JP2003345752A - Authentication management server and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To protect the privacy of a user by enabling the user himself/herself to control contents of user information released for account registration. <P>SOLUTION: An authentication management server 13 acquires from a user terminal 11 information inputted by the user as the user information to be released to a service server 17 in registering an account in a service. Then, the authentication management server 13 requests an authentication station server 15 to issue an electronic certificate based on the information inputted by the user, acquires the electronic certificate (persona ID) and registers the electronic certificate in a database. The authentication management server 13 uses the acquired electronic certificate (persona ID) and performs account registration for the service designated by the user. <P>COPYRIGHT: (C)2004,JPO

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an authentication management server for performing user authentication for a plurality of service providers.

[0002]

2. Description of the Related Art Conventionally, authentication using an electronic certificate issued by a certification authority is generally performed as a means for verifying the identity at the time of login. For example, in a system in which a user uses a service provided by a plurality of service providers, the user needs to present an electronic certificate to each service provider to be authenticated. in this case,
The user uses the same certificate for a plurality of service providers or uses a different certificate for each service.

[0003]

In the above-described system, personal information (user information) necessary for using a service is usually included in an electronic certificate, but the same certificate is provided to a plurality of service providers. When used, there is a possibility that information that the user does not want to disclose may be provided to a certain service provider, and the privacy of the user may not be protected. Further, when a different digital certificate is used for each service, the user has to obtain a digital certificate for each service to be used, which is complicated.

[0004] The present invention has been made in view of the above situation, and has as its object to provide an authentication management server and the like which can protect the privacy of a user. It is another object of the present invention to provide an authentication management server or the like that can improve the convenience of the user.

[0005]

In order to achieve the above object, an authentication management server according to a first aspect of the present invention can be connected to a plurality of service providing servers and responds to requests from user terminals. An authentication management server acting as a proxy for logging in to a service providing server, comprising: means for acquiring information of a service specified by a user from a user terminal; and information disclosed to the service providing server when registering an account for the service specified by the user. Means for obtaining from a user terminal information input by a user as user information to be issued, means for requesting and issuing to a certification authority an issuance of an electronic certificate based on the user information, means for registering in a database, Means for registering an account for a service specified by the user using a certificate. To.

According to the present invention, the contents of user information (name, address, age, etc.) to be disclosed to each service provider for account registration can be specified by the user for each service. Disclosure can be controlled by the user himself and the privacy of the user can be protected. In addition, account registration for each service, acquisition and acquisition of digital certificates to be presented for each service
When the management is performed by the authentication management server, the load on the user can be reduced, and the convenience of the system can be improved.

[0007] Information on the electronic certificate to be used specified by the user may be received from the user terminal, and information on the service to be used specified by the user may be received from the user terminal. The designated electronic certificate for use may be read from the database, and the electronic certificate may be used to log in to the specified service to be used.

Means for inquiring a service providing server of user information necessary for account registration for a service designated by the user, and acquiring an electronic certificate used for account registration for the service for the user based on a result of the inquiry. Acquisition means and means for registering an account for the service using the acquired electronic certificate may be provided. This makes it possible to realize a system that is highly convenient for the user.

[0009] The acquisition means may determine whether or not an electronic certificate matching user information required for account registration indicated by the inquiry result is registered for the user with reference to the database. If it is determined that a conforming digital certificate is registered, the digital certificate may be used for the account registration.If it is determined that the conforming digital certificate is not registered, the Necessary user information may be acquired via a user terminal, an issuance of an electronic certificate based on the acquired user information may be requested to a certification organization, and the issued electronic certificate may be used for the account registration.

[0010] A program according to a second aspect of the present invention provides a computer as an authentication management server which is connectable to a plurality of service providing servers and which performs login to the service providing server in response to a request from a user terminal. A program for causing a user to receive information of a service specified by a user from a user terminal, wherein the user inputs information as a user information to be disclosed to a service providing server when registering an account for the service specified by the user. Receiving means for receiving information from the user terminal, requesting a certification authority to issue an electronic certificate based on the user information, obtaining the information, registering it in a database, and designating the user using the obtained electronic certificate Means to register an account for the service provided,
Function as

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a user authentication system according to an embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram showing a configuration of a user authentication system according to an embodiment of the present invention. As shown
The user authentication system includes a user terminal 11 connected to each other via a network 10 and an authentication management server 1
3, a certificate authority server 15, and a service server 17.

