Recovery system, recovery device, recovery program, and recovery method

Abstract

[Problem] [Solution] A recovery system for restoring control of security information including a private key, the recovery system comprising: a security information generation unit for generating the security information; an encrypted security information storage unit for storing encrypted security information obtained by encrypting the security information; and a decryption unit for decrypting the encrypted security information. The security information generation unit, the encrypted security information storage unit, and the decryption unit are provided in information terminals each having a different owner.

Description

Recovery system, recovery device, recovery program, and recovery method

[0001] The present invention relates to a recovery system, a recovery device, a recovery program, and a recovery method.

[0002] For services on the Internet, IDs that can be used across multiple services are becoming commonplace, and such login infrastructure provided by ID providers is called a "federated ID."

[0003] While login platforms such as federated IDs have reduced the burden of service logins for many users and have been used conveniently, problems have arisen, such as information asymmetry between ID providers, service providers, and users, the difficulty of ensuring user privacy, and the oligopoly of ID providers.

[0004] It was in this context that blockchain technology was born, and as decentralized thinking spread, discussions grew that blockchain technology could be used not only for crypto assets (virtual currencies), but also as one of the technologies to realize self-sovereign identity (SSI), which would allow users to regain control of their own information.

[0005] A technology called Decentralized Digital Identity (DID) was proposed during these discussions. DID is a technology that can solve the frequent data leaks that occur around the world and the problem of centralization of user information by service providers by assigning a decentralized identifier to everything, including people and objects, and is considered to be one of the technologies that will realize SSI. Self-management of DID and user information requires each user to securely manage their own private key.

[0006] Japanese Patent Application Publication No. 11-239124

[0007] For example, Patent Document 1 discloses a method for enabling online recovery of a damaged private key without leaking it to third parties. The method generates a private key and a public key on a user terminal, divides the private key, stores the divided private key information in multiple management mechanisms, and combines the divided private key information when the private key is to be recovered.

[0008] However, in the technology of Patent Document 1, the storage device directly manages the information of the divided private keys, and it is necessary to manage the same amount of private information as the number of user terminals, which increases management costs.

[0009] The present invention has been made in light of this background, and aims to enable users to restore control of secret information such as private keys while reducing the management costs of institutions that manage secret information.

[0010] In order to solve the above problems, the recovery system disclosed herein is a recovery system that restores control of security information including a private key, and includes a security information generation unit that generates the security information, an encrypted security information storage unit that stores encrypted security information that has encrypted the security information, and a decryption unit that decrypts the encrypted security information, wherein the security information generation unit, the encrypted security information storage unit, and the decryption unit are each provided on an information terminal owned by a different owner.

[0011] Other problems and solutions disclosed in this application will be made clear in the section on preferred embodiments of the invention and the drawings.

[0012] According to the present invention, it is possible to support the restoration of control over secret information such as users' private keys while reducing the management costs and security risks of institutions that manage secret information, even though it is non-custodial.

[0013] FIG. 1 is a diagram showing an example of the overall configuration of a recovery system according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of the hardware configuration of a server device 1 according to the embodiment. FIG. 3 is a diagram showing an example of the functional configuration of the server device 1 according to the embodiment. FIG. 4 is a diagram showing an example of the hardware configuration of a user terminal 3 according to the embodiment. FIG. 5 is a diagram showing an example of the functional configuration of the user terminal 3 according to the embodiment. FIG. 6 is a diagram showing an example of the hardware configuration of an institution terminal 4 according to the embodiment. FIG. 7 is a diagram showing an example of the functional configuration of the institution terminal 4 according to the embodiment. FIG. 8 is a diagram showing an example of the processing and flow of each information processing terminal constituting the recovery system according to the embodiment.

