JP2023070060A - Information processing system, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security in communication.

SOLUTION: In an information processing system 1, a first information processing device stores first identification information for identifying a user, and transmits a request for a service by a second information processing device to a third information processing device. The third information processing device acquires the first identification information, receives the request from the first information processing device, inquires of the second information processing device whether or not to permit the request, generates first transmission data by using a seed, first shared information sharing with the first information processing device, time information determined by a communication time with the first information processing device, the first identification information and first communication information determined in each communication with the first information processing device to transmit the first transmission data to the first information processing device when the request is permitted, and generates second transmission data including the seed to transmit the second transmission data to the second information processing device. The first information processing device and the second information processing device perform encryption and communication by using a key generated by extracting the seed from the first transmission data and the second transmission data.

SELECTED DRAWING: Figure 10

COPYRIGHT: (C)2023,JPO&INPIT

Description

The present invention relates to an information processing system, an information processing method, and a program.

2. Description of the Related Art A method of encrypting information with a key in communication between information processing apparatuses is known.

Specifically, when communication is performed between a first information processing device used by a user and a third information processing device providing a service, a plurality of second information processing devices have a key used for communication, Alternatively, it generates material data that is a material for generating a key. In this way, the information processing system seeks an "agreement" between at least three devices including the first information processing device, the second information processing device, and the third information processing device before communicating. Then, the information processing system starts communication when an "agreement" is reached among the three devices. With such a configuration, compared to when communication is performed by a common key cryptosystem that encrypts and decrypts with a key that is shared in advance between two devices, it is a technology that enables communication with improved security. is known (see, for example, Patent Document 1, etc.).

JP 2020-77978 A

The conventional technology has a security problem, such as an attack on communication between devices that transmit and receive a key or material data that is a material for generating a key. That is, the conventional technology has a problem of improving security. Especially in Trust Access Secure Network Architecture (TSA), etc., there is a problem of improving security.

An object of the present invention is to improve security in communication.

In order to solve the above problems, in one aspect of the present invention,
A first information processing device used by a user, a second information processing device connected to the first information processing device, and a third information processing device connected to the first information processing device and the second information processing device. In an information processing system,
The first information processing device is
a first identification information storage unit that stores first identification information that identifies the user;
a request unit for transmitting a service request from the second information processing device to the third information processing device;
The third information processing device is
a first identification information acquisition unit that acquires the first identification information;
a notification unit that, when receiving the request from the first information processing device, notifies the second information processing device of whether or not to permit the request;
a response receiving unit that receives a response to the notification from the second information processing device;
a seed generation unit that generates key basic information or a seed that indicates the key;
When the request is permitted by the response, the seed, first shared information shared with the first information processing device, time information determined by communication time with the first information processing device, the first identification information, and a first transmission data generation unit that generates first transmission data using first communication information determined for each communication with the first information processing device;
a first transmission data transmission unit that transmits the first transmission data to the first information processing device;
a second transmission data generation unit that generates second transmission data including the seed when the request is permitted by the reply;
a second transmission data transmission unit that transmits the second transmission data to the second information processing device;
The second information processing device is
a permitting unit that, when receiving the notification from the third information processing device, sends the response permitting the request to the third information processing device when permitting the notification;
The first information processing device and the second information processing device are
Each further includes a communication unit that performs encryption using the key generated by extracting the seed from the first transmission data or the second transmission data and performing communication.

According to the present invention, security can be improved in communication.

It is a figure which shows the whole structural example of an information processing system. It is a figure which shows the hardware structural example of an information processing apparatus. It is a figure which shows the example of a pre-processing. It is a figure which shows the example of this process. It is a figure which shows the example of an interactive authentication process. It is a figure which shows the example of a non-interactive authentication process. It is a figure which shows the example of an attack. It is a figure which shows the 1st modification of the authentication process using shared information. FIG. 12 is a diagram showing a second modified example of authentication processing using shared information; It is a figure which shows the functional structural example. It is a figure which shows the example which distributes information in 2nd Embodiment. It is a figure which shows the example of distributed information. FIG. 4 is a diagram showing an example of specifying a group of devices by SDx; FIG. 4 is a diagram showing an example of specifying a group of devices by DNS; FIG. 10 illustrates an example of a man-in-the-middle attack; FIG. 10 is a diagram showing an example of an attack by "spoofing";

A specific example will be described below with reference to the accompanying drawings. In the following description, reference numerals in the drawings refer to the same elements when the reference numerals are the same.

[First embodiment]
FIG. 1 is a diagram showing an example of the overall configuration of an information processing system. For example, the information processing system 1 is configured by a combination of a first information processing device 11, a second information processing device 12, a third information processing device 13, a fourth information processing device 14, and the like. For example, in the information processing system 1, the first information processing device 11, the second information processing device 12, the third information processing device 13, and the fourth information processing device 14 are connected by a wired or wireless network. Connect and send and receive information.

The first information processing device 11 is an information processing device used by the user 15 . Specifically, the first information processing device 11 is a Personal Computer (PC) or the like.

The second information processing device 12 is an information processing device such as a server. For example, the second information processing device 12 connects to the first information processing device 11 via the Internet or the like. The second information processing device 12 also provides services to the user 15 via the network. For example, the second information processing device 12 develops a so-called online shopping site and the like, and provides the user 15 with services such as selling products.

The service provided by the second information processing apparatus 12 is not limited to a service related to retail sales, and may be any service that can be provided to the user 15 using a network. For example, the service provided by the second information processing device 12 may be a service related to communication such as e-mail.

The third information processing device 13 is an information processing device such as a server connected to the first information processing device 11, the second information processing device 12, and the fourth information processing device 14 via a network.

