JP2012203516A - Property delegation system, property delegation method, and property delegation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a property delegation system, a property delegation method, and a property delegation program that can efficiently and safely delegate properties not via a property authentication station etc., while using an existent open key authentication base.SOLUTION: A user system 1 determines a delegation property based upon property information on a user 200 (property delegator), and generates a property delegation certificate including the property information on the property delegator and the determined delegation property as property information on the user 200 to whom the property is delegated (property delegated person). The generated property deletion certificate is recorded in the user system 1. A service providing system 4 receives the delegated property that the property delegation certificate indicates as a property of the user 200 when the user 200 makes a request to provide a service based upon the property delegation certificate.

Description

  The present invention relates to an attribute delegation system, an attribute delegation method, and a method that can be applied to a service providing system for providing a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute authority. , Related to the attribute delegation program.

  2. Description of the Related Art Conventionally, in order to prevent tampering and spoofing, public key authentication platforms that perform identity authentication based on a personal certificate (public key certificate) issued by a certificate authority have been widely used. In order to improve security, a service providing system that provides various services via the Internet generally performs user identity authentication using the personal certificate as described above.

  Such a personal certificate has an extended area, and is known to describe attribute information such as the authority of the user related to the service as described above. However, it is common that user attributes are often changed, and it is necessary to update the personal certificate for the attribute change, leading to an increase in cost. In addition, there is a method in which attribute information is stored in a database inside the system and linked to the result of personal authentication, but there are problems such as information leakage because the security level depends on the system.

  Therefore, a method has been proposed in which user attributes are described and managed in attribute certificates issued from attribute certificate authorities. The attribute certificate authority trusts the certificate authority common to the user, and the attribute certificate authority issues an attribute certificate in which the attribute information of the user is described. Thereby, the service providing system can confirm whether the content of the service request from the user corresponds to the attribute based on the attribute certificate of the user.

  Japanese Patent Application Laid-Open No. H10-228707 discloses authority management using such attribute certificates. Patent Document 1 discloses an authority delegation system for requesting an issuance authority to issue an attribute certificate based on the authority possessed by the authority delegator among authorized users and delegating authority to the authorized delegator. ing.

JP 2009-205342 A

  By the way, the attribute certificate is generally issued after being approved by the administrator of the attribute certificate authority that has received the attribute certificate issuance request, which takes time and labor. Also in Patent Document 1, an authority delegator requests an issuance authority such as an attribute certification authority to issue an attribute certificate, and issues an attribute certificate to the authorized delegator. There is a problem that it is not possible to cope with the case where there is an attribute delegation over several generations such as delegating the delegated attribute to another user.

  Therefore, the present invention provides an attribute delegation system, an attribute delegation method, and an attribute delegation that can efficiently and safely delegate attributes without using an attribute authority while using an existing public key authentication infrastructure. The purpose is to provide a program.

  The attribute delegation system of the present invention is an attribute delegation system applied to a service providing system that provides a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority. In response to an input from a storage unit that stores attribute information indicating the attribute of the user, an authentication information acquisition unit that acquires the attribute information from the storage unit, and an attribute delegator that delegates the attribute, Attribute delegation certificate including delegation attribute determining means for determining a delegation attribute to an attribute delegate to whom an attribute is delegated based on the attribute information of the delegator, attribute information of the attribute delegator, and the delegation attribute Attribute delegation certificate generation means for generating the attribute delegation certificate recording means for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegee, and the service providing system Request verification means for accepting the attribute of the attribute delegation certificate as an attribute of the user when there is a service provision request from the user based on the attribute delegation certificate. It is characterized by.

  Further, the attribute delegation method of the present invention is an attribute delegation method applied to a service providing system for providing a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority. The authentication information acquisition step for acquiring attribute information indicating the attribute of the user from the storage means owned by the user, and in response to an input from the attribute delegator who delegates the attribute, Based on the attribute information, a delegation attribute determining step for determining a delegation attribute to the attribute delegate to whom the attribute is delegated, an attribute delegation certificate including the attribute delegator attribute information and the delegation attribute is generated. An attribute delegation certificate generation step, an attribute delegation certificate recording step for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegator, and the service providing system And a request verification step of accepting the attribute of the attribute delegation certificate as the attribute of the user when there is a service provision request based on the attribute delegation certificate from the user. To do.

  The attribute delegation program of the present invention is an attribute delegation program applied to a service providing system that provides a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority. A storage unit storing attribute information indicating an attribute of the user, an authentication information acquisition unit acquiring the attribute information from the storage unit, and an attribute delegator delegating the attribute. In response to the input, based on the attribute information of the attribute delegator, delegation attribute determination means for determining a delegation attribute to the attribute delegate to which the attribute is delegated, the attribute delegator attribute information, and the delegation attribute; Attribute delegation certificate generating means for generating an attribute delegation certificate including the attribute delegation certificate, and attribute delegation certificate for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegate A function as a recording unit, and when there is a request for providing a service based on the attribute delegation certificate from the user to the computer as the service providing system, the attribute of the attribute delegation certificate is changed to the attribute of the user. It is characterized by functioning as a request verification means for accepting as

  According to the above configuration, the attribute is transferred from the attribute transferee to the attribute transferee by generating the attribute transfer certificate including the attribute information of the attribute transferee and the transfer attribute. When there is a service provision request based on the attribute delegation certificate, the service providing system accepts the delegated attribute as the attribute of the user. Thereby, both the delegation attributes of the attribute delegator delegated by the attribute delegator can be confirmed by the attribute information of the attribute delegator included in the attribute delegation certificate. That is, since the service system can accept the delegation attribute as the attribute of the user who made the request, the attribute delegator can safely delegate the attribute to the attribute delegate. Further, since the generated attribute delegation certificate can be recursively used as attribute information included in the newly generated attribute delegation certificate, it is possible to delegate attributes for several generations.