The network 10 comprises a mobile communication network, a telephone line, the Internet and the like.
It is for enabling information transmission and reception between the server and each server.

The user terminal 11 includes a portable terminal, a portable telephone, a personal computer, and the like, and communicates with the authentication management server 13 and the like via the network 10. The user terminal 11 executes an operation program and the like stored in a storage unit (not shown) to perform processing for receiving various services provided by the service servers 17 via the authentication management server 13. In addition, the user terminal 11 has functions related to the Internet, such as browsing a web page, sending and receiving electronic mail, and the like.

The user terminal 11 is provided with a SIM (Subscr
An information storage medium such as an IC card called an "iber Identity Module card" is connectable. Information such as a user's electronic certificate (primary ID), a secret key, and a public key can be stored in an IC card or the like. Here, the primary ID is an electronic certificate used when a user logs in to the authentication management server 13, and the user terminal 1
1 requests the certificate authority server 15 according to the operation of the user and receives the certificate. The primary ID includes personal information of the user (user information) and the like as certificate contents.
As shown in (1), main information such as a user's name, address, age, etc., attached information such as a pseudonym, a field of interest, etc., and a user's public key and the like are information to be signed. The user performs user registration with the authentication management server 13 using the primary ID.

The authentication management server 13 includes, for example, a computer including a control unit 131, a storage unit 132, and a communication control unit 133, as shown in FIG.

The control unit 131 executes an operation program and the like stored in the storage unit 132 to execute a request processing unit 131a, a user authentication unit 131b, and a certificate management unit 131.
c, a service IF (interface) unit 131d, a session management unit 131e, an encryption processing unit 131f, and the like are logically realized.

The request processing section 131a performs processing such as generating a processing screen to be supplied to the user terminal 11, receiving a request from the user terminal 11, and the like. The user authentication unit 131b performs processes such as user registration and authentication of a login user. In the user registration process, the user terminal 11 sends the user's primary ID
Is acquired and registered in the storage unit 132. In the authentication process of the login user, the validity of the login user is confirmed by checking the primary ID presented from the user terminal 11.

The certificate management unit 131c performs processing related to issuance and management of an electronic certificate (persona ID) used when a user logs in to the service server 17.
Specifically, upon issuance of the persona ID, the content of the certificate to be issued is designated by the user, the issuance of the certificate of the content is requested to the certificate authority server 15, and the issued persona I is issued.
D is stored in the storage unit 132 for each user. Persona ID
As shown in FIG. 4, for example, user information and the like are included in the contents of a certificate as in the case of the primary ID, and the main information, attached information, the user's public key, and the like are used as information to be signed. The main information of the persona ID is composed of part or all of the main information of the primary ID. Persona ID
May be set widely so as to include the information content of the primary ID. For example, the information "age: 25" in the primary ID may be set to "age: 18 or more" in the persona ID. . Further, the user can freely specify the content of the additional information, and may be different from the content of the additional information in the primary ID, for example.

The service IF unit 131d performs processing for the user to use the service provided by each service server 17, and the like. Specifically, after the user authentication unit 131b completes the authentication of the logged-in user, the user is allowed to select a persona ID to be used from the persona IDs registered for the user. Then, a list of services available with the selected persona ID is presented to the user, and a service to be used is selected. Then, the user logs in to the service server 17 that provides the selected service using the selected persona ID. When the persona ID is authenticated by the service server 17, the user can use the service by mediating transmission / reception data between the service server 17 and the user terminal 11.

When receiving a request for registration of a new service from the user, the service IF unit 131d inquires of the service server 17 of the service provider for user information necessary for user registration. If user registration is possible with an existing persona ID, user registration is performed. If the user cannot be registered with the existing persona ID, the user is required to input necessary information, and the user is registered upon receiving a new persona ID.

The session management unit 131e performs processing such as session management when the user uses the service.
The communication with the user terminal 11 and the communication with the service server 17 convert a session key to be used. The encryption processing unit 131f performs an electronic signature confirmation process, data encryption / decryption process, and the like.

