Migration source device, system, program, verification device, and data migration method

Abstract

A migration source device (20, 30) which is the migration source of issued data (3) comprises a control unit (21, 31) that: acquires a migration destination public key associated with a migration destination device (30, 40) which is the migration destination of the issued data (3); generates migration information (5, 5', 6) including identification information for uniquely identifying the issued data (3) or other migration information (5), the acquired migration destination public key, and a migration source signature for the identification information and the migration destination public key, the migration source signature being generated using a migration source secret key associated with the migration source device (20, 30); and provides the generated migration information (5, 5', 6) to the migration destination device (30, 40) together with the issued data (3).

Description

Source device, system, program, verification device, and data migration method

[0001] This disclosure relates to source devices, systems, programs, verification devices, and data migration methods.

[0002] In recent years, the concept of self-sovereign identity (SSI) has been considered as a new approach to identity management. Furthermore, technologies such as W3C Decentralized Identifiers (DID) (see Non-Patent Document 1) and W3C Verifiable Credentials (VC) (see Non-Patent Document 2) are being considered as implementation technologies for SSI. In self-sovereign identity, users manage their own identifiers or identities and control where they are provided, without relying on centralized identity providers (ID providers or IdPs). In the world of SSI, there are three parties: Holder, Issuer, and Verifier. The Holder is the user's mobile phone, etc., which manages or holds their digital identity. The Issuer verifies attribute information (name, age, address, etc.) or qualification information (being an employee of a certain company, or a member of a certain service, etc.) and issues attribute or qualification certificates (VC), such as vaccination certificates, to the user. The Verifier verifies the Holder's attributes or qualifications by requesting and receiving the necessary VC from the Holder for service provision, and makes decisions regarding service provision (see Non-Patent Document 3).

[0003] Furthermore, a digital identity wallet (DIW) function has been proposed that stores Holder ID data and is used for identity verification or attribute certification (see Non-Patent Document 4). There are two forms of DIW implementation: a local wallet deployed within the user's operating terminal (UE) and a cloud wallet provided on a platform hosted by a cloud provider or the like.

[0004] To change the cloud service provider, it is necessary to migrate the VC. When changing the user's operating terminal, such as changing the UE model, it is also necessary to migrate the VC. After migrating the VC to another device or the digital identity wallet associated with the DID, as a method for proving the binding between the new device and the VC, there is a method of nesting the VC3 as shown in FIG. 6, Verifiable Presentation (VP) (see Non-Patent Document 2). In the method of nesting the VC, the signature 102 is performed on the information combining the attribute information or qualification information and the information for binding.

[0005] “Decentralized Identifiers (DIDs) v1.0”, [online], W3C, [searched on August 30, 2024], Internet <URL: https: / / www.w3.org / TR / did-core / > “Verifiable Credentials Data Model v1.1”, [online], W3C, [searched on August 30, 2024], Internet <URL: https: / / www.w3.org / TR / vc-data-model / > “Verifiable Credentials Data Model v2.0”, [online], W3C, [searched on August 30, 2024], Internet <URL: https: / / www.w3.org / TR / vc-data-model-2.0 / > “Shaping Europe’s digital future”, [online], European Commission, [searched on August 30, 2024], Internet <URL: https: / / digital-strategy.ec.europa.eu / en / library / european-digital-identity-wallet-architecture-and-reference-framework>

[0006] When migrating Virtual Machines (VCs) between devices via an intermediate server, it is conceivable to encrypt the VCs to avoid disclosing attribute information or credentials to the intermediate server. However, in the case of nesting VCs, the signature guarantees the integrity of the encrypted information, but not the integrity of the original information, making it impossible to prove that the VC is linked to the destination device. Therefore, a mechanism is needed that allows for the migration of VCs without disclosing the information contained within them to the intermediary.

[0007] In light of these circumstances, the purpose of this disclosure is to provide a technology that enables the transfer of data such as VCs without disclosing their contents to an intermediary device.

[0008] A migration source device according to one embodiment is a source of issued data, and includes a control unit that acquires a destination public key associated with a destination device to which the issued data will be migrated, generates migration information including identification information that uniquely identifies the issued data or other migration information, the acquired destination public key, and a source private key associated with the migration source device, which includes a source signature for the identification information and the destination public key, and provides the generated migration information to the destination device together with the issued data.

[0009] A system according to one embodiment comprises a first holding device, an intermediary device, and a second holding device, wherein the first holding device and the intermediary device each function as the source device described above, the intermediary device functions as the destination device when the first holding device functions as the source device, and acquires first transition information from the first holding device as transition information, which is generated by the first holding device and includes first identification information that uniquely identifies the issued data as identification information, and the second holding device functions as the destination device when the intermediary device functions as the source device, and acquires second transition information from the intermediary device together with the first transition information, which is generated by the intermediary device as transition information and includes second identification information that uniquely identifies the first transition information as identification information.

[0010] A program according to one embodiment causes a computer to function as the source device described above.