  The attribute delegation system of the present invention is applied to a service providing system that provides a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority. Yes, storage means for storing the user's personal certificate and attribute information indicating the user's attributes, and authentication information acquisition for acquiring the personal certificate and / or the attribute information from the storage means A delegation attribute determining means for determining a delegation attribute to an attribute delegator to whom an attribute is delegated based on the attribute information of the attribute delegator in response to an input from an attribute delegator who delegates the attribute; Identification information of the attribute transferee based on the personal certificate of the attribute transferee, attribute information of the attribute transferee, the transfer attribute, and a signature based on the attribute certificate of the attribute transferee to these Genus containing An attribute delegation certificate generation unit that generates a delegation certificate, an attribute delegation certificate recording unit that records the attribute delegation certificate as attribute information in the storage unit of the attribute delegator, and the service providing system And when the user has requested to provide a service based on the attribute delegation certificate, confirm the signature of the attribute delegation certificate, and confirm the match between the user and the identification information, Request verification means for receiving the attribute of the attribute delegation certificate as the attribute of the user.

  According to the above configuration, the attribute delegation including the identification information of the attribute delegator based on the personal certificate of the attribute delegator, the attribute information of the attribute delegator, the delegation attribute, and the signature of the attribute delegator to these By generating the certificate, the attribute is transferred from the attribute transferee to the attribute transferee. When there is a request for service provision based on the attribute delegation certificate, the service provision system confirms the signature of the attribute delegation certificate, confirms the user who made the request, and assigns the delegated attribute to the Accept as user attributes.

  Accordingly, the service providing system can confirm that the attribute delegation content has not been tampered with by confirming the signature when there is a request from the attribute delegate. Also, by confirming the identity of the user's personal certificate and the identification information, it is possible to confirm that the user of the request is an attributed delegate to whom the attribute has been delegated by the attribute delegate. Thereby, the attribute indicated by the attribute delegation certificate can be accepted as the user attribute. In addition, since the attribute delegation certificate includes attribute information of the attribute delegator, it can be easily confirmed that the requested service is within the range of the delegation attribute delegated by the attribute delegator. Furthermore, the delegated attribute can be easily delegated to other users as attribute information. As a result, it is possible to efficiently and safely delegate attributes without using an attribute authority or the like while using an existing public key authentication infrastructure.

  Further, the delegation attribute determination means of the present invention determines an expiration date of the delegation attribute according to an input from an attribute delegator who delegates the attribute, and the attribute delegation certificate generation means includes the determined expiration date Alternatively, the attribute delegation certificate may be generated.

  According to the above configuration, the expiration date of the attribute delegation certificate can be set, and the expiration date can be easily confirmed by the attribute information included in the attribute delegation certificate.

  Moreover, the request verification means of this invention may confirm the user who owns the attribute information based on the attribute information contained in the attribute delegation certificate and the signature.

  According to the above configuration, the attribute delegator who delegated the attribute to the user can be authenticated, and the attribute delegation can be performed more safely.

  It is possible to efficiently and securely delegate attributes while using an existing public key authentication infrastructure.

It is explanatory drawing which shows the outline | summary of an attribute delegation system. It is a functional block diagram of an attribute delegation system. It is explanatory drawing which shows an example of the authentication information memorize | stored in a memory | storage part. It is explanatory drawing which shows an example of the authentication information memorize | stored in a memory | storage part. It is explanatory drawing which shows an example of the authentication information memorize | stored in a memory | storage part. It is explanatory drawing which shows an example of the delegation attribute determination screen. It is explanatory drawing which shows an example of the delegation attribute determination screen. It is a figure which shows the flowchart of the attribute transfer process routine which a user apparatus performs. It is a figure which shows the flowchart of the request verification process which a service provision system performs. It is a figure which shows the flowchart of the service provision process which a service provision system performs. It is explanatory drawing which shows an example of a service corresponding table.

  Hereinafter, embodiments of the present invention will be specifically described with reference to the drawings.

(System configuration)
As shown in FIGS. 1 and 2, the attribute delegation system 100 according to the present embodiment is configured so that the certificate authority 2 can authenticate a user 200 who issues a personal certificate (public key certificate) and authenticates the user 200. This is applied to the service providing system 4 that provides a service based on the attribute of the user authenticated by the user, and other attributes are delegated from the user 200 (attribute delegator) who delegates the attribute. The attribute can be transferred to the user 200 (attribute transferee).

(Prerequisite)
Here, it is assumed that all users 200 who use the service providing system 4 have issued personal certificates from the common certificate authority 2. The certificate authority 2 is assumed to be trusted by the attribute certificate authority 3 (a public key certificate is issued from the certificate authority 2). The certificate authority 2 and the attribute certificate authority 3 are assumed to be trusted by the service providing system 4.

  The user 200 can use the service providing system 4 within the range of this attribute by issuing an attribute certificate in which an attribute such as authority related to the service providing system 4 is issued from the attribute certification authority 3. It can be done. That is, when the user 200 makes a service provision request to the service providing system 4, a personal certificate and an attribute certificate issued to the user 200 are required.

  The attribute is not limited to the authority to use the service provided by the service providing system 4, and for example, virtual information held in a game such as point information of a point card system, MMORPG (Massively Multiplayer Online Role-Playing Game), etc. It may be information such as typical item / currency. The service providing system 4 to which the attribute delegation system 100 is applied is not limited, and examples thereof include various systems such as an in-house system of an organization to which a user belongs, a point card system, and a game system.