The storage section 132 stores an operation program executed by the control section 131 and various data necessary for processing. The storage unit 132 includes a user DB 132a that stores predetermined information on each user. User DB
132a, for example, personal information (name, address, age, etc.), primary ID, persona ID, each persona ID
, Information on available services is stored for each user.

The communication control unit 133 performs data communication with the user terminal 11, the certificate authority server 15, the service server 17, and the like via the network 10.

The certificate authority server 15 generates and issues an electronic certificate by, for example, applying an electronic signature to the received information to be signed in response to a request to issue an electronic certificate.

The service server 17 includes, for example, a computer including a control unit 171, a storage unit 172, and a communication control unit 173, as shown in FIG.

The control section 171 executes an operation program and the like stored in the storage section 172 to execute the access management section 171a, the request processing section 171b, and the service providing section 1
71c, the encryption processing unit 171d, and the like are logically realized. In response to the login request from the authentication management server 13, the access management unit 171a performs a process of checking the presented user ID (electronic certificate) to confirm the user of the service request source. The request processing unit 171b receives a request from the authentication management server 13 and transfers it to the service providing unit 171c, and receives a processing result from the service providing unit 171c and supplies the processing result to the authentication management server 13. The service providing unit 171c performs a process for providing a service. The encryption processing unit 171d performs a digital signature confirmation process, a data encryption / decryption process, and the like.

The storage section 172 stores an operation program executed by the control section 171 and various data necessary for processing. The storage unit 172 stores the persona ID of the registered user.
Are stored as registration information. The communication control unit 173 is for performing data communication with the authentication management server 13 and the like via the network 10.

Hereinafter, the operation of the user authentication system according to this embodiment will be described focusing on the characteristic portions of the present invention.

First, a process when a user performs user registration in the authentication management server 13 will be described with reference to FIG. First, the user operates the user terminal 11 to request the certificate authority server 15 to issue an electronic certificate to obtain an electronic certificate (primary ID) used for user registration in the authentication management server 13. (L11). The certificate authority server 15 generates a digital certificate of the user in response to the certificate issuance request from the user terminal 11 (L12), and supplies it to the requesting user terminal 11 (L13). The user terminal 11 stores the issued electronic certificate in an IC card or the like (L14).

Next, the user terminal 11 transmits a user registration request to the authentication management server 13 in response to a user operation (L15). In response, the authentication management server 1
3 performs a predetermined user registration process (L16). In this user registration process, for example, a primary ID is requested from the user terminal 11, a primary ID stored in an IC card or the like is acquired, and an electronic signature is confirmed for the acquired primary ID. When the validity of the certificate is confirmed, the primary ID and the personal information (main information and attached information) of the user included in the primary ID are stored in the user DB 132a, and the registration result is returned to the user terminal 11. (L17), and terminates the user registration process.

Next, a process of issuing an electronic certificate (persona ID) to be presented to the service server 17 when using the service will be described with reference to FIG. For example, the user terminal 11 responds to an operation of the user by
A request for issuing an electronic certificate (persona ID) is transmitted to the client (L21). In response, the authentication management server 13
Supplies a registration screen for inputting the content information of the certificate to the user terminal 11 (L22). The user terminal 11 displays the registration screen from the authentication management server 13, receives the content information of the certificate by the user, and transmits the input information to the authentication management server 13 (L23).

The authentication management server 13 checks the content of the input data from the user terminal 11, creates a new key pair (private key and public key), and includes the input content and one of the created keys (public key). A certificate request is generated (L24) and transmitted to the certificate authority server 15 (L2
5). After checking the contents of the request received from the authentication management server 13, the certificate authority server 15 creates a digital certificate (persona ID) by, for example, applying a signature to the data to be signed (L26). Send (L2
7). The authentication management server 13 registers the received persona ID in the user DB 132a (L28), and supplies a notification screen indicating that the issuance of the persona ID has been completed to the user terminal 11 (L29).

Next, a process when the authentication management server 13 registers an account for a service that the user wants to use will be described with reference to FIGS. For example, when the user presses a login button on a predetermined operation screen displayed on the user terminal 11, the user terminal 11
Requests N (Personal Identification Number) input and accepts PIN input. And the input PI
After verifying the user by collating N, the IC
The primary ID is read from the card (L31), and a login request is transmitted to the authentication management server 13 (L32).
The authentication management server 13 confirms the user using the primary ID in response to the login request, and
Generate a session key to be used for communication with L1 (L33),
Supply to the user terminal 11 together with the login result (L3
4). The user terminal 11 holds the received session key and displays the login result (L35).