[0011] A verification device according to one embodiment includes a control unit that, when the verification of the destination of the issued data is successful, obtains from a destination device which is the destination of the issued data migration information, which includes an identification information that uniquely identifies the issued data or other migration information, a destination public key associated with the destination device, and a source private key associated with the source device which is the source of the issued data migration, and which includes a source signature for the identification information and the destination public key, together with the issued data; requests from the destination device a destination signature generated using the destination private key associated with the destination device; verifies the destination signature using the destination public key included in the obtained migration information; and, when the verification of the destination signature is successful, verifies that the issued data has been migrated from the source device to the destination device by referring to either the identification information included in the obtained migration information or information that uniquely identifies the issued data, which is identified using other migration information identified by the identification information.

[0012] A data migration method according to one embodiment includes: a source device, which is the source of the issued data, obtaining a destination public key associated with a destination device to which the issued data will be migrated; the source device generating migration information that includes identification information that uniquely identifies the issued data or other migration information, the obtained destination public key, and a source private key associated with the source device, and a source signature for the identification information and the destination public key; and the source device providing the generated migration information to the destination device together with the issued data.

[0013] According to this disclosure, data such as VCs can be transferred without disclosing their contents to the intermediary device.

[0014] This is a block diagram showing the configuration of a system according to one embodiment. This is a sequence diagram showing a first example of system operation. This is a sequence diagram showing a first example of system operation. This is a sequence diagram showing a second example of system operation. This is a diagram showing a method for nesting VCs.

[0015] One embodiment will be described below with reference to the figures.

[0016] In each figure, identical or corresponding parts are denoted by the same reference numerals. In the description of this embodiment, the description of identical or corresponding parts will be omitted or simplified as appropriate.

[0017] Referring to Figure 1, the configuration of the system 100 according to this embodiment will be described.

[0018] The system 100 comprises an issuing device 10, a first holding device 20, an intermediary device 30, a second holding device 40, and a verification device 50.

[0019] The issuing device 10, the intermediary device 30, and the verification device 50 are each one or more computers, such as servers. The first owned device 20 and the second owned device 40 are terminals used by the same user, such as smartphones.

[0020] The issuing device 10, the first holding device 20, the intermediary device 30, the second holding device 40, and the verification device 50 each include a memory, control units 11, 21, 31, 41, and 51, and an interface.

[0021] Memory includes at least one semiconductor memory. Semiconductor memory is, for example, RAM, ROM, or flash memory. "RAM" is an abbreviation for random access memory. "ROM" is an abbreviation for read-only memory. RAM is, for example, SRAM or DRAM. "SRAM" is an abbreviation for static random access memory. "DRAM" is an abbreviation for dynamic random access memory. ROM is, for example, EEPROM. "EEPROM" is an abbreviation for electrically erasable programmable read-only memory. Flash memory is, for example, SSD. "SSD" is an abbreviation for solid-state drive. Memory functions, for example, as main memory, secondary memory, or cache memory.

[0022] The control units 11, 21, 31, 41, and 51 include at least one processor. The processor is, for example, a CPU or a GPU. "CPU" is an abbreviation for central processing unit. "GPU" is an abbreviation for graphics processing unit.

[0023] The interface includes at least one communication module. The communication module is, for example, a module compatible with a wired LAN communication standard such as Ethernet®, a wireless LAN communication standard such as IEEE 802.11, or a mobile communication standard such as LTE, 4G, or 5G. "LAN" is an abbreviation for local area network. "IEEE" is an abbreviation for Institute of Electrical and Electronics Engineers. "LTE" is an abbreviation for Long Term Evolution. "4G" is an abbreviation for 4th generation. "5G" is an abbreviation for 5th generation.

[0024] The functions of the issuing device 10, the first holding device 20, the intermediary device 30, the second holding device 40, and the verification device 50 are realized by executing the corresponding programs in the control units 11, 21, 31, 41, and 51. Each program causes the computer to execute the operations of the issuing device 10, the first holding device 20, the intermediary device 30, the second holding device 40, and the verification device 50, thereby causing the computer to function as the issuing device 10, the first holding device 20, the intermediary device 30, the second holding device 40, and the verification device 50, respectively. As will be described later, the issuing device 10, the first holding device 20, the intermediary device 30, and the second holding device 40 function as source devices that receive the issued data 3. That is, the computer functions as a source device by executing the operations of the issuing device 10, the first holding device 20, the intermediary device 30, and the second holding device 40 according to each program.

[0025] The program can be stored on a non-temporary computer-readable medium. Examples of non-temporary computer-readable mediums include flash memory, magnetic recording devices, optical discs, magneto-optical recording media, or ROM. The program can be distributed, for example, by selling, transferring, or lending portable media such as SD cards, DVDs, or CD-ROMs containing the program. "SD" is an abbreviation for Secure Digital. "DVD" is an abbreviation for digital versatile disc. "CD-ROM" is an abbreviation for compact disc read only memory. The program may also be distributed by storing it in server storage and transferring it from the server to other computers. The program may also be provided as a program product.

