[0089] If the VC generating device 301 transmits a signature together with the attribute VC in S310, the verification terminal 201 transmits a key generation request including the proof VP and the signature in S220. Then, in S420, the second key generating unit 420 of the key generating device 401 generates a decryption key only if the verification of the signature is successful.

[0090] Finally, the generation of the decryption key used by the VC generating device 301 will be described with reference to FIG.

[0091] In S311, the VC generation request unit 311 of the VC generating device 301 generates a VC generation request from data for VC generation input by the issuer, including one or more items related to its own attribute information (hereinafter referred to as attribute items), and the transmitting / receiving unit 380 of the VC generating device 301 transmits the VC generation request to the second VC generating device 600. The transmitting / receiving unit 680 of the second VC generating device 600 receives the VC generation request. Here, the VC generation request includes one or more attribute items, and as explained in <Technical Background>, it is assumed that the attribute items comply with a description method agreed upon in advance among the transmitting terminal 101, verification terminal 201, VC generating device 301, and key generating terminal 401.

[0092] In S610, the VC generation unit 610 of the second VC generation device 600 generates a VC including an attribute item (hereinafter referred to as an attribute VC) using the VC generation request received in S311, and the transmission / reception unit 680 of the second VC generation device 600 transmits the attribute VC to the VC generation device 301. The transmission / reception unit 380 of the VC generation device 301 receives the attribute VC. Here, the attribute VC includes one or more attribute items.

[0093] In S312, the key generation request unit 312 of the VC generating device 301 generates a VP (hereinafter referred to as a proof VP) for proving the attribute information of the issuer using the attribute VC received in S610, generates a key generation request including the proof VP, and the transmitting / receiving unit 380 of the VC generating device 301 transmits the key generation request to the key generating device 401. The transmitting / receiving unit 480 of the key generating device 401 receives the key generation request.

[0094] In S421, the third key generation unit 421 of the key generation device 401 generates a decryption key based on the attribute information of the issuer using the key generation request received in S312, and the transmission / reception unit 480 of the key generation device 401 transmits the decryption key to the VC generation device 301. The transmission / reception unit 380 of the VC generation device 301 receives the decryption key. Here, the decryption key includes the attribute information of the issuer.

[0095] If the second VC generating device 600 transmits a signature together with the attribute VC in S610, the VC generating device 301 transmits a key generation request including the proof VP and the signature in S312. Then, in S421, the third key generating unit 421 of the key generating device 401 generates a decryption key only if the verification of the signature is successful.

[0096] (2) Generation of Encrypted VP The operation of the information disclosure system 11 when generating an encrypted VP will be described below with reference to Fig. 24. Fig. 24 is an example of a sequence diagram showing the operation of the information disclosure system 11.

[0097] In S121, the VC generation request unit 121 of the transmitting terminal 101 generates encrypted items from pairs of one or more transaction information-related items (hereinafter referred to as transaction items) entered by the sender and conditional expressions corresponding to the transaction items by encrypting the transaction items of the pair and the conditional expressions corresponding to the transaction items using an encryption key for each pair, generates a VC generation request from data for VC generation including the encrypted items, and the transmitting / receiving unit 180 of the transmitting terminal 101 transmits the VC generation request to the VC generating device 301. The transmitting / receiving unit 380 of the VC generating device 301 receives the VC generation request. Here, the VC generation request includes one or more encrypted items. Furthermore, the encrypted items include conditional expressions corresponding to the encrypted transaction items.

[0098] In S321, the second VC generation unit 321 of the VC generation device 301 confirms a set of transaction items and conditional expressions corresponding to the transaction items obtained by decrypting the encrypted items included in the VC generation request received in S121 using the decryption key, generates a VC including the encrypted items (hereinafter referred to as encrypted VC), and the transmission / reception unit 380 of the VC generation device 301 transmits the encrypted VC to the sending terminal 101. The transmission / reception unit 180 of the sending terminal 101 receives the encrypted VC. Here, the encrypted VC includes one or more encrypted items.