[0014] <Summary of the Invention> [Item 1] A recovery system for restoring control of security information including a private key, comprising: a security information generation unit that generates the security information; an encrypted security information storage unit that stores encrypted security information obtained by encrypting the security information; and a decryption unit that decrypts the encrypted security information, wherein the security information generation unit, the encrypted security information storage unit, and the decryption unit are each provided on an information terminal owned by a different owner. [Item 2] The recovery system according to item 1, further comprising: a restoration unit that restores control of the security information using the decrypted security information decrypted by the decryption unit, wherein the security information generation unit and the restoration unit are provided on a user terminal that is the information terminal used by a user who manages assets. [Item 3] The recovery system according to item 1 or 2, wherein the security information includes private key shares obtained by dividing the private key into multiple shares and recovery information used to regenerate at least one of the private key shares, and the encrypted security information storage unit stores the encrypted recovery information. [Item 4] The recovery system according to item 1 or 2, wherein the decryption unit is not provided in a server device that is the information terminal managed by a wallet provider. [Item 5] The recovery system according to item 3, wherein the decryption unit is not provided in a server device that is the information terminal managed by a wallet provider. [Item 6] The recovery system according to item 4, wherein the encrypted security information storage unit is provided in the server device, and the user terminal comprises the security information generation unit, a security information encryption unit that encrypts the security information, and a presentation unit that presents the encrypted security information to the server device.[Item 7] The recovery system according to Item 6, wherein the encrypted security information storage unit transmits the encrypted security information to the user terminal when a request for encrypted security information is received from the user terminal. [Item 8] A recovery program for restoring control of security information including a private key, the recovery program causing a computer to execute a security information generation step of generating the security information, an encrypted security information storage step of storing encrypted security information obtained by encrypting the security information, and a decryption step of decrypting the encrypted security information, wherein the security information generation step, the encrypted security information storage step, and the decryption step are each executed on an information terminal owned by a different person. [Item 9] A recovery method for restoring control of security information including a private key, the recovery program causing a computer to execute a security information generation step of generating the security information, an encrypted security information storage step of storing encrypted security information obtained by encrypting the security information, and a decryption step of decrypting the encrypted security information, wherein the security information generation step, the encrypted security information storage step, and the decryption step are each executed on an information terminal owned by a different person.

[0015] One element in realizing decentralized digital identity is the digital wallet, a module for managing private keys and signing for a variety of purposes, from managing users' crypto assets to storing and presenting attribute (address, date of birth, credential information, etc.) certificates.

[0016] Digital wallets can be broadly divided into two types: custodial wallets, in which a third party such as a wallet provider manages the user's private key, and non-custodial wallets, in which each user manages their private key at their own risk.

[0017] As mentioned above, a distinctive feature of custodial wallets is that private keys are managed by a third-party organization (custodian). Custodial wallets are often incorporated into cryptocurrency exchanges and services. Because the custodian is responsible for managing private keys, if the custodian goes bankrupt or is hacked, private keys may be stolen and assets may be lost. Even if you forget your password, it may be possible to restore it by verifying your identity.

[0018] A feature of non-custodial wallets is that users themselves manage their private keys. Because users manage their own private keys, there is no risk of the custodian going bankrupt or being hacked, and assets can be managed without being influenced by a third party (custodian). However, if a private key is lost, it is highly likely that it cannot be restored, so users must manage their private keys and private key recovery information and take security measures themselves.

[0019] In decentralized digital identity, while non-custodial wallets prevent the wallet provider from freezing crypto assets or fraudulently presenting attribute information, it is known to be difficult for users to manage their private keys at their own risk (including recovering them in the event of loss).

[0020] Therefore, it is possible to entrust the recovery information necessary to recover private information, including private keys, to a trusted third party, but the third party must manage the recovery information for each user, which is costly and a significant hurdle.

[0021] In this embodiment, the user entrusts security information, including recovery information, to a trusted third party (hereinafter referred to as the "recovery agent") and a service provider such as a wallet, who jointly manage the security information. This reduces the recovery agent's burden of managing confidential information and security risks, and provides a service that makes it easy to recover confidential information, even though it is a non-custodial wallet.

[0022] The recovery system in this embodiment is composed of an authority terminal 4 used by a recovery operator to present a public key, securely store a decryption private key that decrypts security information encrypted with the public key, and perform decryption processing using the private key, a server device 1 used by a service provider such as a wallet that securely stores each user's encrypted security information, a user terminal 3 used by users that generates and encrypts security information, and a secure encrypted communication path between these entities.With this configuration, the service provider manages each user's encrypted security information on their behalf, so the recovery operator does not have to manage each user's security information, and the risk of users' security information being immediately leaked can be reduced even if the recovery operator's private key is compromised.