[0026] A computer, for example, stores a program stored on a portable medium or a program transferred from a server in its main memory. Then, the computer reads the program stored in the main memory with its processor and executes the processing according to the read program. The computer may also read a program directly from the portable medium and execute the processing according to the program. The computer may also execute the processing according to the received program sequentially each time a program is transferred to it from a server. Processing may also be performed by a so-called ASP type service, which does not transfer programs from the server to the computer, but realizes its function only through execution instructions and result retrieval. "ASP" is an abbreviation for application service provider. A program includes information used for processing by an electronic computer that is equivalent to a program. For example, data that is not a direct instruction to the computer but has the nature of defining the computer's processing falls under "equivalent to a program".

[0027] An overview of the system 100 according to this embodiment will be described.

[0028] The issuing device 10 and verification device 50 of system 100 provide a digital wallet service.

[0029] The issuing device 10 corresponds to the Issuer. The issuing device 10 issues issuance data 3 to the first holding device 20. The issuance data 3 is information about the user. In this embodiment, the issuance data 3 is an attribute or qualification certificate (VC) such as a vaccination certificate or a driver's license. The issuing device 10 may issue a VC to the user after verifying attribute information (name, age, or address, etc.) or qualification information (being an employee of a certain company, or being a member of a certain service, etc.).

[0030] The first holding device 20 corresponds to the original Holder. The second holding device 40 corresponds to the new Holder. When the issued data 3 is transferred from the first holding device 20 to the second holding device 40 via the intermediary device 30, the first holding device 20 encrypts the issued data 3 and generates encrypted data 4. The second holding device 40 decrypts the encrypted data 4. On the other hand, when the issued data 3 is transferred directly from the first holding device 20 to the second holding device 40, the first holding device 20 does not need to encrypt the issued data 3. If attribute information or credential information can be disclosed to the intermediary device 30, the first holding device 20 does not need to encrypt the issued data 3 even when the issued data 3 is transferred from the first holding device 20 to the second holding device 40 via the intermediary device 30.

[0031] The first holding device 20 selectively generates first transfer information 5 and transfer information 5'. First transfer information 5 indicates that the association of the issued data 3 has been transferred from the first holding device 20 to the intermediary device 30. Transfer information 5' indicates that the association of the issued data 3 has been transferred from the first holding device 20 to the second holding device 40. Therefore, the first holding device 20 functions as the source device for the transfer of the issued data 3. The intermediary device 30 and the second holding device 40 function as destination devices for the transfer of the issued data 3.

[0032] The first holding device 20 transmits the key 7 to the second holding device 40. In this embodiment, the key 7 is a password, but it may also be a common key. As another example, the first holding device 20 does not need to transmit the key 7 to the second holding device 40. In this case, the user may manage or store the key 7.

[0033] The intermediary device 30 corresponds to an intermediate server. The intermediary device 30 mediates the transfer of the issued data 3 between the first holding device 20 and the second holding device 40. If the first holding device 20 encrypts the issued data 3 and generates encrypted data 4, the intermediary device 30 acquires and stores the encrypted data 4. On the other hand, if the first holding device 20 does not encrypt the issued data 3, the intermediary device 30 acquires and stores the issued data 3 as is. If the first holding device 20 generates first transfer information 5, the intermediary device 30 also acquires and stores the first transfer information 5. The intermediary device 30 generates and stores second transfer information 6. The second transfer information 6 indicates that the association of the issued data 3 has been transferred from the intermediary device 30 to the second holding device 40. Therefore, the intermediary device 30 functions as the source device from which the issued data 3 is transferred. The intermediary device 30 may store the issued data 3 or encrypted data 4, the first migration information 5, and the second migration information 6 only for the period required to transfer the issued data 3 from the first holding device 20 to the second holding device 40. The intermediary device 30 may store the issued data 3 or encrypted data 4, the first migration information 5, and the second migration information 6 for a longer period. In other words, the intermediary device 30 may back up the issued data 3 or encrypted data 4, the first migration information 5, and the second migration information 6.

[0034] When the first holding device 20 generates the transition information 5', the second holding device 40 acquires and stores the transition information 5'.

[0035] Verification device 50 corresponds to a verifier. Verification device 50 verifies that the issued data 3 is linked to the second holding device 40 based on either the combination of the issued data 3, the first migration information 5, and the second migration information 6, or the combination of the issued data 3 and the migration information 5'. In other words, verification device 50 verifies that the issued data 3 has been migrated from the source device to the destination device. Verification device 50 requests the VC necessary for service provision from the second holding device 40 and receives the VC. Verification device 50 verifies the attributes or qualifications of the second holding device 40 and makes decisions regarding service provision, etc.

[0036] A first example of the operation of the system 100 according to this embodiment will be described. The method described below corresponds to the first data transfer method according to this embodiment. In the first example and the second example described later, the operation of the issuing device 10, the first holding device 20, the intermediary device 30, the second holding device 40, and the verification device 50 is performed by their respective control units 11, 21, 31, 41, and 51.