The fourth information processing device 14 is an information processing device such as a server connected to the first information processing device 11, the second information processing device 12, and the third information processing device 13 via a network. Further, the fourth information processing device 14 holds user information 16 of the user 15 in a database or the like.

For example, the user 15 registers the user information 16 when subscribing as a member of the service provided by the second information processing apparatus 12 . Therefore, the user information 16 differs depending on the content used in the service or the like. Specifically, the user information 16 is, for example, information such as name, age, address, password, and credit card number in an online shopping service.

Note that the user information 16 may be information used for services other than the services provided by the second information processing device 12 . Moreover, the user information 16 may be registered before communication is performed between the first information processing device 11 and the second information processing device 12 .

Hereinafter, in order to identify the user information 16, it is assumed that identification information (ID, identification) is set by registration. Therefore, identification information for identifying the user 15 and the first information processing apparatus 11 (hereinafter referred to as "first identification information") can be acquired by the first information processing apparatus 11 at the time of registration.

Note that the first identification information can be acquired by inquiring of the fourth information processing device 14 after registration. However, the fourth information processing device 14 does not unconditionally provide the first identification information in response to an inquiry from the external device, but provides the first identification information after performing a check such as a certain verification process.

Also, the first identification information is generated using all or part of the user information 16 . For example, the first identification information is generated corresponding to all or part of the user information 16 . Specifically, the first identification information may be a different identification number if the name in the user information 16 is different. On the other hand, if the first identification information is determined, the user 15 can be specified based on the first identification information because there is one corresponding name.

[Hardware Configuration Example of Information Processing Device]
FIG. 2 is a diagram illustrating a hardware configuration example of an information processing apparatus. For example, the first information processing device 11 has a hardware configuration including a Central Processing Unit (CPU, hereinafter referred to as "CPU 11H1"), a storage device 11H2, an interface 11H3, an input device 11H4, an output device 11H5, and the like.

The CPU 11H1 is an example of an arithmetic device and a control device. For example, the CPU 11H1 performs calculations based on programs, operations, or the like.

The storage device 11H2 is a main storage device such as a memory. The storage device 11H2 may be a Solid State Drive (SSD) or an auxiliary storage device such as a hard disk.

The interface 11H3 transmits and receives data to and from an external device via a network, cable, or the like. For example, the interface 11H3 is a connector, an antenna, or the like.

The input device 11H4 is a device for inputting an operation by a user. For example, the input device 11H4 is a mouse, keyboard, or the like.

The output device 11H5 is a device that outputs processing results and the like to the user. For example, the output device 11H5 is a display or the like.

Note that the information processing apparatus may have a hardware configuration that further includes internal or external hardware resources other than those described above. Also, each information processing device may be a plurality of devices.

Further, the first information processing device 11, the second information processing device 12, the third information processing device 13, and the fourth information processing device 14 may have different hardware configurations, or may have the same hardware configuration. good.

[Overall processing example]
Hereinafter, in the overall processing, the information processing system 1 performs processing (hereinafter referred to as “pre-processing”) in advance, and then processing including communication etc. (hereinafter referred to as “main (hereinafter referred to as “processing”).

Note that the pre-processing may be completed before the main processing. Therefore, the pretreatment and the main treatment do not have to be continuous.

Moreover, once the pre-processing is executed, it is not necessary to execute the main processing thereafter. That is, it is not necessary to perform the pre-processing in advance each time the main processing is performed.

FIG. 3 is a diagram illustrating an example of preprocessing. For example, the information processing system 1 registers the user information 16 by the following pre-processing.

In step S<b>101 , the first information processing device 11 transmits information and the like input by the input operation by the user 15 to the fourth information processing device 14 to register the user information 16 .

Note that the user information 16 may be registered by a process other than the above process. For example, the user information 16 may be registered via a site or the like developed by the second information processing device 12 .

Specifically, the second information processing apparatus 12 develops a site or the like that displays an enrollment form for procedures for the user 15 to join the service provided by the second information processing apparatus 12 . Then, the user 15 operates the first information processing device 11 to input each item (information corresponding to the name, etc. of the user information 16) in the membership form. When such an input is made, the second information processing device 12 receives the user information 16 (or part of it in some cases) from the first information processing device 11 . After that, the second information processing device 12 transmits the user information 16 to the fourth information processing device 14 .

In this manner, the user information 16 may be registered directly or through multiple information processing devices. Also, the user information 16 may centrally manage information used in a plurality of services.

The user information 16 may be generated and managed by data integration (sometimes called data integration (Digital Identity, DI, ID), etc.). Also, the user information 16 may be used in combination with a plurality of services, or may be different for each service (including a case where the user information 16 is partially different).

After step S101, for example, the fourth information processing device 14 uses the user information 16 or part of the user information 16 to generate the first identification information. Therefore, after the registration in step S101, for example, by inquiring about the first identification information in step S102 or step S104, an external device other than the fourth information processing device 14 can acquire the first identification information.

In step S102, the third information processing device 13 inquires of the fourth information processing device 14 about the first identification information.

In step S103, the fourth information processing device 14 responds to the inquiry with the first identification information. Thus, the third information processing device 13 acquires the first identification information.

In step S104, the second information processing device 12 inquires of the fourth information processing device 14 about the first identification information.

In step S105, the fourth information processing device 14 responds to the inquiry with the first identification information. Thus, the second information processing device 12 acquires the first identification information.

Note that the first identification information may be acquired by a method other than steps S102 to S104. For example, the third information processing device 13 and the like may acquire the first identification information by performing processing using the user information 16 or part of the user information 16 . Also, the acquisition of the first identification information can be done at any timing as long as the registration is completed.

FIG. 4 is a diagram showing an example of this processing. An example of main processing performed by the information processing system 1 after the pre-processing shown in FIG. 3 is completed will be described below.