(Attribute delegation system 100)
As shown in FIG. 2, the attribute delegation system 100 includes a storage unit 101, an authentication information acquisition unit 102, a delegation attribute determination unit 103, an attribute delegation certificate generation unit 104, an attribute delegation certificate recording unit 105, And a request verification unit 106.

(User device 1)
In the present embodiment, a user 200 who uses a service has a user device 1, and the user device 1 includes a storage unit 101, an authentication information acquisition unit 102, a delegation attribute determination unit 103, an attribute delegation certificate. A generation unit 104 and an attribute delegation certificate recording unit 105 are included. The user device 1 can be connected to the service providing system 4 and the user device 1 of another user via a communication line capable of data communication with each other.

  The user device 1 includes a request request unit 110, a display unit 111, and an input unit 112.

  In addition, in this embodiment, although the user apparatus 1 is mobile terminals, such as a tablet terminal, it is not limited to this. For example, the user 200 possesses an electronic recording medium such as an IC card or a USB memory as the storage unit 101, and at the time of attribute delegation, the authentication information acquisition unit 102, delegation attribute determination unit 103, attribute delegation certificate A PC terminal having the functions of the generation unit 104 and the attribute delegation certificate recording unit 105 reads the electronic recording medium of the user 200 and records the attribute delegation certificate on the IC card of another user 200. May be.

Specifically, functions of each unit of the user device 1 will be described.
The storage unit 101 has a function of storing a personal certificate of the user 200 who owns the user device 1 and attribute information indicating the attribute of the user 200. The storage unit 101 stores a secret key corresponding to the personal certificate.

  The attribute information indicates an attribute certificate issued by the attribute certificate authority 3 and / or an attribute delegation certificate generated by the attribute delegation system 100 (attribute delegation certificate generation unit 104). As shown in FIG. 1, when the user 200 (users 200B and 200C) has this attribute delegation certificate, the service providing system 4 to which the attribute delegation system 100 is applied can be used. It is not necessary to issue an attribute certificate from the certificate authority 3. The attribute delegation certificate will be described in detail later.

  When the user 200 is an attribute transferee, the attribute transfer certificate is recorded in the storage unit 101 by the user device 1 of another user 200. That is, the storage unit 101 may have a function of receiving and storing attribute delegation certificate data from the user device 1. The attribute information stored in the storage unit 101 may store a plurality of attribute certificates and / or attribute delegation certificates. However, the attribute delegator storage unit 101 needs to store at least one attribute certificate or attribute delegation certificate.

  Further, in the storage unit 101, the storage area of the secret key may have tamper resistance in hardware or software. With this configuration, for example, the private key storage area may be physically separated from the personal certificate and attribute information storage area. Thereby, even when a computer, an electronic storage medium or the like storing a secret key is stolen or lost, it is possible to prevent the secret key from leaking to a third party.

  The authentication information acquisition unit 102 has a function of acquiring authentication information of a personal certificate and / or attribute information from the storage unit 101. The authentication information acquisition unit 102 is made accessible to the storage unit 101 in the same user apparatus 1 via an internal bus or the like, and wirelessly communicates with the storage unit 101 of another user apparatus 1. It is made accessible by

  The delegation attribute determination unit 103 has a function of determining a delegation attribute to an attribute delegator to which an attribute is delegated based on attribute information of the attribute delegator in response to an input from the attribute delegator who delegates the attribute. is doing. Specifically, the delegation attribute determination unit 103 displays the content of the attribute indicated by the attribute information acquired by the authentication information acquisition unit 102 on the display unit 111 in a selectable manner. Further, the delegation attribute determination unit 103 determines an attribute that the user 200 desires to delegate to another user 200 based on an operation on the input unit 112 by the user 200. Note that the delegation attribute determination unit 103 may have a function of determining the expiration date of the delegation attribute in accordance with an input from the attribute delegator who delegates the attribute.

  The attribute delegation certificate generation unit 104 includes the identification information of the attribute delegator based on the personal certificate of the attribute delegator, the attribute information of the attribute delegator, the delegation attribute determined by the delegation attribute determination unit 103, It has a function of generating an attribute delegation certificate including a signature based on the attribute delegator's personal certificate. Here, the identification information is an identifier for identifying an attributed delegate (personal certificate of the attributed delegate) included in the attributed delegate's personal certificate.

  Specifically, the attribute delegation certificate generation unit 104 encrypts a plaintext composed of identification information, attribute information, and a delegation attribute, and a message digest obtained by converting the plaintext using a hash function with a secret key corresponding to the personal certificate. The attribute delegation certificate having the digital signature data thus generated is generated. When the delegation attribute determination unit 103 determines the expiration date, the expiration date may be included in the plain text. In addition, the plain text may include management information such as attribute certificate version information and attribute delegation certificate signature algorithm.

  When the attribute delegation certificate generation unit 104 and the storage unit 101 that stores the secret key are included in different devices, the device having the storage unit 101 receives the signature request signal from the attribute delegation certificate generation unit 104. The electronic signature data may be generated.

  The attribute delegation certificate recording unit 105 has a function of recording the attribute delegation certificate in the storage unit 101 of the attribute delegator. In the present embodiment, the attribute delegation certificate recording unit 105 of the user device 1 of the user 200 delegating the attribute uses wireless communication to the storage unit 101 of the user device 1 of the user 200 to which the attribute is delegated. The attribute delegation certificate is recorded, but the present invention is not limited to this.

  For example, the authentication information acquisition unit 102 and the attribute delegation certificate recording unit 105 described above may use a card reader / writer, Wi-Fi (wireless fidelity), Bluetooth, infrared, etc. A communication device that satisfies the wireless communication standard may be used.