[0037] Figures 2 to 4 show the sequence of operations in which encrypted VCs are transferred between devices via the intermediary device 30 of system 100, namely between the first holding device 20, which is the source of the issued data 3, and the second holding device 40, which is the final destination of the issued data 3.

[0038] Referring to Figure 2, in S101, the issuing device 10 requests the public key associated with the first holding device 20 from the first holding device 20. In S102, the first holding device 20 transmits the public key associated with the first holding device 20 to the issuing device 10. As a result, the issuing device 10 obtains the public key associated with the first holding device 20.

[0039] If the public key associated with the first holding device 20 is already registered in a public key infrastructure (PKI) or public blockchain, the issuing device 10 may obtain the registered public key instead of executing steps S101 and S102. The issuing device 10 may verify the public key by having the first holding device 20, which possesses the corresponding private key, respond to a challenge-response using the said public key.

[0040] In S103, the issuing device 10 issues the issuance data 3. Specifically, the issuing device 10 generates issuance information that includes the issuance data 3, a public key associated with the first holding device 20, and an issuer signature. The issuer signature is a signature on the issuance data 3 and the public key associated with the first holding device 20, generated using the issuer private key associated with the issuing device 10. A third party other than the issuing device 10 can verify the issuer signature using the issuer public key associated with the issuing device 10, which corresponds to the issuer private key, and confirm that the issuance data 3 and the public key associated with the first holding device 20, which are included in the issuance information, have not been tampered with. In other words, the issuer signature included in the issuance information guarantees the integrity of the issuance data 3 and the public key associated with the first holding device 20, which are also included in the same issuance information. The issuing device 10 transmits the generated issuance information to the first holding device 20. As a result, the first holding device 20 obtains the issuance information from the issuing device 10.

[0041] In this embodiment, the issued data 3 is a VC. The issued information further includes a VC ID as identification information that uniquely identifies the issued data 3. The issuer signature also guarantees the integrity of the VC ID.

[0042] In steps S104 to S108, the first holding device 20 functions as the source device from which the issued data 3 is transferred, and the intermediary device 30 functions as the destination device to which the issued data 3 is transferred.

[0043] In S104, the first holding device 20 requests the mediating device 30 to provide the public key associated with the mediating device 30. In S105, the mediating device 30 transmits the public key associated with the mediating device 30 to the first holding device 20. As a result, the first holding device 20 obtains the public key associated with the mediating device 30. The public key associated with the mediating device 30 corresponds to the destination public key associated with the destination device.

[0044] If the public key associated with the mediation device 30 has already been registered in the PKI or the public blockchain, instead of executing the steps of S104 and S105, the first holding device 20 may acquire the registered public key. The mediation device 30 having the corresponding private key may respond to the challenge response using the public key, and the first holding device 20 may verify the public key.

[0045] In S106, the first holding device 20 generates transfer information for proving that the issued data 3 has been transferred from the source device to the destination device. Specifically, the first holding device 20 generates first transfer information 5 including first identification information uniquely identifying the issued data 3, the public key associated with the mediation device 30, and a first source signature. The first source signature is a signature for the first identification information and the public key associated with the mediation device 30, generated using the private key associated with the first holding device 20. A third party other than the first holding device 20 can verify that the first identification information and the public key associated with the mediation device 30 included in the first transfer information 5 have not been tampered with by verifying the first source signature using the public key associated with the first holding device 20 corresponding to the private key associated with the first holding device 20. That is, the first source signature included in the first transfer information 5 guarantees the integrity of the first identification information and the public key associated with the mediation device 30 included in the same first transfer information 5. The private key associated with the first holding device 20 corresponds to the source private key associated with the source device. The first holding device 20 transmits the first transfer information 5 to the mediation device 30. As a result, the mediation device 30 acquires the first transfer information 5 from the first holding device 20. When transmitting the first transfer information 5, the first holding device 20 may log in to the mediation device 30. That is, the mediation device 30 may accept the first transfer information 5 after performing authentication and authorization processing for the first holding device 20.

[0046] In this embodiment, the first identification information may be a VC ID or a hash value of the VC (Hash(VC)). The VC ID is extracted from the issuance information. Hash(VC) is calculated for the VC included in the issuance information. The first transfer information 5 is linked to the VC by the first identification information, that is, chained to the VC. The first transfer information 5 further includes a Chain ID1 as identification information that uniquely identifies the first transfer information 5. The first transferor signature also guarantees the integrity of the Chain ID1.

[0047] In this embodiment, the first transfer information 5 further includes a first encryption flag indicating whether the issuance data 3 is provided by the mediation device 30 in an encrypted state. In this embodiment, the first encryption flag indicates that the issuance data 3 is encrypted. However, when S107 described later is omitted and the issuance data 3 is transmitted to the mediation device 30 instead of the encrypted data 4, the first encryption flag indicates that the issuance data 3 is not encrypted. The first transferor signature also guarantees the integrity of the first encryption flag. Therefore, a third party other than the first holding device 20 can confirm whether the content of the VC, such as a vaccination certificate or a driver's license, has been disclosed to the mediation device 30 by verifying the first transferor signature.