In step S<b>201 , the first information processing device 11 transmits a service request from the second information processing device 12 to the third information processing device 13 . Hereinafter, information instructing the second information processing device 12 to start a service at the request of the user 15 is simply referred to as a "request". Also, this process is started by sending a request.

Specifically, the request is sent at the timing when the user 15 makes an application to purchase a predetermined product at an online shopping site, or when the user 15 inputs an operation such as sending an email in an email sending/receiving service. . Therefore, as long as the request is information that serves as a trigger indicating the start of this processing, the amount of information and the format of the request do not matter.

In step S202, when receiving the request, the third information processing device 13 notifies the second information processing device 12 whether or not to permit the request.

In step S<b>203 , the second information processing device 12 sends a reply to the notification to the third information processing device 13 . Specifically, when the second information processing device 12 determines that the request is from the first information processing device 11, it makes a reply of permission.

On the other hand, when the second information processing device 12 determines that the request is not from the first information processing device 11, it makes a reply of refusal. It should be noted that, if a reply of refusal is received, this processing ends. In the following, it is assumed that the response is permission.

Also, if the response in step S203 is permission, it means that the first information processing device 11 has been authenticated by the second information processing device 12 .

In step S<b>204 , the third information processing device 13 preferably authenticates the first information processing device 11 . In step S204, it is more desirable to perform authentication processing using shared information, which will be described later. In this way, when authentication is performed, unauthorized access or unauthorized acquisition of information by an information processing apparatus "spoofing" the first information processing apparatus 11 can be prevented.

In step S205, the third information processing device 13 generates data to be transmitted to the first information processing device 11 (hereinafter referred to as "first transmission data").

For example, the first transmission data is generated by calculating the following formula (1).

First transmission data=(S _d ||N ₁ ||T) XOR Hash(ID ₁ ||S ₁ ) (1)

For example, in step S205, the third information processing device 13 calculates the right side of the above equation (1) to generate the first transmission data. Specifically, in generating the first transmission data, the third information processing device 13 first generates a key or data serving as basic information of the key (hereinafter referred to as "seed"). . A case where the seed is the basic information of the key will be described below as an example.

In the above equation (1), "S _d " is the seed. The seed is data used as a basis for generating a key used for encrypted communication between the first information processing device 11 and the third information processing device 13 using a common key system.

Therefore, if the first information processing device 11 and the second information processing device 12 receive the same seed, the same key can be generated on the transmitting side and the receiving side. Decryption becomes possible.

For example, the seed is a random number or the like having a predetermined amount of information. Alternatively, the seed may be a key. However, if the seed is basic information from which the key can be obtained by performing certain processing on the seed, rather than the key, the security against an attacker who does not know the certain processing can be improved.

It should be noted that the amount of information of the seed does not matter as long as it serves as the basis of the key. For example, the seed may be data or the like that becomes part of the key.

Specifically, the first information processing device 11 and the second information processing device 12 share data to be added in advance, a conversion method, or the like, rather than receiving the seed. Then, when the seeds are received, the first information processing device 11 and the second information processing device 12 add data to be shared to the seeds, or perform the same processing such as the conversion method to be shared, and convert the seeds. to get the same key.

Also, in the above equation (1), "N ₁ " is information shared between the first information processing device 11 and the third information processing device 13 (hereinafter referred to as "first shared information"). For example, the first shared information is a number or the like. Therefore, as long as the same data can be shared between the first information processing device 11 and the third information processing device 13, "N ₁ " can be any amount of information. Also, the method of sharing the first shared information is, for example, transmitting information.

In the above formula (1), "T" is information (hereinafter referred to as "communication time") determined by the time at which communication was performed between the first information processing device 11 and the third information processing device 13. (referred to as "time information"). For example, the time information is a so-called time password or the like. Also, the communication time is, for example, the time when communication is started.

Thus, the first transmission data is desirably generated depending on the time of communication. This is because using the time information makes it difficult to extract the seed or the like from the first transmission data at times other than the fixed period according to the time information. Therefore, information such as seeds can be prevented from leaking from the first data, and security can be improved.

In the above formula (1), "ID ₁ " is the first identification information. Therefore, the first identification information is acquired in advance by preprocessing or the like.

In the above formula (1), “S ₁ ” is information determined for each communication performed between the first information processing device 11 and the third information processing device 13 (hereinafter referred to as “first communication information”). . For example, the first communication information is information different for each session. Therefore, the first communication information is disposable information for each communication, such as a session ID or a one-time password. Note that the first communication information may be generated in units other than sessions.

Further, the first communication information is transmitted from the third information processing device 13 to the first information processing device 11, for example, when communication is established between the first information processing device 11 and the third information processing device 13. Send and share.

Thus, it is desirable that the first transmission data be generated based on information that differs for each communication. This is because if the first communication information is used, the information differs for each communication, making it difficult to extract the seed or the like from the first transmission data in different communications. Therefore, information such as seeds can be prevented from leaking from the first transmission data, and security can be improved.

In the above formula (1), "||" is a logical sum (OR) operator. Furthermore, in the above formula (1), "XOR" is an exclusive OR operator. In the above formula (1), "Hash" indicates a hash function. Therefore, the argument of the hash function is in "brackets ( )" following "Hash".

Note that the first transmission data may be generated by a calculation other than the formula (1) above. For example, the first transmission data may be generated by calculating an equation that performs an equivalent calculation to equation (1) above. Alternatively, the first transmission data may be generated by a formula using a different operator from formula (1) above, or a calculation further using arbitrary random numbers.

In addition, the first transmission data may be generated by calculation using location information in addition to the above equation (1) or using it instead of the variables in the above equation (1).