  The display unit 111 is a display that displays the attribute information acquired by the authentication information acquisition unit 102 in a selectable manner. The input unit 112 is an input device that can be input from the outside, and is a touch panel provided so as to cover the display unit 111, but with an input button, a keyboard, or the like according to the form of the user device 1. There may be. The user 200 who delegates an attribute can select an attribute on the delegation attribute determination screen displayed on the display unit 111 and can input the delegation attribute to be delegated through the input unit 112. The delegation attribute determination screen will be described in detail later.

  Further, the request request unit 110 transmits a service provision request to the service providing system in response to an input to the input unit 112 and displays the contents of the service on the display unit 111 based on the response from the service providing system 4. .

(Service provision system 4)
The service providing system 4 includes a request verification unit 106 of the attribute delegation system 100 and a service providing unit 130 that provides a service in response to a request from the user 200. Here, the request includes “personal certificate of user 200”, “attribute information”, and “service request content”.

  The request verification unit 106 includes a request reception unit 107, a signature verification unit 108, a user confirmation unit 109, and an attribute confirmation unit 120.

  The request reception unit 107 has a function of confirming a personal certificate from the user apparatus 1 that has made the request and performing personal authentication of the user 200. For example, the request reception unit 107 browses the revocation list of the certificate authority 2 and confirms whether the personal certificate has expired. Further, when the request is based on the attribute certificate, the request reception unit 107 browses the revocation list of the attribute certificate authority 3 to check whether the attribute certificate has expired. Note that these functions may be provided by the service providing unit 130.

  If the request accepting unit 107 confirms the validity of the request as described above, the request accepting unit 107 transmits the attribute of the user 200 and the content of the service request to the service providing unit 130, and sends a response from the request processing unit to the user. Transmit to device 1.

  Further, when the request is based on the attribute delegation certificate, that is, when the request from the user device 1 includes the attribute delegation certificate indicating the attribute of the user 200 Then, information based on the request from the user device 1 is transmitted to the signature verification unit 108 and the user confirmation unit 109.

  The signature verification unit 108 has a function of verifying the signature of the attribute delegation certificate. Specifically, the request verification unit 106 decrypts the electronic signature data included in the attribute delegation certificate into a message digest using a public key, and converts the plaintext included in the attribute delegation certificate into a message using a hash function. It is converted to a digest and it is confirmed whether or not these message digests match.

  The user confirmation unit 109 has a function of confirming whether the plaintext identification information included in the attribute transfer certificate matches the identification information of the personal certificate confirmed by the request reception unit 107. The attribute confirmation unit 120 has a function of browsing the revocation list of the attribute certification authority 3 to confirm whether or not the attribute certificate included in the attribute delegation certificate has expired, and a function of confirming the attribute indicated by the attribute delegation certificate have.

  The request reception unit 107 described above, the request verification unit 106 receives the verification result information from the request reception unit 107, the signature verification unit 108, and the attribute confirmation unit 120, and the attribute and service request content acquired by the attribute confirmation unit 120. Are transmitted to the service providing unit 130. That is, the request reception unit 107 has a function of receiving the attribute indicated by the attribute delegation certificate as the user attribute.

  The service providing unit 130 executes various processes for providing a service based on the attribute from the request verification unit and the content of the service request. That is, since the attribute verification is performed by the request verification unit 106, the service providing unit 130 can execute the process assuming that the attribute of the user 200 transmitted from the request verification unit 106 is correct. Therefore, the service providing unit 130 only needs to determine whether the requested service request content corresponds to the attribute, and does not need to authenticate the attribute.

  In this embodiment, the user device 1 and the service providing system (application server) 4 are computers, and a CPU (Central Processing Unit), a program executed by the CPU, and data used for these programs can be rewritten. EEPROM (Electrically Erasable and Programmable Read Only Memory) stored in the memory and RAM (Random Access Memory) that temporarily stores data when the program is executed. The above-described units included in the user device 1 and the service providing system 4 are constructed in cooperation with these and the above-described computer and the attribute delegation program in the EEPROM.

  In other words, the attribute delegation program causes the computer to have functions as described above.

  Further, the user device 1 and the service providing system 4 are not limited to a single device, but may be provided by distributing functions to a plurality of computers or the like. That is, the request verification unit 106 is applied so as to be included in the service providing system 4, but the request verification unit 106 may be installed on a separate server from the service providing system 4. Further, for example, one independent server for verifying all requests of the plurality of service providing systems 4 may be installed.

(Attribute information)
Here, the authentication information stored in the storage unit 101 will be described.
First, as shown in FIGS. 1 and 3, when the user 200A issues an attribute certificate from the attribute certificate authority 3, the storage unit 101 of the user apparatus 1A stores the personal certificate 11 of the user 200A. The private key 12 corresponding to the personal certificate 11 and the attribute certificate 13 are stored as attribute information.

  Next, a case where the attribute is transferred from the user 200A as described above to the user 200B having no attribute information will be described. As shown in FIG. 4, in the storage unit 101 of the user device 1B of the user 200B, a personal certificate 21 of the user 200B, a private key 22 corresponding to the personal certificate 21, and attributes as attribute information The delegation certificate 23 is recorded by the user apparatus 1A.

  Specifically, the attribute transfer certificate 23 includes identification information 231, an attribute certificate 13 of the user 200A, a transfer attribute 232, an expiration date 233, and a signature 234 of the user 200A who is the attribute transferee. include. Here, the identification information 231 is a subject unique identifier (Subject Unique ID) included in the personal certificate 21 of the user 200B, and is unique information for identifying the user 200B. Further, as described above, the signature 234 is the signature made by the user apparatus 1A based on the identification information 231, the attribute certificate 13, the delegation attribute 232, and the private key 12 of the user 200A for the expiration date 233. It is.