[0099] In S131, the encrypted VP generating unit 131 of the transmitting terminal 101 generates an encrypted VP from the encrypted VC received in S320. Here, the encrypted VP includes one or more encrypted items included in the encrypted VC.

[0100] In S141, the VP registration unit 141 of the sending terminal 101 registers the encrypted VP generated in S131 in a tag to be used in the transaction, and the sender then attaches the tag to the product to be traded.

[0101] In S141, the sending terminal 101 may register a signature together with the encrypted VP.

[0102] (3) Decryption of Encrypted VP The operation of the information disclosure system 11 when decrypting an encrypted VP will be described below with reference to Fig. 25. Fig. 25 is an example of a sequence diagram showing the operation of the information disclosure system 11.

[0103] In S231, the VP acquisition unit 231 of the verification terminal 201 reads the encrypted VP from the tag attached to the product received by the verifier, and acquires the encrypted VP.

[0104] In S241, the encrypted VP decryption unit 241 of the verification terminal 201 generates a decrypted VP by decrypting each encrypted item included in the encrypted VP from the encrypted VP acquired in S231 using the decryption key. For an encrypted item included in the encrypted VP, decryption is successful if the attribute information included in the decryption key satisfies the conditional expression included in the encrypted item, but decryption fails if the attribute information included in the decryption key does not satisfy the conditional expression included in the encrypted item. Therefore, the VP acquisition unit 231 of the verification terminal 201 acquires transaction items corresponding to the encrypted item if the attribute information included in the decryption key for each encrypted item included in the encrypted VP satisfies the conditional expression included in the encrypted item, and generates a decrypted VP including the acquired transaction items. In other words, the verifier can only confirm transaction information included in encrypted items that were successfully decrypted.

[0105] If the sending terminal 101 registered a signature along with the encrypted VP in S141, the verification terminal 201 also acquires the signature in S231. Then, in S241, the encrypted VP decryption unit 241 of the verification terminal 201 verifies the signature and generates a decrypted VP.

[0106] According to an embodiment of the present invention, it is possible to selectively disclose items depending on the attributes of the verifier.

[0107] <Modification> Instead of the encrypted VP, information required to obtain the encrypted VP may be registered in a tag, and the encrypted VP may be obtained from a predetermined device using this information.

[0108] [Configuration of information disclosure system 11] The configuration of the information disclosure system 11 will be described below with reference to Fig. 15, Fig. 26 to Fig. 27, Fig. 18 to Fig. 20, and Fig. 28. Fig. 15 is a block diagram showing the configuration of the information disclosure system 11. Fig. 26 is a block diagram showing the configuration of the sending terminal 101. Fig. 27 is a block diagram showing the configuration of the verification terminal 201. Fig. 18 is a block diagram showing the configuration of the VC generation device 301. Fig. 19 is a block diagram showing the configuration of the key generation device 401. Fig. 20 is a block diagram showing the configuration of the second VC generation device 600. Fig. 28 is a block diagram showing the configuration of the VP disclosure device 501.

[0109] 15, the information disclosure system 11 includes a sending terminal 101, a verification terminal 201, a VC generating device 301, a key generating device 401, a second VC generating device 600, and a VP publishing device 501. The sending terminal 101, the verification terminal 201, the VC generating device 301, the key generating device 401, the second VC generating device 600, and the VP publishing device 501 are each connected to a network 900. The network 900 may be any network configured so that the sending terminal 101, the verification terminal 201, the VC generating device 301, the key generating device 401, the second VC generating device 600, and the VP publishing device 501 can communicate with each other, and the Internet, for example, can be used. The information disclosure system 11 differs from the information disclosure system 11 of the second embodiment in that it further includes a VP publishing device 501.

[0110] 26, transmitting terminal 101 includes key generation request unit 110, VC generation request unit 121, encrypted VP generation unit 131, VP registration request unit 146, transmission / reception unit 180, and recording unit 190. Transmitting terminal 101 differs from transmitting terminal 101 of the second embodiment in that it includes VP registration request unit 146 instead of VP registration unit 141.