When the position information is used in this way, it is necessary to grasp the position where the first information processing device 11 exists, or the like, when the first information processing device 11 exists within a predetermined position or within a range. , it can be difficult to extract seeds, etc. from the first transmitted data. Therefore, by using the location information, it is possible to prevent the information such as the seed from leaking from the first transmission data and improve the security.

In step S<b>206 , the third information processing device 13 transmits first transmission data to the first information processing device 11 . In addition, it is desirable that the third information processing device 13 encrypts and transmits the first transmission data. That is, the first transmission data is desirably transmitted between the first information processing device 11 and the third information processing device 13 while ensuring confidentiality.

In step S207, the first information processing device 11 extracts the seed and generates a key. First, the first information processing device 11 receives first transmission data transmitted by the third information processing device 13 in step S207. In addition, when the first transmission data is encrypted, the first information processing device 11 decrypts the first transmission data.

Next, upon receiving the first transmission data, the first information processing device 11 extracts the seed from the first transmission data. For example, when the first transmission data is generated based on the above equation (1), the first information processing device 11 can extract the seed from the first transmission data by calculating back the above equation (1).

Therefore, if the first information processing device 11 shares the above formula (1), the first shared information, the time information, the first identification information, the first communication information, etc. with the third information processing device 13, A seed can be retrieved from the first transmitted data.

Subsequently, the first information processing device 11 generates a key based on the extracted seed. Since the method of generating the key from the seed is shared with the second information processing device 12 in advance, the same key can be generated if the same seed is held.

In step S208, the third information processing device 13 generates data to be transmitted to the second information processing device 12 (hereinafter referred to as "second transmission data"). Specifically, the second transmission data may be data that can be extracted by the seed (for example, encrypted or compressed data may be used). However, it is desirable that the second transmission data be generated in the same manner as the first transmission data. An example of generating the second transmission data in the same manner as the first transmission data will be described below. Note that the following formula (2) may not be the same as the above formula (1) as long as it can be shared between the second information processing device 12 and the third information processing device 13 .

For example, the second transmission data is generated by calculating the following formula (2).

Second transmission data=(S _d ||N ₂ ||T) XOR Hash(ID ₂ ||S ₂ ) (2)

For example, in step S208, the third information processing device 13 calculates the right side of the above equation (2) to generate the second transmission data. Specifically, the third information processing device 13 uses the same seed as used for the first transmission data. Therefore, "S _d " in the above equation (2) is the seed. Also, "S _d " in the above formula (2) is the same data as "S _d " in the above formula (1). Therefore, the seed is common data between the first information processing device 11 and the second information processing device 12 . As a result, the first information processing device 11 and the second information processing device 12 can use the same key for encryption.

Also, in the above equation (2), “N ₂ ” is information shared between the second information processing device 12 and the third information processing device 13 (hereinafter referred to as “second shared information”). For example, the second shared information is a number or the like. Therefore, as long as the same data can be shared between the second information processing device 12 and the third information processing device 13, the amount of information or the like does not matter for "N ₂ ". Further, the method of sharing the second shared information is, for example, transmitting information.

In the above equation (2), "T" is time information. Note that the time information may be the same information as the above equation (1), or may be different information as long as it can be shared between the second information processing device 12 and the third information processing device 13 .

Thus, it is desirable that the second transmission data is also generated depending on the time of communication. This is because using the time information makes it difficult to extract the seed or the like from the second transmission data at times other than the fixed period according to the time information. Therefore, information such as seeds can be prevented from leaking from the second transmission data, and security can be improved.

In the above equation (2), “ID ₂ ” is information identifying the second information processing device 12 (hereinafter referred to as “second identification information”). For example, like the first identification information, the second identification information is acquired in advance by preprocessing or the like.

In the above formula (2), “S ₂ ” is information determined for each communication performed between the second information processing device 12 and the third information processing device 13 (hereinafter referred to as “second communication information”). . For example, the second communication information is information different for each session. Therefore, the second communication information is disposable information for each communication, such as a session ID or a one-time password. Note that the second communication information may be generated in units other than sessions.

However, the second communication information may be the same information as the first communication information. An example in which the first communication information and the second communication information are different will be described below.

Further, the second communication information is transmitted from the third information processing device 13 to the second information processing device 12, for example, when establishing communication between the second information processing device 12 and the third information processing device 13. Send and share.

Thus, it is desirable that the second transmission data be generated based on information that differs for each communication. This is because when the second communication information is used, the information differs for each communication, making it difficult to extract the seed or the like from the second transmission data in different communications. Therefore, information such as seeds can be prevented from leaking from the first transmission data, and security can be improved.

"||", "XOR", and "Hash" in the above formula (2) are the same as in the above formula (1).

In step S<b>209 , the third information processing device 13 transmits the second transmission data to the second information processing device 12 . In addition, it is desirable that the third information processing device 13 encrypts the second transmission data and transmits the encrypted data. That is, the second transmission data is desirably transmitted between the second information processing device 12 and the third information processing device 13 with confidentiality secured.

In step S210, the second information processing device 12 extracts the seed and generates a key. First, the second information processing device 12 receives second transmission data transmitted by the third information processing device 13 in step S209. In addition, when the second transmission data is encrypted, the second information processing device 12 decrypts the second transmission data.

Next, upon receiving the second transmission data, the second information processing device 12 extracts the seed from the second transmission data. For example, when the second transmission data is generated based on the above equation (2), the second information processing device 12 can extract the seed from the second transmission data by back-calculating the above equation (2).

Therefore, if the second information processing device 12 shares the above formula (2), the second shared information, the time information, the second identification information, the second communication information, etc. with the third information processing device 13, A seed can be retrieved from the second transmitted data.

Subsequently, the second information processing device 12 generates a key based on the extracted seed. Since the method of generating the key from the seed is shared with the first information processing device 11 in advance, the same key can be generated if the same seed is held.