[0048] In S107, the first holding device 20 encrypts the issuance data 3 using the key 7 to generate encrypted data 4. In this example, the encryption is based on the password input by the user to the first holding device 20 as the key 7. The first holding device 20 provides the issuance data 3 to the mediation device 30 by transmitting the encrypted data 4 to the mediation device 30. Specifically, the first holding device 20 extracts the issuance data 3 from the issuance information, encrypts the issuance data 3 to generate encrypted data 4, replaces the issuance data 3 included in the issuance information with the encrypted data 4, and then transmits the issuance information to the mediation device 30 to provide the issuance data 3 to the mediation device 30. As a result, the mediation device 30 acquires the issuance data 3 together with the issuance information.

[0049] In S108, the mediation device 30 stores the encrypted data 4 and the first transfer information 5.

[0050] Subsequent processing may be performed some time after S108. In other words, the steps up to S108 and the steps from S109 onwards may be separated.

[0051] Referring to Figure 3, in steps S109 to S115, the intermediary device 30 functions as the source device for the transfer of the issued data 3, and the second holding device 40 functions as the destination device for the transfer of the issued data 3.

[0052] In S109, the second holding device 40 logs in to the intermediary device 30. That is, the intermediary device 30 performs authentication and authorization processing for the second holding device 40. In S110, the intermediary device 30 provides the second holding device 40 with the issuance data 3 by transmitting encrypted data 4 to the second holding device 40. Specifically, the intermediary device 30 provides the issuance data 3 to the intermediary device 30 by transmitting issuance information to the second holding device 40. As a result, the second holding device 40 acquires the issuance data 3 along with the issuance information.

[0053] In S111, the second holding device 40 decrypts the encrypted data 4 using the key 7 and generates the issued data 3. The decryption process corresponds to the encryption in S107. For example, if the password entered by the user into the second holding device 40 matches the password entered in S107 (key 7 in Figure 1), the second holding device 40 can decrypt the encrypted data 4. If the two passwords do not match, the process is terminated. Specifically, the second holding device 40 extracts the encrypted data 4 from the issuance information, decrypts the encrypted data 4, and generates the issued data 3.

[0054] In S112, the second holding device 40 extracts the first identification information from the issuance information and transmits the first identification information to the intermediary device 30 to request a transfer certificate chain.

[0055] In S113, the intermediary device 30 requests the second holding device 40 to provide the public key associated with the second holding device 40. In S114, the second holding device 40 transmits the public key associated with the second holding device 40 to the intermediary device 30. As a result, the intermediary device 30 obtains the public key associated with the second holding device 40. The public key associated with the second holding device 40 corresponds to the destination public key associated with the destination device.

[0056] In S115, the intermediary device 30 generates migration information to prove that the issued data 3 has been migrated from the source device to the destination device. Specifically, the intermediary device 30 generates second migration information 6 which includes second identification information that uniquely identifies the first migration information 5, a public key associated with the second holding device 40, and a second source signature. The second source signature is a signature to the second identification information and the public key associated with the second holding device 40, generated using the private key associated with the intermediary device 30. A third party other than the intermediary device 30 can verify the second source signature using the public key associated with the intermediary device 30, which corresponds to the private key associated with the intermediary device 30, and confirm that the second identification information and the public key associated with the second holding device 40 included in the second migration information 6 have not been tampered with. In other words, the second source signature included in the second migration information 6 guarantees the integrity of the second identification information and the public key associated with the second holding device 40, both of which are also included in the second migration information 6. The private key associated with the intermediary device 30 corresponds to the source private key associated with the source device. The intermediary device 30 transmits the first migration information 5 and the second migration information 6 to the second holding device 40. As a result, the second holding device 40 obtains the first migration information 5 and the second migration information 6 from the intermediary device 30.

[0057] In this embodiment, the second identification information may be Chain ID1, or a hash value obtained by hashing at least the portion of the first migration information 5 that includes Chain ID1, such as the hash value of the concatenated string of Hash(VC) and Chain ID1 (Hash(Hash(VC) | Chain ID1)). Chain ID1 is extracted from the first migration information 5. Hash(Hash(VC) | Chain ID1) is calculated by concatenating Hash(VC) and Chain ID1 contained in the first migration information 5. The second migration information 6 is linked to the first migration information 5 by the second identification information, that is, it is chained to the first migration information 5. The second migration information 6 further includes Chain ID2 as identification information that uniquely identifies the second migration information 6. The second migration source signature also guarantees the integrity of Chain ID2. Chain ID2 is used when it is necessary to link further migration information to the second migration information 6, that is, when the chain continues further.