[0111] 27, the verification terminal 201 includes a VC generation request unit 210, a key generation request unit 220, a VP acquisition request unit 236, an encrypted VP decryption unit 241, a transmission / reception unit 280, and a recording unit 290. The verification terminal 201 differs from the verification terminal 201 of the second embodiment in that it includes a VP acquisition request unit 236 instead of the VP acquisition unit 231.

[0112] The VC generating device 301, the key generating device 401, and the second VC generating device 600 are the same as the VC generating device 301, the key generating device 401, and the second VC generating device 600 of the second embodiment, respectively (see FIGS. 18 to 20).

[0113] As shown in Figure 28, the VP publishing device 501 includes a VP registration unit 511, a VP acquisition unit 521, a transmission / reception unit 580, and a recording unit 590. The transmission / reception unit 580 is a component for transmitting and receiving information necessary for the processing of the VP publishing device 501 via the network 900. The recording unit 590 is a component for appropriately recording information necessary for the processing of the VP publishing device 501. The recording unit 590 records, for example, encrypted VPs. Note that the functions of the VP publishing device 501 may be provided by the transmitting terminal 101.

[0114] [Operation of Information Disclosure System 11] Here, the operation of the information disclosure system 11 will be described with reference to Figures 21 to 23 and Figures 29 to 30. Specifically, the operation of the information disclosure system 11 in three situations will be described: (1) key generation, (2) encrypted VP generation, and (3) encrypted VP decryption.

[0115] (1) Key Generation The operation of the information disclosure system 11 when generating a key is the same as the operation of the information disclosure system 11 when generating a key in the second embodiment (see FIGS. 21 to 23).

[0116] (2) Generation of Encrypted VP The operation of the information disclosure system 11 when generating an encrypted VP will be described below with reference to Fig. 29. Fig. 29 is an example of a sequence diagram showing the operation of the information disclosure system 11.

[0117] The operations of steps S121 to S131 are the same as those in the second embodiment, so steps S146 and onwards will be described.

[0118] In S146, the VP registration request unit 146 of the transmitting terminal 101 generates a VP registration request including the encrypted VP generated in S131, and the transmitting / receiving unit 180 of the transmitting terminal 101 transmits the VP registration request to the VP publishing device 501. The transmitting / receiving unit 580 of the VP publishing device 501 receives the VP registration request.

[0119] In S511, the VP registration unit 511 of the VP disclosure device 501 registers the encrypted VP included in the VP registration request received in S146 in the data disclosure area of ​​the recording unit 590, generates a registration result including information necessary to acquire the encrypted VP, and the transmission / reception unit 580 of the VP disclosure device 501 transmits the registration result to the sending terminal 101. The transmission / reception unit 180 of the sending terminal 101 receives the registration result. The information necessary to acquire the encrypted VP can be, for example, a URL. Then, the sender attaches the information necessary to acquire the encrypted VP, for example, as a QR code (registered trademark), to the product to be traded.

[0120] If the sending terminal 101 sends a VP registration request including a signature together with the encrypted VP in S146, the VP publishing device 501 also registers the signature in S511.

[0121] (3) Decryption of Encrypted VP The operation of the information disclosure system 11 when decrypting an encrypted VP will be described below with reference to Fig. 30. Fig. 30 is an example of a sequence diagram showing the operation of the information disclosure system 11.

[0122] In S236, the VP acquisition request unit 236 of the verification terminal 201 reads the information necessary to acquire the encrypted VP from the QR code attached to the product received by the verifier, generates a VP acquisition request including that information, and the transmission / reception unit 280 of the verification terminal 201 transmits the VP acquisition request to the VP disclosure device 501. The transmission / reception unit 580 of the VP disclosure device 501 receives the VP acquisition request.

[0123] In S521, the VP acquisition unit 521 of the VP disclosure device 501 reads the encrypted VP from the data disclosure area of ​​the recording unit 590 using the information necessary to acquire the encrypted VP included in the VP acquisition request received in S236, generates an acquisition result including the encrypted VP, and the transmission / reception unit 580 of the VP disclosure device 501 transmits the acquisition result to the verification terminal 201. The transmission / reception unit 280 of the verification terminal 201 receives the acquisition result.