  Accordingly, the attribute confirmation unit 120 verifies the signature 234 with the public key of the user 200A indicated by the attribute certificate 13 included in the attribute delegation certificate 23, and clears the plaintext (identification information 231 and attribute proof of the attribute delegation certificate 23). It can be confirmed that the document 13, the delegation attribute 232, and the expiration date 233) have not been tampered with. That is, it can be confirmed that the user 200A has delegated the attribute (delegation attribute 232) to the user 200B (identification information 231).

  Further, since the attribute delegation certificate 23 includes the attribute information (attribute certificate 13) of the authority delegator, the attribute confirmation unit 120 indicates that the delegated attribute (delegation attribute 232) is the attribute certificate 13. It can be easily confirmed without accessing the attribute certificate authority 3 that it is within the range of the attribute. Further, since the attribute certificate 13 includes the expiration date of the attribute indicated by the attribute certificate 13, the attribute confirmation unit 120 determines that the attribute expiration date 233 of the delegated attribute is within the expiration date of the attribute certificate 13. It can be easily confirmed whether or not.

  Next, a case where the attribute is transferred from the user 200B as described above to the user 200C having no attribute information will be described. As shown in FIG. 5, in the storage unit 101 of the user device 1C of the user 200C, a personal certificate 31 of the user 200C, a private key 32 corresponding to the personal certificate 31, and attributes as attribute information The delegation certificate 33 is recorded by the user apparatus 1B.

  Specifically, the attribute delegation certificate 33 includes the identification information 331, the attribute delegation certificate 23 of the user 200B as attribute information, the delegation attribute 332, the expiration date 333, and the user 200B who is the attribute delegator. The signature 334 is included.

  Therefore, the attribute confirmation unit 120 verifies the signature 334 with the public key indicated by the identification information 331 included in the attribute delegation certificate 33, and clears the plain text (identification information 231, attribute certificate 13, delegation attribute) of the attribute delegation certificate 23. 232 and the expiration date 233) can be confirmed. That is, it can be confirmed that the user 200B has delegated the attribute (delegation attribute 332) to the user 200C (identification information 231).

  In addition, since the attribute delegation certificate 33 includes the attribute information (attribute delegation certificate 23) of the authority delegator, the delegated attribute (delegation attribute 332) is the attribute (delegation) indicated by the attribute delegation certificate 23. It can be easily confirmed without accessing the attribute certification authority 3 that it is within the range of the attribute 232). Further, since the attribute delegation certificate 23 includes the validity period 233 of the attribute indicated by the attribute delegation certificate 23, the delegation attribute validity period 333 is within the validity period of the attribute delegation certificate 23. It can be easily confirmed whether or not.

  In this way, attribute information can be delegated for several generations by storing attribute information in a nested state. That is, the attribute delegation model using the attribute delegation certificate as described above has a hierarchical pyramid structure in which attribute delegation can be repeated. For example, when the user is a member belonging to the same organization, Can be delegated to subordinate members as needed. Then, the member whose attribute has been transferred can transfer the attribute to a lower-level member. By using the attribute delegation certificate in this way, it is possible to delegate attributes directly and dynamically.

(Delegation attribute determination screen)
Next, a delegation attribute determination screen displayed on the display unit 111 of the user device 1 when generating such an attribute delegation certificate will be described. In the present embodiment, the attribute information attribute (attribute included in the attribute certificate or delegation attribute included in the attribute delegation certificate) includes at least one attribute item and an attribute value corresponding to the attribute item. Indicated. The display unit 111 displays attribute items and attribute values of the attribute information of the attribute delegator.

  FIG. 6 is an explanatory diagram illustrating an example of a delegation attribute determination screen. As illustrated in FIG. 6, the delegation attribute determination screen includes an attribute delegator information area 40, an attribute delegator information area 41, an attribute item information area 42, an attribute value area 43, an expiration date area 44, and a delegation area. A determination button area 45 is provided.

  In the attribute delegator information area 40, information regarding the user 200 who becomes the attribute delegator (the owner of the user device 1 displaying the delegation attribute determination screen) is displayed. In this example, the name of the user 200 and the expiration date of the attribute of the user 200 are displayed. In the attribute transferee information area 41, information on the user 200 who becomes the attribute transferee is displayed. In this example, the name of the user 200 who becomes the attribute transferee is displayed. The attribute transferee information area 41 is displayed when the user device 1 reads the personal certificate of the attribute transferee.

  In the attribute item information area 42, attribute items of attribute information possessed by the user 200 as an attribute delegator are displayed. In FIG. 6, attribute items of “reading authority, update authority, transfer authority of customer management system”, “read authority, update authority, transfer authority of sales management system” and “read authority, update authority of authority transfer system” are displayed. Has been. That is, by displaying the attribute item in the attribute item information area 42, the attribute possessed by the attribute delegator is indicated.

  The transfer authority is an authority for further delegating the delegated attribute. That is, when the attribute delegater further delegates the attribute, it is necessary that the transfer authority is delegated from the attribute delegater.

  The attribute value area 43 is an area in which the attribute item displayed in the attribute item information area 42 can be input within the attribute range of the attribute delegator. In FIG. 6, the attribute value area 43 is displayed with check boxes corresponding to the attribute items, and each attribute item can be selected. As a result, the user 200 can select an attribute to be delegated to the authorized delegate within the range of the attribute that the user 200 has. That is, when the check box of a certain attribute item is checked, the attribute corresponding to this attribute item is delegated to the authorized delegate.