[0023] This embodiment discloses a recovery system that restores (recovers) control of private information such as a user's private key in a non-custodial wallet.

[0024] 1 is a diagram showing an example of the overall configuration of a recovery system according to one embodiment of the present invention. The recovery system of this embodiment is configured to include a server device 1. The server device 1 is communicably connected to a user terminal 3 and an institution terminal 4 via a communication network 2. The communication network 2 is, for example, the Internet, and is constructed using a public telephone network, a mobile phone network, a wireless communication path, Ethernet (registered trademark), or the like.

[0025] ==Server Device 1== The server device 1 is a service provider such as a wallet provider, and is a computer operated by a business (provider) that stores encrypted security information (described later). For example, it may be a general-purpose computer such as a workstation or personal computer, or may be logically realized by cloud computing. In this embodiment, for convenience of explanation, one server is illustrated as an example, but the present invention is not limited to this, and multiple servers may be used.

[0026] FIG. 2 is a diagram illustrating an example of the hardware configuration of the server device 1. Note that the illustrated configuration is an example, and other configurations may also be used. The server device 1 includes a processor 101, a memory 102, a storage device 103, a communication interface 104, an input device 105, and an output device 106. The storage device 103 stores various data and programs, and is, for example, a hard disk drive, a solid-state drive, or a flash memory. The communication interface 104 is an interface for connecting to the communication network 2, and is, for example, an adapter for connecting to Ethernet (registered trademark), a modem for connecting to a public telephone network, a wireless communication device for wireless communication, a USB (Universal Serial Bus) connector, or an RS232C connector for serial communication. The input device 105 is, for example, a keyboard, a mouse, a touch panel, buttons, a microphone, or the like for inputting data. The output device 106 is, for example, a display, a printer, a speaker, or the like for outputting data. Each functional unit of the server device 1 described below is realized by the processor 101 reading a program stored in the storage device 103 into the memory 102 and executing it, and each storage unit of the server device 1 is realized as part of the storage area provided by the memory 102 and the storage device 103.

[0027] Fig. 3 shows the functional configuration of server device 1. As shown in Fig. 3, server device 1 includes a storage unit of encrypted security information storage unit 131, and processing units of wallet service providing unit 111, encrypted security information acquisition unit 112, and encrypted security information presentation unit 113.

[0028] ==User Terminal 3== The user terminal 3 is a computer used by a user who handles assets such as crypto assets and attribute information. For example, it is a smartphone, tablet computer, personal computer, wearable computer, etc. The user can access the server device 1 or the institution terminal 4, for example, using an application or web browser executed on the user terminal 3.

[0029] FIG. 4 is a diagram showing an example of the hardware configuration of the user terminal 3. Note that the illustrated configuration is an example, and other configurations may also be used. The user terminal 3 includes a processor 301, a memory 302, a storage device 303, a communication interface 304, an input device 305, and an output device 306. The storage device 303 stores various data and programs, and is, for example, a hard disk drive, a solid-state drive, or a flash memory. The communication interface 304 is an interface for connecting to the communication network 2, and is, for example, an adapter for connecting to Ethernet (registered trademark), a modem for connecting to a public telephone network, a wireless communication device for wireless communication, a USB (Universal Serial Bus) connector or an RS232C connector for serial communication, etc. The input device 305 is, for example, a keyboard, a mouse, a touch panel, buttons, a microphone, etc. for inputting data. The output device 306 is, for example, a display, a printer, a speaker, etc. for outputting data. Each functional unit of the user terminal 3 described below is realized by the processor 301 reading a program stored in the storage device 303 into the memory 302 and executing it, and each storage unit of the user terminal 3 is realized as part of the storage area provided by the memory 302 and the storage device 303.

[0030] Fig. 5 shows the functional configuration of the user terminal 3. As shown in Fig. 5, the user terminal 3 includes each of the following processing units: a security information generation unit 311, a security information encryption unit 312, a presentation unit 313, a security information request unit 314, a decryption request unit 315, and a restoration unit 316.