Note that steps S205 to S207 and steps S208 to S210 may be executed in parallel or in reverse order.

As described above, when the first information processing device 11 executes step S207 and the second information processing device 12 executes step S210, the first information processing device 11 and the second information processing device 12 Encryption using the same key, ie, a state in which communication is possible with a common key system.

In step S211, the first information processing apparatus 11 and the second information processing apparatus 12 perform communication by encrypting using a key. Specifically, the communication is Advanced Encryption Standard (AES), Data Encryption Standard (DES), or the like. Note that the encryption and decryption may be of any standard as long as it is a method using a common key (including a combination with another method or use for partial encryption).

If communication can be performed with encryption in this way, the information processing system 1 can communicate confidentially between the first information processing device 11 and the second information processing device 12, thereby ensuring security in communication. can be improved.

It should be noted that step S211 is preferably encrypted communication with authentication such as Galois/Counter Mode (GCM).

In addition, the timing and the number of times of communication are not limited as long as the communication is in a state where the key can be held or later. That is, step S211 may be performed at any time after steps S207 and S210 are performed.

[Example of authentication processing using shared information]
For the authentication in step S204 and the like, for example, it is desirable to authenticate by determining whether or not to store the identification information as follows. In the following, the identification information is the first identification information, that is, the authentication of the first information processing device 11 by the third information processing device 13 will be described as an example. Note that the authentication may be, for example, either an interactive method or a non-interactive method described below.

[Example of interactive processing]
FIG. 5 is a diagram illustrating an example of interactive authentication processing. First, in the following example, the first information processing apparatus 11 shown on the left side of the drawing is subject to authentication. In other words, the third information processing device 13 authenticates whether the first information processing device 11 is an information processing device that has been "spoofed" by an attacker.

Authentication is determined by whether or not the first information processing device 11 stores the secret information “s”. The secret information “s” is hereinafter referred to as first identification information. Therefore, the third information processing device 13 grasps the first identification information in advance by preprocessing or the like. Therefore, the third information processing device 13 authenticates the first information processing device 11 based on whether or not the secret information “s” stored by the first information processing device 11 matches the first identification information.

First, prior to performing authentication, a public key "h" shown in the following equation (3) is made public. Therefore, the first information processing device 11, the third information processing device 13, and the like refer to the following formula (3) to grasp the public key calculation formula and the like.

h = g ^A (3)

A case where the public key calculation formula is the above formula (3) will be described below as an example. However, the public key calculation formula is not limited to the above formula (3), and any formula that can calculate the public key may be used. That is, it is sufficient that the same public key calculation formula can be shared among a plurality of information processing apparatuses.

The public key calculation formula, for example, is composed of the coefficient "g" and the index "A" as shown in the above formula (3). Therefore, when the public key calculation formula is grasped, the first information processing apparatus 11, the third information processing apparatus 13, etc. can grasp the calculation method of the public key "h", the coefficient "g", and the like.

Next, the third information processing device 13 generates a random number (hereinafter referred to as "first random number") "c". For example, the first random number 'c' has a value of either '1' or '0'.

In step S<b>401 , the third information processing device 13 transmits the first random number “c” to the first information processing device 11 . Therefore, the first information processing device 11 can grasp the first random number "c" and use it for subsequent calculations.

In step S402, the first information processing device 11 generates a random number (hereinafter referred to as "second random number") "r". Note that the second random number is a random number different from the first random number.

In step S403, the first information processing apparatus 11 substitutes the coefficient "g" and the second random number "r" into the public key calculation formula to determine a value (hereinafter referred to as "first calculated value") "x". to calculate Specifically, the first calculated value "x" is calculated by the following formula (4).

x= ^gr (4)

Equation (4) above is the public key calculation equation shown in Equation (3) above. Therefore, the above equation (4) uses the same coefficient "g" for calculation. On the other hand, in the above equation (4), the second random number "r" is substituted for the exponent. Thus, by calculating the power of the coefficient "g" and the second random number "r", the first information processing device 11 calculates the first calculated value "x".

In step S<b>404 , the first information processing device 11 transmits the first calculated value “x” to the third information processing device 13 . Therefore, the third information processing device 13 can grasp the first calculated value "x" and use it for subsequent calculations.

In step S405, the first information processing device 11 uses the order "q" determined from the second random number "r", the first identification information "s", the first random number "c", and the coefficient "g". A value (hereinafter referred to as "second calculated value") "y" is calculated. Specifically, in step S405, the first information processing device 11 calculates the second calculated value "y" using the following equation (5).

y=r+s×c mod q (5)

In the above equation (5), the order "q" is the order of the coefficient "g". That is, the order "q" is the smallest value among the natural numbers that become the identity when the coefficient "g" is raised to the power of the order "q". Therefore, the order "q" is a value determined by calculation from the coefficient "g".

In step S<b>406 , the first information processing device 11 transmits the second calculated value “y” to the third information processing device 13 . Therefore, the third information processing device 13 can grasp the second calculated value "y" and use it for subsequent calculations.

In step S407, when the third information processing apparatus 13 receives the second calculated value "y", it substitutes the coefficient "g" and the second calculated value "y" into the public key calculation formula to obtain a value (hereinafter " (referred to as "third calculated value"). Specifically, the third calculated value is a value obtained by calculating the left side of the following equation (6).

In step S408, when the third information processing device 13 receives the first calculated value "x", it uses the first calculated value "x", the public key "h", and the first random number "c" to generate a value ( hereinafter referred to as "fourth calculated value").

g ^y = x×h ^c (6)

A step S407 calculates the left side of the above equation (6), that is, the third calculated value. First, the left side of the above equation (6) is the public key calculation formula shown in the above equation (3), and the coefficient "g" is the same. Then, the second calculated value "y" used for calculating the third calculated value is transmitted in step S406.