  Such attribute items are stored in the storage unit 101 as data having an object identifier (OID) or XML (Extensible Markup Language) structure, and a delegation attribute determination screen is displayed on the display unit 111. At this time, each attribute item and an attribute value corresponding to the attribute item are acquired. The attribute value indicates what attribute the attribute item has. For example, the attribute value includes information on whether or not the user has authority regarding a certain attribute item.

  In the expiration date area 44, the expiration date for the attribute to be transferred can be input. In FIG. 6, the expiration date area 44 is displayed in a text input form. The delegation determination button area 45 is used to determine information input to the attribute value area 43 and the expiration date area 44 by operating this area. That is, by operating the delegation determination button area 45, the delegation attribute input based on the attribute information of the attribute delegator is determined.

  FIG. 7 is an explanatory diagram showing another example of the delegation attribute determination screen. The attribute delegated person information area 41, the expiration date area 44, and the delegation determination button area 45 are the same as described above, and thus the description thereof is omitted.

  In the example of FIG. 7, the attribute item is “point information”, and the attribute value is “number of points”. In the attribute item information area 42, the “number of points” corresponding to the “point information” is displayed, and the attributes of the attribute delegator are indicated. The attribute value area 43 is displayed in a text input form, and the number of points to be transferred can be input.

(Operation)
Next, a specific operation of the attribute delegation system 100 having the above functions will be described.

(Attribute delegation process)
FIG. 8 is a flowchart of the attribute delegation processing routine executed by the user device 1.
First, the user device 1 reads the attribute delegator's personal certificate (referred to as personal certificate A) and the attribute delegator's attribute information (referred to as attribute information A) stored in the storage unit 101 ( S1). Then, based on the read personal certificate A and attribute information A, a delegation attribute determination screen as shown in FIG. 6 or 7 is displayed (S2).

  Then, the user apparatus 1 determines whether or not the delegation determination button area 45 on the delegation attribute determination screen has been operated (S3), and if not pressed (S3: NO), repeats the process of step S3. In other words, the attribute delegator inputs information regarding the attributes to be delegated to the attribute value area 43 and the expiration date area 44 and is in a standby state until the delegation determination button area 45 is operated.

  When the delegation determination button area 45 is operated, the contents (delegation attribute and expiration date) input to the attribute value area 43 and the expiration date area 44 are acquired (S4). At this time, input contents such as whether the acquired delegation attribute is within the range of the attribute delegator's attribute or whether the acquired expiration date is within the validity period of the attribute delegator's attribute may be checked.

  Next, the user device 1 acquires a personal certificate (referred to as personal certificate B) from the storage unit 101 of the user device 1 of the attribute transferee (S5). Note that acquisition of authentication information such as a personal certificate from another user apparatus 1 may be performed before the display of the delegation attribute determination screen. Thereby, information for identifying the attribute transferee who is a transfer target person can be displayed in advance on the transfer attribute determination screen. Then, the user device 1 acquires identification information (identification information B) from the personal certificate B (S6).

  After that, the user device 1 determines the attribute delegation certificate (attribute information B, or from the identification information B obtained in step S6, the attribute information A obtained in step S1, and the delegation attribute and expiration date obtained in step S4. , A plaintext of attribute delegation certificate B) is generated (S7). Then, an attribute delegation certificate B is generated by adding a signature to this plaintext (S8). Specifically, the user device 1 generates a message digest by converting the plaintext with a hash function, and encrypts the message digest with a secret key to obtain electronic signature data. Then, an attribute delegation certificate B is generated from the plain text and the electronic signature data.

  Then, the user device 1 records the generated attribute transfer certificate B in the user device 1 of the attribute transferee (S9), and ends this routine.

(Request verification process)
FIG. 9 is a diagram illustrating a flowchart of a request verification process executed by the service providing system 4 (the attribute delegation system 100 applied to be included in the service providing system 4).

  First, the service providing system 4 determines whether or not there is a request from the user device 1 (S11). If there is no request (S11: NO), the process of step S1 is repeated. That is, the service providing system 4 is in a standby state until the user makes a service provision request to the service providing system 4 by the user device 1 or the like.

  When there is a request from the user, the revocation of the personal certificate of the request is confirmed (S12). That is, the service providing system 4 accesses the certificate authority 2 to confirm the revocation list, and confirms that the personal certificate is not included in the revocation list.

  Next, the service providing system 4 determines whether the request is based on the attribute delegation certificate (S13). That is, it is determined whether or not the attribute information included in the request is an attribute delegation certificate, and the attribute is delegated from another user.

  When the request is based on the attribute delegation certificate (S13: YES), the signature attached to the attribute delegation certificate is verified based on the public key of the attribute delegator (S14). Specifically, the digital signature data included in the attribute delegation certificate is decrypted into a message digest using the public key, and the plain text included in the attribute delegation certificate is converted into a message digest using a hash function. To do. The signature is verified by confirming whether these message digests match.

  Then, the service providing system 4 performs user confirmation of the attribute delegation certificate (S15). Specifically, the plaintext identification information included in the attribute delegation certificate is compared with the identification information acquired from the personal certificate included in the request, and the personal certificate whose attribute delegation certificate is confirmed in step S12. Confirm that it corresponds to the letter.