[0058] Subsequent processing may be performed some time after S115. If the issued data 3 is transferred multiple times, the same processing as S104 to S115 is repeated the number of times the data is transferred. For example, after the processing from S104 to S115 is executed and the issued data 3 is transferred from the first holding device 20 to the second holding device 40 via the intermediary device 30, the same processing may be executed again and the issued data 3 is transferred from the second holding device 40 to the third holding device via the intermediary device 30.

[0059] Referring to Figure 4, in steps S116 to S117, the verification device 50 verifies the attributes or qualifications necessary for the second holding device 40 to receive a specific service. Therefore, the process from S116 to S117 may be executed each time the second holding device 40 receives a specific service.

[0060] In S116, the second holding device 40 transmits the issuance data 3, the first transition information 5, and the second transition information 6 to the verification device 50. As a result, the verification device 50 acquires the second transition information 6 from the second holding device 40 along with the issuance data 3 and the first transition information 5. Specifically, the issuance data 3 is transmitted from the second holding device 40 to the verification device 50, and the verification device 50 acquires the issuance information along with the data. The second holding device 40 may also transmit presentation data such as VP, which is created by processing the issuance data 3, the first transition information 5, and the second transition information 6, to the verification device 50. The presentation data may include multiple VCs or other data.

[0061] In S117, the verification device 50 verifies that the issued data 3 is associated with the second holding device 40, based on the issued data 3, the first transfer information 5, and the second transfer information 6. Specifically, the verification device 50 requests the second holding device 40 to provide a destination signature generated using the private key associated with the second holding device 40. The verification device 50 verifies the destination signature using the public key associated with the second holding device 40, which is included in the second transfer information 6. If the verification of the destination signature is successful, the verification device 50 identifies the first identification information using the first transfer information 5, which is identified by the second identification information included in the second transfer information 6. The verification device 50 then verifies, by referring to the first identification information, that the issued data 3 has been transferred from the first holding device 20 to the intermediary device 30, and further transferred from the intermediary device 30 to the second holding device 40. More specifically, the verification device 50 uses the public key associated with the intermediary device 30, which is included in the first transfer information 5 identified by the second identification information, to verify that the issued data 3 has been transferred from the intermediary device 30 to the second holding device 40. For example, if the public key associated with the intermediary device 30 is already registered in a PKI or public blockchain, the verification device 50 can determine that the issued data 3 has been transferred from the intermediary device 30 to the second holding device 40 by checking that the public key associated with the intermediary device 30, which is included in the same issuance information as the issued data 3 identified by the first identification information, is associated with the first holding device 20, to verify that the issued data 3 has been transferred from the first holding device 20 to the intermediary device 30. For example, if the public key associated with the first holding device 20 is already registered in a PKI or public blockchain, then it can be determined that the issued data 3 has been transferred from the first holding device 20 to the intermediary device 30 by checking whether the public key associated with the first holding device 20 included in the issuance information matches the registered public key.

[0062] A second example of the operation of the system 100 according to this embodiment will be described. The method described below corresponds to the second data migration method according to this embodiment.

[0063] Figure 5 shows the sequence of operations in which devices communicate with each other without the intermediary device 30, in other words, P2P, and the VC is transferred between devices without encryption. In other examples, devices may communicate with each other without the intermediary device 30, and the VC may be encrypted before being transferred between devices.

[0064] Since steps S201 to S203 are the same as steps S101 to S103 described above, their explanation will be omitted.

[0065] In steps S204 to S206, the first owned device 20 functions as the source device for the transfer of the issued data 3, and the second owned device 40 functions as the destination device for the transfer of the issued data 3.

[0066] In S204, the first holding device 20 requests the second holding device 40 to provide the public key associated with the second holding device 40. In S205, the second holding device 40 transmits the public key associated with the second holding device 40 to the first holding device 20. As a result, the first holding device 20 obtains the public key associated with the second holding device 40. The public key associated with the second holding device 40 corresponds to the destination public key associated with the destination device.

[0067] In S206, the first holding device 20 generates migration information to prove that the issued data 3 has been migrated from the source device to the destination device. Specifically, the first holding device 20 generates migration information 5' which includes identification information that uniquely identifies the issued data 3, a public key associated with the second holding device 40, and a source signature. The source signature is a signature to the identification information and the public key associated with the second holding device 40, generated using the private key associated with the first holding device 20. A third party other than the first holding device 20 can verify the source signature using the public key associated with the first holding device 20, which corresponds to the private key associated with the first holding device 20, and confirm that the identification information and the public key associated with the second holding device 40 included in the migration information 5' have not been tampered with. In other words, the source signature included in the migration information 5' guarantees the integrity of the identification information and the public key associated with the second holding device 40, which are also included in the same migration information 5'. The secret key associated with the first holding device 20 corresponds to the source secret key associated with the source device. The first holding device 20 transmits the issuance information and the migration information 5' to the second holding device 40. As a result, the second holding device 40 obtains the issuance information and the migration information 5' from the first holding device 20.