Next, the user inputs a request to register a new service, and in response, the user terminal 11 transmits a service registration request to the authentication management server 13 (L
36). In response to the service registration request, the authentication management server 13 queries the service server 17 corresponding to the requested service for information necessary for account registration (L37). In response to the inquiry from the authentication management server 13, the service server 17 transmits information on items of user information necessary for account registration (registration required items) to the authentication management server 13 (L38). In response,
The authentication management server 13 refers to the persona IDs registered in the storage unit 132 for the requesting user, and stores the data items of the user information included in each of them and the registration necessary items acquired from the service server 17. Compared to,
It is determined whether there is a matching persona ID (L39).

In this determination, a suitable persona ID
If there is, the authentication management server 13 extracts the corresponding persona ID, supplies the extraction result to the user terminal 11 (L40), and causes the user to select the persona ID to be used (L41). Then, an account registration request including the selected persona ID is transmitted to the service server 17 (L42). In response, the service server 17 performs an account registration process (L43). Note that, when the information of the matching persona ID is supplied to the user terminal 11 and there is an input indicating that they are not used, the authentication management server 13 requests the user terminal 11, for example, Information is input to the user, a persona ID is issued based on the input data, and an account is registered using the persona ID.

If there is no matching persona ID,
The authentication management server 13 obtains information necessary for account registration from the user terminal 11 by, for example, supplying an input screen for insufficient information to the user terminal 11 (L44).
5). Then, a new persona I based on the acquired information
Request issuance of D to the certificate authority server 15 (L46), and issuance of a persona ID is received (L47). Then, the authentication management server 13 transmits an account registration request including the newly issued persona ID to the service server 17 (L
48). In response, the service server 17 performs an account registration process (L49).

Here, the details of the operation of the authentication management server 13 in the process of registering an account on the service side will be described with reference to the flowchart of FIG. First, in response to a service registration request, the control unit 131 of the authentication management server 13 accesses the service server 17 corresponding to the requested service and inquires and acquires information necessary for account registration (step S11). Next, the control unit 131 refers to the persona IDs registered in the storage unit 132 for the requesting user, and stores the data items of the user information included in each of the user IDs and the service server 17.
With the registration required items obtained from (step S
12) If the data item of the existing persona ID satisfies the registration required item (step S13), the corresponding persona ID is extracted and supplied to the user terminal 11 as information on the candidate persona ID of the use target and displayed. (Step S14).

Then, when information indicating that one of the candidate persona IDs has been selected is received from the user terminal 11 (step S15), the control unit 131 sends the information to the service server 17 using the selected persona ID. An account registration request is transmitted to receive an account registration (step S16).

If information indicating that the candidate persona ID has not been selected is received from the user terminal 11 (step S15), the control unit 131 supplies an input screen for information necessary for account registration. For example, predetermined user information is acquired from the user terminal 11, the issuance of an electronic certificate based on the acquired information is requested to the certificate authority server 15, and a new electronic certificate (persona ID) is issued (step S <b> 1). S17). Then, an account registration request is transmitted to the service server 17 using the issued electronic certificate (persona ID), and the account registration is received (step S).
16).

In step S13, if there are more items to be registered than the data items of the existing persona ID, the information necessary for account registration is obtained from the user terminal 11, and the electronic information based on the obtained information is obtained. It requests the certificate authority server 15 to issue a certificate and receives a new electronic certificate (personal ID) (step S17).
Then, an account registration request is transmitted to the service server 17 using the issued electronic certificate (persona ID), and the account registration is received (step S16).

Next, processing when a user uses a service will be described. First, a process until the user receives the user authentication of the service providing side will be described with reference to FIGS.
This will be described with reference to FIG. First, as in the case of the account registration process described above, the user logs in to the authentication management server 13 using the user terminal 11 (L51 to L55).
Next, the user lists the persona ID (personalist)
Is input to the user terminal 11, and in response to this, the user terminal 11 requests the user's personalist from the authentication management server 13 (L56). In response to the request from the persona list, the authentication management server 13 stores the persona ID registered for the user in the user DB 132
a), a personalist is generated, supplied to the user terminal 11, and displayed (L57, L58). The user terminal 11 receives a selection input of a persona ID to be used from the displayed persona list, and notifies the authentication management server 13 of the selected persona ID (L59).