  Then, the service providing system 4 confirms the revocation of the attribute delegation certificate (S16). Here, as described with reference to FIG. 5, the attribute delegation certificate allows a structure in which the attribute delegation certificate is formed in multiple layers in order to realize attribute delegation over several generations. That is, the attribute delegation certificate has at least one attribute certificate in the multilayer structure. Therefore, the service providing system 4 confirms the revocation of the attribute certificate included in the attribute delegation certificate. In step S16, it is confirmed whether the validity period of the attribute delegation certificate that is higher than the attribute certificate is within the validity period of the attribute certificate. When a large number of attribute delegation certificates are formed in multiple layers, the validity period is confirmed by comparing the validity period of the attribute delegation certificate with the validity period of the higher-level attribute delegation certificate.

  Then, the service providing system 4 confirms the attribute of the attribute delegation certificate (S17). As described above, since the attribute delegation certificate has at least one attribute certificate, it is confirmed whether the attribute range indicated by the attribute certificate is within the attribute range indicated by the higher-level attribute delegation certificate. . When a large number of attribute delegation certificates are formed in multiple layers, the attribute range indicated by the attribute delegation certificate is compared with the attribute range indicated by the higher-level attribute delegation certificate to confirm the attribute.

  Then, the service providing system 4 confirms the match between the owner of the attribute information in the attribute delegation certificate and the signer (S18). For example, in the case of the attribute delegation certificate 23 as shown in FIG. 4, the attribute delegation obtained by delegating the attribute delegation certificate 23 using the personal certificate corresponding to the attribute certificate 13 and the signature 234 of the attribute delegator. Person can be confirmed.

  Further, for example, in the case of the attribute delegation certificate 33 as shown in FIG. 5, the attribute delegation certificate 23 as described above is confirmed, the identification information 231 of the attribute delegation certificate 23, and the signature of the attribute delegator 334, the attribute delegator who delegated the attribute delegation certificate 33 can be confirmed.

  As described above, the service providing system 4 includes the contents of the attribute transfer certificate (whether tampering has been performed), the owner of the attribute transfer certificate, the revocation / expiration date of the attribute transfer certificate, and the attribute transfer certificate. And the owner of the attribute information in the attribute delegation certificate can be verified.

  On the other hand, if the request is not based on the attribute delegation certificate in step S13 (S13: NO), that is, if the request is based on the attribute certificate, the revocation of the attribute certificate is confirmed (S19).

  After the service providing system 4 verifies the validity of the attribute information (attribute delegation certificate or attribute certificate) after step S18 or S19, the service request included in the request and the attribute indicated by the attribute information The contents are transferred to the service providing unit 130 which is a service providing application that provides the service (S20), and this routine is terminated.

(Service provision processing)
FIG. 10 is a diagram simply illustrating a flowchart of a service providing process (a service providing application that provides a service) executed by the service providing system 4.

  First, the service providing system 4 determines whether or not the attribute and the content of the service request are transferred from the request verification processing routine shown in FIG. 9 (S21). If there is no transfer (S21: NO), step S21 is performed. Repeat the process. That is, the service providing system 4 is in a standby state until there is a transfer from the request verification processing routine.

  When there is a transfer from the request verification processing routine (S21: YES), matching is performed between the service request content and the attribute (S22). That is, the service providing system 4 has a service correspondence table for matching service request contents and attributes in a storage device or the like.

  Here, the service correspondence table will be described. FIG. 11 is a diagram illustrating an example of the service correspondence table. As shown in FIG. 11, the service correspondence table has a service type column and a necessary attribute column. In the service type column, service request contents that can be requested by the user 200 (user device 1) are stored. In the necessary attribute column, attributes necessary for the contents of the service request are stored.

  For example, when the service request content is data browsing related to the customer management system, the customer management system reading authority is required as an attribute. Further, when the service request content is data addition related to the customer management system, the read authority and update authority of the customer management system are required as attributes.

  That is, in step S22, a process for determining whether or not an attribute required for the service request content is included in the transferred attribute is performed. The matching process as in step S22 may be included in the function as the attribute delegation system 100 included in the service providing system.

  And when it has a required attribute, after performing the request process with respect to the content of a service request (S23), a result is transmitted to the user apparatus 1 as a response (S24). For example, when transferring the number of points as delegation of attributes, the database managing the number of points is updated in step S23. That is, the attribute delegator's point number is subtracted by the delegation, and the attribute delegator's point number is added. And the process which invalidates the attribute delegation certificate used for the request is performed. This prevents the attribute transferee from acquiring points multiple times. Similar processing is performed for delegation of game items and currency.

  In this way, since the attribute whose validity has been verified is transferred to the service providing application that provides the service, the service providing application does not need to perform verification regarding the attribute. That is, the attribute delegation system 100 (request verification unit) applied to be included in the service providing system 4 can accept the attribute indicated by the attribute delegation certificate as the attribute of the user who made the request.

  The embodiment of the present invention has been described above, but only specific examples are illustrated, and the present invention is not particularly limited. The specific configuration of each unit and the like can be appropriately changed. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  That is, in this embodiment, a user has a user device and can perform attribute delegation between user devices, but the attribute delegation mode is not limited to this. For example, a user has a storage medium such as an IC card in which authentication information (personal certificate, private key, attribute certificate, etc.) is stored, and attribute transfer is performed by a PC having a card reader / writer or the like. It may be a thing. For example, the user may have a PC terminal in which authentication information is stored, and attribute delegation may be performed via the Internet, an intranet, or the like.