[0068] In this embodiment, the identification information may be a VC ID or a hash value of the VC (Hash(VC)). The VC ID is extracted from the issuance information. Hash(VC) is calculated for the VCs included in the issuance information. The migration information 5' is linked to the VC by the identification information, i.e., chained to the VC. The migration information 5' further includes a Chain ID as identification information that uniquely identifies the migration information 5'. The source signature also guarantees the integrity of the Chain ID.

[0069] Subsequent processing may be performed some time after S206. If the issued data 3 is transferred multiple times, the same processing as S204 to S206 is repeated the number of times the data is transferred. For example, after the processing from S204 to S206 is executed and the issued data 3 is transferred directly from the first holding device 20 to the second holding device 40, the same processing may be executed again to transfer the issued data 3 directly from the second holding device 40 to the third holding device. Alternatively, after the processing from S204 to S206 is executed and the issued data 3 is transferred directly from the first holding device 20 to the second holding device 40, the same processing as S104 to S115 may be executed again to transfer the issued data 3 from the second holding device 40 to the third holding device via the intermediary device 30.

[0070] In steps S207 to S208, the verification device 50 verifies the attributes or qualifications necessary for the second possessing device 40 to receive a specific service. Therefore, the processing from S207 to S208 may be executed each time the second possessing device 40 receives a specific service.

[0071] In S207, the second holding device 40 transmits the issuance data 3 and the transition information 5' to the verification device 50. As a result, the verification device 50 acquires the transition information 5' along with the issuance data 3 from the second holding device 40. Specifically, the issuance information is transmitted from the second holding device 40 to the verification device 50, and the verification device 50 acquires the issuance information along with the data. The second holding device 40 may also transmit presentation data, such as VP, created by processing the issuance data 3 and the transition information 5' to the verification device 50. The presentation data may include multiple VCs or other data.

[0072] In S208, the verification device 50 verifies that the issued data 3 is associated with the second holding device 40 based on the issued data 3 and the transfer information 5'. Specifically, the verification device 50 requests the second holding device 40 to provide a destination signature generated using the private key associated with the second holding device 40. The verification device 50 verifies the destination signature using the public key associated with the second holding device 40, which is included in the transfer information 5'. If the verification of the destination signature is successful, the verification device 50 verifies that the issued data 3 has been transferred from the first holding device 20 to the second holding device 40 by referring to the identification information included in the transfer information 5'. More specifically, the verification device 50 verifies that the issued data 3 has been transferred from the first holding device 20 to the second holding device 40 using the public key associated with the first holding device 20, which is included in the same issued information as the issued data 3 identified by the identification information. For example, if the public key associated with the first holding device 20 is already registered in a PKI or public blockchain, then it can be determined that the issued data 3 has been transferred from the first holding device 20 to the second holding device 40 by checking whether the public key associated with the first holding device 20 included in the issuance information matches the registered public key.

[0073] According to this embodiment, not only can the issued data 3, such as VC, be transferred without disclosing its contents to the intermediary device 30, but it can also be transferred directly between devices without going through the intermediary device 30.

[0074] The following further notes are disclosed regarding the embodiments described above.

[0075] (Note 1) A source device that is the source of the issued data, which includes a control unit that acquires a destination public key associated with a destination device to which the issued data will be transferred, generates transfer information that includes identification information that uniquely identifies the issued data or other transfer information, the acquired destination public key, and a source signature for the identification information and the destination public key, generated using the source private key associated with the source device, and provides the generated transfer information to the destination device together with the issued data. (Note 2) The source device according to Note 1, wherein the control unit encrypts the issued data to generate encrypted data, provides the issued data to the destination device by transmitting the encrypted data to the destination device, the transfer information further includes an encryption flag indicating whether the destination device provided the issued data in an encrypted state, and the source signature is a signature for the identification information, the destination public key, and the encryption flag. (Note 3) The source device according to Note 1 or 2, wherein the control unit obtains issuance information from the issuing device that issued the issuance data, including the issuance data, the source public key associated with the source device, and the source private key associated with the issuing device, which is generated using the issuance data and the source public key, and provides the issuance data to the destination device by transmitting the obtained issuance information to the destination device.(Appendix 4) A system comprising: a first holding device; an intermediary device; and a second holding device, wherein the first holding device and the intermediary device each function as a source device as described in any one of the appendix items 1 to 3; the intermediary device functions as the destination device when the first holding device functions as the source device, and acquires from the first holding device first transition information, which is generated by the first holding device and includes first identification information that uniquely identifies the issued data, as the transition information; and the second holding device functions as the destination device when the intermediary device functions as the source device, and acquires from the intermediary device second transition information, which is generated by the intermediary device and includes second identification information that uniquely identifies the first transition information, as the transition information, together with the first transition information. (Appendix 5) The system as described in Appendix 4, further comprising a verification device, the verification device acquires the second migration information from the second holding device together with the issuance data and the first migration information, requests the second holding device to provide a destination signature generated using the destination private key associated with the second holding device, verifies the destination signature using the destination public key included in the acquired second migration information, and, upon successful verification of the destination signature, identifies the first identification information using the first migration information identified by the second identification information included in the acquired second migration information, and verifies that the issuance data has been transferred from the source device to the destination device by referring to the identified first identification information. (Appendix 6) A program that causes a computer to function as a source device as described in any one of Appendix 1 to 3.(Appendix 7) A verification device comprising a control unit, which obtains, together with the issued data, a destination device which is the destination of the issued data, a destination public key associated with the destination device and a source private key associated with the source device which is the source of the issued data, and a source signature for the identification information and the destination public key generated using the identification information and the destination public key; requests the destination device to generate a destination signature generated using the destination private key associated with the destination device; verifies the destination signature using the destination public key included in the obtained transition information; and, upon successful verification of the destination signature, verifies that the issued data has been transferred from the source device to the destination device by referring to either the identification information included in the obtained transition information or information that uniquely identifies the issued data, which is identified using other transition information identified by the identification information. (Appendix 8) A data migration method comprising: a source device, which is the source of the issued data, obtaining a destination public key associated with a destination device to which the issued data will be transferred; the source device generating migration information that includes identification information that uniquely identifies the issued data or other migration information, the obtained destination public key, and a source private key associated with the source device, and a source signature for the identification information and the destination public key; and the source device providing the generated migration information to the destination device together with the issued data.