[0124] In S241, the encrypted VP decryption unit 241 of the verification terminal 201 obtains the encrypted VP from the acquisition result received in S521, and generates a decrypted VP from the encrypted VP by decrypting each encrypted item contained in the encrypted VP using a decryption key.

[0125] If the sending terminal 101 sends a VP registration request including a signature along with the encrypted VP in S146, the VP publishing device 501 sends the acquisition result including the signature in S521. Then, in S241, the encrypted VP decryption unit 241 of the verification terminal 201 verifies the signature and generates a decrypted VP.

[0126] <Additional Notes> The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0127] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0128] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0129] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 31 and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0130] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0131] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0132] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its storage device and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of the server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0133] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0134] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

Claims

1. An information disclosure method for disclosing transaction information in an information disclosure system including a sending terminal and a verification terminal, comprising: an encrypted VC generation step in which the sending terminal generates encrypted items from a transaction VC including one or more transaction information items (hereinafter referred to as transaction items) by encrypting the transaction items and a conditional expression entered by the sender for the transaction items using an encryption key of attribute-based encryption for each transaction item, thereby generating an encrypted VC including one or more encrypted items; and an encrypted VC decryption step in which the verification terminal generates a decrypted VC by decrypting each encrypted item included in the encrypted VC using a decryption key of the attribute-based encryption, wherein the encrypted VC decryption step, if attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the encrypted item, obtains the transaction item corresponding to the encrypted item, and generates a decrypted VC including the obtained transaction items.

2. An information disclosure system for disclosing transaction information, comprising a sending terminal and a verification terminal, wherein the sending terminal comprises an encrypted VC generation unit that generates encrypted items from a transaction VC containing one or more transaction information items (hereinafter referred to as transaction items) by encrypting the transaction items and a conditional expression input by a sender for the transaction items using an encryption key of attribute-based encryption for each transaction item, and generates an encrypted VC containing one or more encrypted items; the verification terminal comprises an encrypted VC decryption unit that generates a decrypted VC by decrypting each encrypted item included in the encrypted VC using a decryption key of the attribute-based encryption; and the encrypted VC decryption unit, when attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the encrypted item, obtains the transaction item corresponding to the encrypted item, and generates a decrypted VC containing the obtained transaction items.

3. A transmitting terminal of an information disclosure system that discloses transaction information, including a transmitting terminal and a verifying terminal, the transmitting terminal including an encrypted VC generation unit that generates encrypted items from a transaction VC that includes one or more transaction information items (hereinafter referred to as transaction items) by encrypting the transaction items and a conditional expression entered by the sender for the transaction items using an encryption key for attribute-based encryption for each transaction item, and generates an encrypted VC that includes one or more encrypted items.

4. A verification terminal of an information disclosure system that discloses transaction information, including a sending terminal and a verification terminal, wherein the encrypted VC includes one or more encrypted items generated by encrypting the transaction item and a conditional expression entered by a sender for the transaction item using an encryption key of attribute-based encryption for each transaction item from the transaction VC that includes one or more items related to transaction information (hereinafter referred to as transaction items), and the verification terminal includes an encrypted VC decryption unit that generates a decrypted VC by decrypting each encrypted item included in the encrypted VC using a decryption key of the attribute-based encryption, and the encrypted VC decryption unit obtains the transaction item corresponding to the encrypted item if the attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the encrypted item, and generates a decrypted VC including the obtained transaction item.

5. An information disclosure method for disclosing transaction information in an information disclosure system including a sending terminal and a verification terminal, comprising: an encrypted VP generation step in which the sending terminal generates an encrypted VP including one or more encrypted items from an encrypted VC including one or more encrypted items generated by encrypting items related to the transaction information entered by the sender (hereinafter referred to as transaction items) and a conditional expression corresponding to the transaction items using an encryption key for attribute-based encryption; and an encrypted VP decryption step in which the verification terminal generates a decrypted VP by decrypting each encrypted item included in the encrypted VP using a decryption key for the attribute-based encryption, wherein the encrypted VP decryption step, if the attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the encrypted item, obtains the transaction item corresponding to the encrypted item and generates a decrypted VP including the obtained transaction item.

Images