[0031] ==Institution Terminal 4== The institution terminal 4 is a computer operated by an institution (recovery institution) that presents the public key, securely stores the private key, and uses the private key to decrypt encrypted security information. For example, it may be a smartphone, tablet computer, personal computer, or wearable computer. Note that this institution must be independent of the institution that provides the wallet service. Also, the recovery institution is not limited to a single organization; the same security information may be encrypted with the private keys of multiple recovery institutions, each of which may be stored by a service provider.

[0032] FIG. 6 is a diagram showing an example of the hardware configuration of the engine terminal 4. Note that the illustrated configuration is an example, and other configurations may also be used. The engine terminal 4 includes a processor 401, a memory 402, a storage device 403, a communication interface 404, an input device 405, and an output device 406. The storage device 403 stores various data and programs, such as a hard disk drive, a solid-state drive, or a flash memory. The communication interface 404 is an interface for connecting to the communication network 2, such as an adapter for connecting to Ethernet (registered trademark), a modem for connecting to a public telephone network, a wireless communication device for wireless communication, or a USB (Universal Serial Bus) connector or an RS232C connector for serial communication. The input device 405 is used to input data, such as a keyboard, a mouse, a touch panel, buttons, or a microphone. The output device 406 is used to output data, such as a display, a printer, or a speaker. Each functional unit of the engine terminal 4 described below is realized by the processor 401 reading a program stored in the storage device 403 into the memory 402 and executing it, and each storage unit of the server device 1 is realized as part of the storage area provided by the memory 402 and the storage device 403.

[0033] Fig. 7 shows the functional configuration of the institution terminal 4. As shown in Fig. 5, the institution terminal 4 includes a storage unit of a decryption private key storage unit 431, a decryption unit 411, and a decryption security information presentation unit 412.

[0034] The encrypted security information storage unit 131 and the decryption private key storage unit 431 will now be described.

[0035] The encrypted security information storage unit 131 stores encrypted security information.

[0036] As an example, the security information is information generated by the user terminal 3, and may include a private key for the wallet (referred to as a user private key), private key shares, recovery information, etc.

[0037] The user private key is a private key used for sending and receiving crypto assets in the wallet and for digital signatures when presenting attribute information.

[0038] Private key shares are information in which a user private key is distributed among multiple shares. Even if one of the private key shares is lost or damaged, the user private key can be restored and a signature can be generated if the other shares are available. In this embodiment, there are three types of private key shares: a device share linked to the unique identification information of the user terminal 3, a provider share managed by a business operator (e.g., a wallet provider) that uses the server device 1, and a recovery share used for recovery. The signature is generated using two of these shares, but the invention is not limited to these shares.

[0039] The recovery information is, for example, information used when regenerating security information. The recovery information may be, for example, information used when regenerating a private key or a recovery share.

[0040] The decryption private key storage unit 431 stores a decryption private key for decrypting encrypted security information.

[0041] The following describes each processing unit: the wallet service providing unit 111, encrypted security information acquisition unit 112, and encrypted security information presentation unit 113 provided in the server device 1; the security information generating unit 311, security information encryption unit 312, presentation unit 313, security information request unit 314, decryption request unit 315, and restoration unit 316 provided in the user terminal 3; and the decryption unit 411 and decrypted security information presentation unit 412 provided in the authority terminal 4.

[0042] First, the process for generating security information will be described.

[0043] The wallet service providing unit 111 provides a wallet service to a user, for example. The wallet service in this embodiment is, for example, a service for safely storing and managing crypto assets, and may provide functions such as sending and receiving crypto assets, such as sending crypto assets to other users and receiving crypto assets from other wallets, asset management, such as balances and transaction history of owned crypto assets and digital assets such as NFTs, mining, staking, lending, and yield farming. The wallet service may also be, but is not limited to, a service for managing and presenting attribute information.

[0044] As an example, the security information generation unit 311 generates security information for a user to use a wallet service. The security information generated by the security information generation unit 311 may include, but is not limited to, a user private key, one or more shares of the private key (e.g., the recovery share described above), and recovery information.