  Further, in the above detailed description, the characteristic portions have been mainly described so that the present invention can be easily understood. The present invention is not limited to the embodiments described in the detailed description above, but can be applied to other embodiments, and the scope of application is various. The terms and terminology used in the present specification are used to accurately describe the present invention, and are not used to limit the interpretation of the present invention. Moreover, it would be easy for those skilled in the art to infer other configurations, systems, methods, and the like included in the concept of the present invention from the concept of the invention described in this specification. Accordingly, the description of the claims should be regarded as including an equivalent configuration without departing from the scope of the technical idea of the present invention. The purpose of the abstract is to simplify the technical contents and essence of this application by patent offices and general public institutions, and engineers belonging to this technical field who are not familiar with patents, legal terms or technical terms. It is intended to be able to make a quick determination through a simple survey. Accordingly, the abstract is not intended to limit the scope of the invention to be evaluated by the claims. Moreover, in order to fully understand the object of the present invention and the specific effects of the present invention, it is desired that the interpretation should be made with sufficient consideration of the literatures already disclosed.

  The above detailed description includes processing executed by a computer. The above explanations and expressions are given for the purpose of enabling those skilled in the art to understand the most efficiently. In this specification, each step used to derive one result should be understood as a self-consistent process. In each step, transmission / reception, recording, and the like of electrical or magnetic signals are performed. In the processing in each step, such a signal is expressed by bits, values, symbols, characters, terms, numbers, etc., but these are used only for convenience of explanation. There is a need. In addition, the processing in each step may be described in an expression common to human behavior, but the processing described in this specification is executed by various devices in principle. Further, other configurations required for performing each step will be apparent from the above description.

DESCRIPTION OF SYMBOLS 1 User apparatus 2 Certification authority 3 Attribute certification authority 4 Service provision system 101 Storage part 102 Authentication information acquisition part 103 Delegation attribute determination part 104 Attribute delegation certificate generation part 105 Attribute delegation certificate recording part 106 Request verification part 107 Request reception part 108 Signature verification unit 109 User confirmation unit 110 Request request unit 111 Display unit 112 Input unit 120 Attribute confirmation unit 130 Service provision unit 200 User

Claims (6)

An attribute delegation system applied to a service providing system for providing a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority,
Storage means for storing attribute information indicating the attribute of the user;
Authentication information acquisition means for acquiring the attribute information from the storage means;
A delegation attribute determining means for determining a delegation attribute to an attribute delegate to which an attribute is delegated based on the attribute information of the attribute delegator in response to an input from the attribute delegator who delegates the attribute;
Attribute transfer certificate generating means for generating an attribute transfer certificate including the attribute information of the attribute transferee and the transfer attribute;
Attribute delegation certificate recording means for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegator;
Request verification that is applied to be included in the service providing system and accepts the attribute of the attribute delegation certificate as an attribute of the user when there is a service provision request based on the attribute delegation certificate from the user And an attribute delegation system. An attribute delegation system applied to a service providing system for providing a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority,
Storage means for storing the personal certificate of the user and attribute information indicating the attribute of the user;
Authentication information acquisition means for acquiring the personal certificate and / or the attribute information from the storage means;
A delegation attribute determining means for determining a delegation attribute to an attribute delegate to which an attribute is delegated based on the attribute information of the attribute delegator in response to an input from the attribute delegator who delegates the attribute;
Identification information of the attribute transferee based on the personal certificate of the attribute transferee, attribute information of the attribute transferee, the transfer attribute, and a signature based on the attribute certificate of the attribute transferee to these Attribute delegation certificate generation means for generating an attribute delegation certificate including
Attribute delegation certificate recording means for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegator;
When it is applied to be included in the service providing system and a request for providing a service based on the attribute delegation certificate is received from the user, the signature of the attribute delegation certificate is confirmed, and the user and the identification are confirmed. An attribute delegation system comprising: request verification means for confirming a match with information and receiving an attribute of the attribute delegation certificate as an attribute of the user. The delegation attribute determination means determines an expiration date of the delegation attribute according to an input from the attribute delegator who delegates the attribute,
The attribute delegation system according to claim 1, wherein the attribute delegation certificate generation unit generates the attribute delegation certificate including the determined expiration date.   The said request verification means confirms the user who possesses this attribute information based on the said attribute information contained in the said attribute delegation certificate, and the said signature, The Claim 2 or 3 characterized by the above-mentioned. Attribute delegation system. An attribute delegation method applied to a service providing system for providing a service to a user authenticated by a certificate authority based on the attribute of the user authenticated by the attribute certificate authority,
An authentication information acquisition step of acquiring attribute information indicating the attribute of the user from the storage means owned by the user;
A delegation attribute determination step for determining a delegation attribute to an attribute delegate to which an attribute is delegated based on the attribute information of the attribute delegator in response to an input from the attribute delegator who delegates the attribute;
An attribute delegation certificate generation step for generating an attribute delegation certificate including the attribute information of the attribute delegator and the delegation attribute;
An attribute delegation certificate recording step for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegator;
A request verification step for accepting the attribute of the attribute delegation certificate as an attribute of the user when the user requests the service providing system to provide a service based on the attribute delegation certificate. An attribute delegation method characterized by An attribute delegation program applied to a service providing system for providing a service based on an attribute of a user authenticated by an attribute certificate authority to a user authenticated by a certificate authority,
The computer that the user has
Storage means for storing attribute information indicating the attribute of the user;
Authentication information acquisition means for acquiring the attribute information from the storage means;
A delegation attribute determination means for determining a delegation attribute to an attribute delegate to which an attribute is delegated based on the attribute information of the attribute delegator in response to an input from the attribute delegator who delegates the attribute;
Attribute delegation certificate generation means for generating an attribute delegation certificate including the attribute information of the attribute delegator and the delegation attribute; and
Attribute delegation certificate recording means for recording the attribute delegation certificate as attribute information in the storage means of the attribute delegator,
Function as
A computer as the service providing system,
An attribute delegation program that functions as a request verification unit that accepts an attribute of the attribute delegation certificate as an attribute of the user when there is a service provision request based on the attribute delegation certificate from the user .