Next, the authentication management server 13 stores the user DB
With reference to 132a, a service registered as a user with the persona ID selected by the user is extracted, and a list of extracted services is supplied to the user terminal 11 and displayed (L60, L61). The user terminal 11 allows the user to select and input a service to be used from the displayed service list, and notifies the authentication management server 13 of the selected service (L62). The authentication management server 13 specifies the service server 17 corresponding to the selected service, and transmits a login request including the selected persona ID to the user (L63). In response to the login request from the authentication management server 13, the service server 17 checks the user by checking the received persona ID, and generates a session key used for communication with the authentication management server 13 (L
64), and supplies it to the authentication management server 13 together with the login result (L65). The authentication management server 13 holds the session key received from the service server 17, and notifies the user terminal 11 of the login result (L66).

Next, FIG. 13 shows an example in which a service provided by a bank's loan consultation counter is used for processing in a situation where a service is actually received after completion of user authentication on the service providing side.
This will be described with reference to FIG. For example, the user is the user terminal 11
, The user terminal 11 encrypts the input data with the session key between the user terminal 11 and the authentication management server 13 and transmits the data to the authentication management server 13 (L
71). The authentication management server 13 decrypts the data received from the user terminal 11 with the session key between the user terminal 11 and the authentication management server 13 (L72), and then encrypts the data using the session key between the authentication management server 13 and the service server 17. And sends it to the service server 17 (L73).

The service server 17 is an authentication management server 1
3 is decrypted with the session key between the authentication management server 13 and the service server 17, and information (finance consultation content) necessary for the processing is extracted (L74). Then, based on the extracted information, the person in charge on the service providing side inputs a response to the loan consultation to the service server 17 (L75). The service server 17 encrypts the data with the input session key between the data authentication management server 13 and the service server 17, and transmits the encrypted data to the authentication management server 13 (L76).

The authentication management server 13 is a service server 1
7 is decrypted with the session key between the authentication management server 13 and the service server 17 (L7
7), encrypt the data with the session key between the user terminal 11 and the authentication management server 13, and transmit the encrypted data to the user terminal 11 (L78). The user terminal 11 transmits the data received from the authentication management server 13 to the user terminal 11 and the authentication management server 1.
3 (L79), and displays information indicating a response to the loan consultation.

As described above, according to the present invention, the contents of user information to be disclosed to various services for account registration can be specified by the user himself / herself, so that the disclosure of his / her own information can be performed by the user. You can control yourself and protect your privacy. The authentication management server 1 performs registration for each service and acquisition and management of an electronic certificate to be presented for each service.
By performing 3, the load on the user can be reduced, and the convenience of the system can be improved. Even if the user does not disclose the real information to the service side, since the identity is confirmed in the authentication management server 13,
Each service can provide the service with peace of mind.

The primary ID in the above description,
The configuration content of the persona ID is an example, and is not limited to this. In the above description, the primary ID of the user,
Although a secret key, a public key, and the like are stored in an information storage medium such as an IC card, the present invention is not limited to this. For example,
You may make it memorize | store in the memory | storage part of the user terminal 11. FIG.

The configuration of each device and DB can be arbitrarily changed. Further, each server may be constituted by a plurality of computer systems operating in cooperation with each other, and the functions of each server may be integrated and realized by one computer system.

It should be noted that the system of the present invention can be realized using an ordinary computer system without using a dedicated system. For example, a computer readable recording medium (F
D, CD-ROM, DVD, etc.), and the server may be configured to execute the above processing by installing the program on a computer. Alternatively, the program may be stored in a disk device of a server device on a network such as the Internet, and may be superimposed on a carrier wave and downloaded to a computer. In addition, the above functions are shared by the OS or the OS
In the case of realizing by joint application with
Only the parts other than the OS may be stored in the medium and distributed,
Further, it may be superimposed on a carrier wave and downloaded to a computer.

[0051]

According to the present invention, the content of the user information disclosed for account registration can be controlled by the user himself / herself, so that the privacy of the user can be protected.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a user authentication system according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating an example of a configuration of a primary ID.