[0045] The security information generation unit 311 generates, from the private key shares, a device share linked to the unique identification information of the user terminal 3 and a recovery share used for recovery. For example, when a user applies for use to the wallet service providing unit 111 from the user terminal 3, the security information generation unit 311 generates security information related to the wallet for that user. At this time, the server device 1 generates a provider share from the private key shares.

[0046] As an example, the security information encryption unit 312 encrypts the security information generated by the security information generation unit 311. The security information encryption unit 312 encrypts, for example, recovery information. The security information encryption unit 312 acquires, from the institution terminal 4, a public key generated by the institution terminal 4 managed by the recovery operator, and encrypts the security information using the public key.

[0047] For example, the presenting unit 313 presents the encrypted security information encrypted by the security information encrypting unit 312 to the server device 1 .

[0048] The encrypted security information acquisition unit 112 acquires the security information presented by the presentation unit 313 and stores it in the encrypted security information storage unit 131 .

[0049] Below is the process for recovering a wallet if a user loses or damages any of their shares.

[0050] The decryption request unit 315 presents the request information for decrypting the encrypted security information to the server device 1 .

[0051] The encrypted security information presentation unit 113 presents the encrypted security information stored in the encrypted security information storage unit 131 to the user terminal 3 .

[0052] The decryption request unit 315 presents the decryption request information, including the encrypted security information acquired from the encrypted security information presentation unit 113, to the institution terminal 4. At this time, the institution terminal 4 may perform identity authentication of the user.

[0053] As an example, the decryption unit 411 decrypts the encrypted security information using the decryption private key stored in the decryption private key storage unit 431 .

[0054] As an example, the decrypted security information presentation unit 412 presents the security information decrypted by the decryption unit 411 to the user terminal 3 .

[0055] For example, the restoration unit 316 acquires the decryption security information presented by the decryption security information presentation unit 412 and uses the decryption security information to regenerate security information (which may be, for example, a recovery share). The restoration unit 316 restores control of secret information such as a private key using the regenerated recovery share and an existing share.

[0056] Regarding the control of secret information by the restoration unit 316, the security information generation unit 311 regenerates the device share linked to the unique identification information of the user terminal 3 and the recovery share used for recovery. At this time, the server device 1 regenerates the provider share from among the secret key shares.

[0057] FIG. 8 is a diagram illustrating an example of processing performed by the evaluation device of this embodiment.

[0058] The user terminal 3 presents application information for the wallet service to the server device 1 (3001), and the server device 1 acquires the application information (1001). The user terminal 3 generates security information including a user private key, device share, recovery share, and recovery information (3002). The server device 1 generates a provider share (1002). The institution terminal 4 presents a public key to the user terminal 3 (4001), and the user terminal 3 acquires the public key (3003). The user terminal 3 encrypts security information including recovery information with the public key (3004). The user terminal 3 presents the encrypted security information to the server device 1 (3005), and the server device 1 acquires and stores the encrypted security information (1003). The user terminal 3 submits an encrypted security information request to the server device 1 (3005), and the server device 1 acquires the encrypted security information request (1004). The server device 1 presents the encrypted security information to the user terminal 3 (1005), and the user terminal 3 acquires the encrypted security information (3007). The user terminal 3 presents recovery request information including the encrypted security information to the institution terminal 4 (3008), and the institution terminal 4 acquires the recovery request (4002). The institution terminal 4 decrypts the encrypted security information with the decryption private key (4003). The institution terminal 4 presents the decrypted security information to the user terminal 3 (4004), and the user terminal 3 acquires the decrypted security information (3009). The user terminal 3 regenerates the security information using the decrypted security information (3010). The regenerated recovery share and existing shares are used to restore control of secret information such as the private key (3011).

[0059] Other examples are given below.

[0060] Although the present disclosure describes an embodiment of a private key recovery method for a digital wallet, the present disclosure may be applied to various services that use private keys, such as, but not limited to, cloud storage, e-commerce sites, IoT devices, and the like.

[0061] Although the preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings, the technical scope of the present disclosure is not limited to such examples. It is clear that a person skilled in the art of the present disclosure can conceive of various modified or altered examples within the scope of the technical idea described in the claims, and it is understood that these also naturally fall within the technical scope of the present disclosure.