A step S408 calculates the right side of the above equation (6), that is, the fourth calculated value. First, the first calculated value "x" on the right side of the above equation (6) is transmitted in step S404. The fourth calculated value is calculated by multiplying the first calculated value 'x' by 'h ^c '. It should be noted that the public key "h" is determined by the disclosure of the above equation (3). Therefore, 'h ^c ' is determined by the first random number 'c' and the public key 'h'.

In step S409, the third information processing device 13 compares the third calculated value and the fourth calculated value. Specifically, the third information processing device 13 determines whether or not the third calculated value and the fourth calculated value match, that is, whether or not “=” in the above formula (6) holds. do.

If the secret information "s" held by the first information processing device 11 (in this example, it is the first identification information) is information shared with the third information processing device 13 in advance, that is, the first information processing If the device 11 knows the secret information "s", "=" in the above equation (6) is established. The determination is proved below.

In this example, the first random number 'c' is either '1' or '0', so the cases of 'c=0' and 'c=1' are separately demonstrated below.

When "c=0", the second calculated value "y" is "y=r" according to the above equation (5). Therefore, in the calculation of the above equation (6), the left side is “g ^y ”=“g ^r ”. Then, based on the above equation (4), “g ^r ”=“x”.

On the other hand, in the calculation of the above equation (6), since the right side is "c=0", " ^hc " is " ^hc = ^h0 =1". Therefore, the right side of the above equation (6) is "x×h ^c =x×1=x". Therefore, in the above equation (6), "left side=right side" holds.

When "c=1", the second calculated value "y" is "y=r+s" according to the above equation (5). Therefore, in the calculation of the above equation (6), the left side is "g ^y "="g ^r+s ". And "g ^r+s " is "g ^r ×g ^s ".

On the other hand, the calculation of the above equation (6) is "x×h ^c =x×h" because the right side is "c=1". Furthermore, based on the above equation (4), “x”=“g ^r ”. Next, based on the above equation (3), if "A=s" (that is, if the first information processing device 11 knows the secret information "s"), then "h=g ^A =g ^s ”. Therefore, the right-hand side is "g ^r ×g ^s ". Therefore, in the above equation (6), "left side=right side" holds.

As shown in FIG. 5, the disclosure of equation (3) above, steps S401, S404, and S406 do not include the secret information 's'. That is, even if information (including unauthorized information acquisition) and information such as a public key are obtained between the first information processing device 11 and the third information processing device 13, the secret information " s" is difficult to identify.

In this way, even if the third information processing device 13 cannot directly transmit the secret information "s" from the first information processing device 11, the third information processing device 13 determines whether or not to store the secret information "s". The processing device 11 can be authenticated.

If information can be obtained illegally by eavesdropping or man-in-the-middle attack between the first information processing device 11 and the third information processing device 13, sending and receiving information such as secret information "s" Information such as confidential information “s” may be leaked. On the other hand, as shown in FIG. 5, the first information processing apparatus 11 can be authenticated without transmitting/receiving information such as secret information "s" between the first information processing apparatus 11 and the third information processing apparatus 13. and further improve security.

As described above, it is desirable that interactive zero-knowledge proof (ZKPOK, Zero-Knowledge Proof Of Knowledge) is used for authentication. With such authentication, it is possible to prevent "spoofing" and the like, and to prevent leakage of confidential information.

[Example of non-interactive processing]
FIG. 6 is a diagram illustrating an example of non-interactive authentication processing. In the following description, as in FIG. 5, an example in which the first information processing apparatus 11 shown on the left side of the figure is to be authenticated will be described.

Before performing authentication, two values (hereinafter referred to as "first shared value" and "second shared value") are exchanged between first information processing device 11 and third information processing device 13, and share functions (hereinafter referred to as "shared functions").

Hereinafter, let the first shared value be “P” and the second shared value be “Q”. Further, the shared function is a hash function and is denoted as "Hash( )". An argument of the hash function is in "brackets ( )" following "Hash( )". Note that the shared function may be any function that calculates a specific calculation result for the argument.

Sharing may also be in the form of public disclosure. For example, the second shared value 'Q' may be a public key or the like.

The first shared value 'P' and the second shared value 'Q' are values having a certain relationship. Hereinafter, the expression indicating the relationship between the first shared value "P" and the second shared value "Q" will be referred to as "relational expression". For example, the relational expression is "Q=qP". Then, the secret information "s" is substituted for the constant "q" in the relational expression.

Authentication is determined by whether or not the first information processing device 11 stores the secret information "s", as in FIG. Hereinafter, as in FIG. 5, the secret information "s" is used as the first identification information. Therefore, the third information processing device 13 grasps the first identification information in advance by preprocessing or the like. Therefore, the third information processing device 13 authenticates the first information processing device 11 based on whether or not the secret information “s” stored by the first information processing device 11 matches the first identification information.

In step S501, the first information processing device 11 generates a random number (hereinafter referred to as "third random number") "m". It should be noted that the third random number "m" is desirably a temporary value that differs for each authentication. Using a different third random number "m" for each authentication in this way improves security because the usable period is fixed like a so-called one-time password. For example, countermeasures can be taken against unauthorized access such as session hijacking, and security can be improved.

In step S502, the first information processing device 11 multiplies the third random number "m" and the first shared value "P" to calculate a value (hereinafter referred to as "fifth calculated value") "R". . Specifically, in step S502, the first information processing device 11 calculates the fifth calculated value "R" by the following equation (7).

R = m x P (7)

As shown in the above equation (7), the fifth calculated value "R" is calculated based on the third random number "m". If the third random number "m" is set to a temporary value, the fifth calculated value "R", which is the multiplication result, can also be set to a temporary value, and the usable period is constant, thereby improving security.