FIG. 3 is a diagram showing a configuration of an authentication management server used in the user authentication system of FIG. 1;

FIG. 4 is a diagram showing an example of a configuration of a persona ID.

FIG. 5 is a diagram showing a configuration of a service server used in the user authentication system of FIG. 1;

FIG. 6 is a diagram for explaining processing when a user performs user registration in the authentication management server;

FIG. 7 is a diagram illustrating a process of issuing an electronic certificate (persona ID) to be presented to a service server.

FIG. 8 is a diagram illustrating a process when registering an account with a service server.

FIG. 9 is a diagram for explaining processing when registering an account with a service server.

FIG. 10 is a flowchart illustrating an operation of the authentication management server in the account registration process.

FIG. 11 is a diagram for explaining processing until the user receives user authentication on the service providing side.

FIG. 12 is a diagram for explaining processing until a user receives user authentication on a service providing side;

FIG. 13 is a diagram for explaining processing of a scene where a service is actually received after user authentication on the service providing side is completed.

[Explanation of symbols]

10 Network 11 User terminal 13 Authentication management server 15 Certificate Authority Server 17 Service server 131, 171 control unit 132, 172 storage unit 133, 173 Communication control unit 131a Request processing unit 131b User authentication unit 131c Certificate Management Department 131d Service IF section 131e Session management unit 131f Cryptographic processing unit 132a User DB 171a Access Management Department 171b Request processing unit 171c Service Provider 171d Cryptographic processing unit

   ────────────────────────────────────────────────── ─── Continuation of front page    (72) Inventor Tetsuya Kusuda             3-3-3 Toyosu, Koto-ku, Tokyo Stock Association             Inside NTT DATA (72) Inventor Koji Miyata             3-3-3 Toyosu, Koto-ku, Tokyo Stock Association             Inside NTT DATA (72) Inventor Shigetoshi Yokoyama             3-3-3 Toyosu, Koto-ku, Tokyo Stock Association             Inside NTT DATA F term (reference) 5B085 AA08 AE02 AE09 AE23 BA07                       BG02 BG07                 5J104 MA01

Claims (5)

[Claims] An authentication management server connectable to a plurality of service providing servers and acting as a log-in to the service providing server in response to a request from a user terminal, wherein information on a service designated by a user is stored. A means for acquiring from a user terminal information obtained by a user as user information to be disclosed to a service providing server when registering an account for a service designated by the user; and an electronic device based on the user information. Means for requesting a certificate authority to issue a certificate and acquiring the certificate, and registering the certificate in a database; and means for registering an account for a service specified by the user using the acquired electronic certificate. Characteristic authentication management server. 2. A method for receiving, from a user terminal, information of an electronic certificate to be used specified by a user, receiving information of a service to be used specified by a user from the user terminal, 2. The authentication management server according to claim 1, wherein the electronic certificate is read from the database, and the electronic certificate is used to log in to the specified service to be used. 3. 3. A means for querying a service providing server for user information necessary for account registration for a service designated by a user, and an electronic certificate used for account registration for the service for the user based on the inquiry result. The authentication management server according to claim 2, further comprising: an obtaining unit configured to obtain the electronic certificate, and a unit configured to perform an account registration for the service using the obtained electronic certificate. 4. The acquisition means determines whether or not an electronic certificate matching user information required for account registration indicated by the inquiry result has been registered for the user with reference to the database. If it is determined that the electronic certificate to be registered is registered, the digital certificate is used for the account registration. If it is determined that the applicable digital certificate is not registered, a user required for the account registration is determined. Acquiring information via a user terminal, requesting a certification authority to issue an electronic certificate based on the acquired user information, and using the issued electronic certificate for the account registration. Item 4. The authentication management server according to item 3. 5. A program for causing a computer to function as an authentication management server connectable to a plurality of service providing servers and acting as a proxy for logging in to a service providing server in response to a request from a user terminal. Means for receiving, from a user terminal, information of a service specified by the user, receiving means for receiving, from the user terminal, information input by the user as user information to be disclosed to a service providing server when registering an account for the service specified by the user Means for requesting a certification authority to issue an electronic certificate based on the user information and acquiring the request, and registering the request in a database; means for registering an account for a service designated by the user using the acquired electronic certificate A program to function as a,.