[0076] This disclosure is not limited to the embodiments described above. For example, two or more blocks shown in the block diagram may be combined, or one block may be divided. Instead of executing two or more steps shown in the flowchart in chronological order as described, each step may be executed in parallel or in a different order, depending on the processing capacity of the device on which it is performed, or as necessary. Other modifications are possible without departing from the spirit of this disclosure.

[0077] 3. Issuance data 4. Encrypted data 5. First migration information 5'. Migration information 6. Second migration information 7. Key 10. Issuing device 11, 21, 31, 41, 51. Control unit 20. First holding device 30. Intermediary device 40. Second holding device 50. Verification device 100. System 102. Signature

Claims

1. A source device that is the source of the issued data, which includes a control unit that acquires a destination public key associated with a destination device to which the issued data will be transferred, generates transfer information that includes identification information that uniquely identifies the issued data or other transfer information, the acquired destination public key, and a source private key associated with the source device, and provides the generated transfer information to the destination device together with the issued data.

2. The source device according to claim 1, wherein the control unit encrypts the issued data to generate encrypted data, transmits the encrypted data to the destination device, the migration information further includes an encryption flag indicating whether the destination device provided the issued data in an encrypted state, and the source signature is a signature to the identification information, the destination public key, and the encryption flag.

3. The source device according to claim 1, wherein the control unit obtains issuance information from the issuing device that issued the issuance data, including the issuance data, a source public key associated with the source device, and a source private key associated with the issuing device, which is generated using the issuance data and the source public key, and provides the issuance data to the destination device by transmitting the obtained issuance information to the destination device.

4. A system comprising a first holding device, an intermediary device, and a second holding device, wherein the first holding device and the intermediary device each function as a source device as described in claim 1, the intermediary device functions as a destination device when the first holding device functions as the source device, and acquires from the first holding device first transition information, which is generated by the first holding device and includes first identification information that uniquely identifies the issued data, as the transition information, and the second holding device functions as a destination device when the intermediary device functions as the source device, and acquires from the intermediary device second transition information, which is generated by the intermediary device and includes second identification information that uniquely identifies the first transition information, as the transition information, together with the first transition information.

5. The system according to claim 4, further comprising a verification device, the verification device acquires the second migration information from the second holding device together with the issuance data and the first migration information, requests the second holding device to provide a destination signature generated using the destination private key associated with the second holding device, verifies the destination signature using the destination public key included in the acquired second migration information, and, upon successful verification of the destination signature, identifies the first identification information using the first migration information identified by the second identification information included in the acquired second migration information, and verifies that the issuance data has been transferred from the source device to the destination device by referring to the identified first identification information.

6. A program that causes a computer to function as the source device described in any one of claims 1 to 3.

7. A verification device comprising a control unit, which obtains, from a destination device which is the destination of the issued data, migration information including an identification information that uniquely identifies the issued data or other migration information, a destination public key associated with the destination device, and a source signature for the identification information and the destination public key, generated using the source private key associated with the source device which is the source of the issued data; requests the destination device to generate a destination signature using the destination private key associated with the destination device; verifies the destination signature using the destination public key included in the obtained migration information; and, upon successful verification of the destination signature, verifies that the issued data has been migrated from the source device to the destination device by referring to either the identification information included in the obtained migration information or information that uniquely identifies the issued data, which is identified using other migration information identified by the identification information.

8. A data migration method comprising: a source device, which is the source of the issued data, obtaining a destination public key associated with a destination device to which the issued data will be transferred; the source device generating migration information that includes identification information that uniquely identifies the issued data or other migration information, the obtained destination public key, and a source private key associated with the source device, and a source signature for the identification information and the destination public key; and the source device providing the generated migration information to the destination device together with the issued data.

Images