[0062] The devices described in this specification may be realized as a single device, or may be realized by a plurality of devices (e.g., cloud servers) some or all of which are connected via a communication network. For example, the CPU and storage device of the server device 1 may be realized by different servers connected to each other via a communication network.

[0063] The series of processes performed by the device described herein may be implemented using software, hardware, or a combination of software and hardware. A computer program for implementing each function of the server device 1 according to this embodiment may be created and installed on a PC or the like. A computer-readable recording medium storing such a computer program may also be provided. Examples of the recording medium include a magnetic disk, an optical disk, a magneto-optical disk, and a flash memory. The computer program may also be distributed, for example, via a communication network without using a recording medium.

[0064] Additionally, the processes described herein do not necessarily have to be performed in the order described, some process steps may be performed in parallel, additional process steps may be employed, and some process steps may be omitted.

[0065] Furthermore, the effects described herein are merely descriptive or exemplary and are not limiting. In other words, the technology according to the present disclosure may achieve other effects that will be apparent to those skilled in the art from the description of this specification, in addition to or in place of the above-described effects.

[0066] REFERENCE SIGNS LIST 1 Server device 2 Communication network 3 User terminal 101 CPU 102 Memory 103 Storage device 104 Communication interface 105 Input device 106 Output device 111 Wallet service providing unit 112 Encrypted security information acquisition unit 113 Encrypted security information presentation unit 131 Encrypted security information storage unit 301 CPU 302 Memory 303 Storage device 304 Communication interface 305 Input device 306 Output device 311 Security information generation unit 312 Security information encryption unit 313 Presentation unit 314 Security information request unit 315 Decryption request unit 316 Restoration unit 401 CPU 402 Memory 403 Storage device 404 Communication interface 405 Input device 406 Output device 411 Decryption unit 412 Decrypted security information presentation unit 431 Decryption private key storage unit

Claims

1. A recovery system for restoring control of security information including a private key, comprising: a security information generation unit that generates the security information; an encrypted security information storage unit that stores encrypted security information obtained by encrypting the security information; and a decryption unit that decrypts the encrypted security information, wherein the security information generation unit, the encrypted security information storage unit, and the decryption unit are each located on an information terminal owned by a different owner.

2. A recovery system as described in claim 1, further comprising: a restoration unit that restores control of the security information using the decrypted security information decrypted by the decryption unit; wherein the security information generation unit and the restoration unit are provided in a user terminal, which is the information terminal used by a user who manages assets.

3. A recovery system as described in claim 1 or 2, wherein the security information includes private key shares obtained by dividing the private key into multiple shares and recovery information used when regenerating at least one of the private key shares, and the encrypted security information storage unit stores the encrypted recovery information.

4. A recovery system according to claim 1 or 2, wherein the decryption unit is not provided in a server device that is the information terminal managed by a wallet provider.

5. A recovery system according to claim 3, wherein the decryption unit is not provided in a server device that is the information terminal managed by a wallet provider.

6. A recovery system as described in claim 4, wherein the encrypted security information storage unit is provided in the server device, and the user terminal is provided with the security information generation unit, a security information encryption unit that encrypts the security information, and a presentation unit that presents the encrypted security information to the server device.

7. A recovery system according to claim 6, wherein the encrypted security information storage unit transmits the encrypted security information to the user terminal when a request for encrypted security information is received from the user terminal.

8. A recovery program for restoring control of security information including a private key, the recovery program causing a computer to execute a security information generation step for generating the security information, an encrypted security information storage step for storing encrypted security information obtained by encrypting the security information, and a decryption step for decrypting the encrypted security information, wherein the security information generation step, the encrypted security information storage step, and the decryption step are each executed on an information terminal owned by a different owner.

9. A recovery method for restoring control of security information including a private key, wherein a computer executes the following steps: a security information generation step for generating the security information; an encrypted security information storage step for storing encrypted security information obtained by encrypting the security information; and a decryption step for decrypting the encrypted security information, wherein the security information generation step, the encrypted security information storage step, and the decryption step are each executed on an information terminal owned by a different owner.

Images