In step S<b>503 , the first information processing device 11 transmits the fifth calculated value “R” to the third information processing device 13 . Therefore, the third information processing device 13 can grasp the fifth calculated value "R" and use it for subsequent calculations.

Also, the fifth calculated value “R” is information transmitted and received between the first information processing device 11 and the third information processing device 13 as in step S<b>503 . Therefore, it is desirable to prevent information leakage even if the fifth calculated value "R" is illegally obtained by eavesdropping or the like by setting the third random number "m" to a temporary value.

In step S504, the first information processing device 11 uses a shared function "Hash( )" whose arguments are the first shared value "P", the second shared value "Q", and the fifth calculated value "R". A value (hereinafter referred to as a "sixth calculated value") "b" is calculated. Specifically, in step S504, the first information processing device 11 calculates the sixth calculated value "b" using the following equation (8).

b=Hash(P, Q, R) (8)

In calculating the above formula (8), the shared function "Hash()", which is the calculation formula, and the first shared value "P" and the second shared value "Q" as arguments are shared in advance. be done. Additionally, a fifth calculated value 'R' is calculated in step S502.

In step S505, the first information processing apparatus 11 uses the third random number "m", the secret information "s" which is the first identification information, and the sixth calculated value "b" (hereinafter referred to as "seventh calculation value”) to calculate “k”. Specifically, in step S505, the first information processing device 11 calculates the seventh calculated value "k" using the following equation (9).

k=m+s×b (9)

As shown in the above equation (9), the seventh calculated value "k" is calculated based on the third random number "m". If the third random number "m" is set to a temporary value, the seventh calculated value "k", which is the result of multiplication, can also be set to a temporary value, and the usable period is constant, thereby improving security.

In step S<b>506 , the first information processing device 11 transmits the seventh calculated value “k” to the third information processing device 13 . Therefore, the third information processing device 13 can grasp the seventh calculated value "k" and use it for subsequent calculations.

Also, the seventh calculated value “k” is information transmitted and received between the first information processing apparatus 11 and the third information processing apparatus 13 as in step S<b>506 . Therefore, it is desirable to set the third random number "m" to a temporary value so as to prevent information leakage even if the seventh calculated value "k" is illegally obtained by eavesdropping or the like.

In step S507, when the third information processing device 13 receives the fifth calculated value "R", it takes the first shared value "P", the second shared value "Q", and the fifth calculated value "R" as arguments. , the value (hereinafter referred to as the "eighth calculated value") "j" is calculated using the shared function "Hash()". Specifically, in step S507, the third information processing device 13 calculates the eighth calculated value "j" using the following equation (10).

j=Hash(P, Q, R) (10)

The above expression (10) is the same shared function "Hash( )" as the above expression (8), and calculation of arguments. Therefore, in step S507, the third information processing device 13 does not directly acquire the sixth calculated value "b" from the first information processing device 11, but obtains the same calculation result as the sixth calculated value "b" as the eighth calculated value. "j" can be calculated and grasped.

In step S508, when the third information processing device 13 receives the seventh calculated value "k", it multiplies the seventh calculated value "k" and the first shared value "P" to obtain a value (hereinafter referred to as "9th (referred to as "calculated value"). Calculate "F". Specifically, in step S508, the third information processing device 13 calculates the ninth calculated value "F" using the following equation (11).

F=k×P (11)

In the above equation (11), the seventh calculated value “k” is acquired from the first information processing device 11 . Also, the first shared value 'P' is shared in advance.

In step S509, the third information processing device 13 uses the fifth calculated value "R", the eighth calculated value "j", and the second shared value "Q" to obtain a value (hereinafter referred to as "tenth calculated value"). .) Compute "L". Specifically, in step S509, the third information processing device 13 calculates the tenth calculated value "L" by the following equation (12).

L=R+j×Q (12)

In the above equation (12), the fifth calculated value "R" is acquired in step S503. Also, the second shared value 'Q' is shared in advance. Further, an eighth calculated value 'j' is calculated by step S507.

In step S<b>510 , the third information processing device 13 compares the ninth calculated value “F” and the tenth calculated value “L” to authenticate whether it is the first information processing device 11 . That is, in step S510, the third information processing device 13 performs authentication by determining whether the following formula (13) holds.

F = L (13)

When the above formula (13) holds, the third information processing device 13 authenticates that the information processing device that has transmitted the request is the first information processing device 11 . On the other hand, if the above formula (13) does not hold, the third information processing device 13 determines that the information processing device that has sent the request is not the first information processing device 11 (there is a possibility of "spoofing" or the like). do.

If the secret information “s” held by the first information processing device 11 (in this example, it is the first identification information) is information shared with the third information processing device 13 in advance, that is, the first information processing If the device 11 knows the secret information "s", "=" in the above equation (13) is established. The determination is proved below.

The left side in the above equation (13) is the ninth calculated value "F" calculated by the above equation (11). Therefore, based on the above equation (11), the left side is "F=k×P". Next, "k" is "k=m+s×b" based on the above equation (9). Therefore, the left side is "F=k*P=(m+s*b)*P=mP+b*sP".

On the other hand, the right side in the above equation (13) is the tenth calculated value "L" calculated by the above equation (12). Therefore, based on the above equation (12), the right side is "L=R+j×Q". Next, based on the above formula (7), "R=m×P". Therefore, the right side is "L=R+j*Q=(m*P)+j*Q=mP+j*Q".

Based on the above formula (8) and the above (10), "j=b". Therefore, since the above equation (13) is "mP+b*sP=mP+j*Q", it is established that "sP=Q". Then, based on the relational expression, "Q=qP". Therefore, if the secret information "s" can be substituted for the constant "q", the above equation (13) holds. That is, if the secret information "s" (in this example, it is the first identification information) is known, the above equation (13) holds, so the third information processing device 13 uses the above equation (13) can be authenticated by determining whether or not

In this way, even if the third information processing device 13 cannot directly transmit the secret information "s" from the first information processing device 11, the third information processing device 13 determines whether or not to store the secret information "s". The processing device 11 can be authenticated.

If information can be obtained illegally by eavesdropping or man-in-the-middle attack between the first information processing device 11 and the third information processing device 13, sending and receiving information such as secret information "s" Information such as confidential information “s” may be leaked. On the other hand, as shown in FIG. 5, the first information processing apparatus 11 can be authenticated without transmitting/receiving information such as secret information "s" between the first information processing apparatus 11 and the third information processing apparatus 13. and further improve security.

Furthermore, compared to the interactive type shown in FIG. 5, the non-interactive type shown in FIG. Therefore, non-interactive authentication can reduce the amount of communication between the first information processing device 11 and the third information processing device 13 . Furthermore, information leaked from communication between the first information processing device 11 and the third information processing device 13 can be reduced.

As described above, it is more desirable to use non-interactive zero-knowledge proof (NIZK) and Schnorr signature for authentication. With such authentication, it is possible to prevent "spoofing" and the like, and to prevent leakage of confidential information. In addition, non-interactive allows for less communication.

Note that each procedure in the interactive processing example and the non-interactive processing example does not have to be in the order shown in the above examples. That is, after the values used in each procedure have been acquired, each procedure may be executed in sequence, redundantly, or in parallel.

Also, as described above, if the authentication or the like is such that the secret information "s" cannot be directly transmitted, security can be improved against attacks such as the following, for example.

FIG. 7 is a diagram showing an example of an attack. For example, the attacker 18 operates the attacker terminal 17 to illegally acquire information between the first information processing device 11 and the third information processing device 13, or illegally acquires information from the first information processing device 11. may perform attacks such as accessing

When such an attack is made, the aggressor terminal 17 may be able to acquire the first identification information "ID ₁ " and the like. If such information is illegally obtained, the seed "S _d " and other information is likely to be leaked.

When the attacker 18 can identify the seed "S _d ", for example, he attacks to tamper with the seed "S _d ". Specifically, the attacker terminal 17 acquires the seed “S _d ” and performs “XOR” on any “1” of the bits forming the seed “S _d ”. In this way, the attacker terminal 17 modifies all or part of the seed "S _d " to a different value by some calculation. When such falsification is performed, the first information processing device 11 and the second information processing device 12 acquire different seeds "S _d ". Therefore, the same key cannot be shared, and it becomes difficult to encrypt and communicate using the common key method. In this way, the attacker 18 attacks such as obstructing communication. Therefore, if the leakage of information such as the first identification information “ID ₁ ” can be reduced, security can be improved.

On the other hand, if secret information such as "s" is not directly communicated, the possibility of receiving such an attack can be reduced, and security can be improved.

[Modified example of authentication processing using shared information]
The information processing system 1 may perform authentication processing using the shared information (both interactive and non-interactive) with the following configuration. A case where authentication is performed between the first information processing apparatus 11 and the third information processing apparatus 13 will be described below as an example. However, the configuration described below may be applied to authentication between other devices.

[First modification]
FIG. 8 is a diagram showing a first modified example of authentication processing using shared information. When compared with the interactive and non-interactive examples described above, the first modification further includes an information processing device (hereinafter " ) is used.

In the first modification, the fifth information processing device 19 also authenticates the first information processing device 11 .

In advance, the third information processing device 13 and the fifth information processing device 19 use the first identification information (secret information “s”), the first shared value “P”, or the shared function used for authentication. Share "Hash()" and so on.

Then, the fifth information processing device 19 authenticates the first information processing device 11 separately from the third information processing device 13 in parallel or before or after the authentication by the third information processing device 13 .

The fifth information processing device 19 uses a random number different from the authentication by the third information processing device 13 (specifically, the first random number "c", the third random number "m", etc.), etc. Authenticate.

In this way, it is more desirable for the information processing system 1 to redundantly perform authentication using a plurality of information processing apparatuses. If even one of the authentications performed redundantly cannot be authenticated, the information processing system 1 as a whole may assume that the first information processing apparatus 11 is being "spoofed" or the like. judge.

In this way, the information processing system 1 can prevent fraud such as "spoofing" and improve security by redundantly performing authentication with a plurality of information processing apparatuses.

A plurality of fifth information processing apparatuses 19 may be provided. Further, the fifth information processing device 19 or the third information processing device 13 may further perform authentication a plurality of times.

[Second modification]
FIG. 9 is a diagram showing a second modified example of authentication processing using shared information. Compared with the first modification, the second modification has the same configuration as the first modification in which the fifth information processing device 19 is used.

In the second modification, the first information processing device 11 and the third information processing device 13 transmit and receive data or share information via the fifth information processing device 19 . Specifically, step S401, step S404, step S406, step S503, step S506, the first shared value "P", the shared function "Hash( )", or a combination of these, etc., are performed by the fifth information processing device 19. Data is transmitted/received or shared through the

In this way, the number of direct transmission/reception or sharing of data between devices performing authentication is reduced. Instead, the information processing system 1 performs data transmission/reception, information sharing, or the like through a separate communication path via an information processing apparatus different from the apparatus that performs authentication and the apparatus to be authenticated. In this way, with a configuration in which another information processing device is interposed, it is possible to prevent information from being leaked and improve security even if fraud such as eavesdropping occurs between authentication devices.

Note that the number of information processing devices that intervene between the first information processing device 11 and the third information processing device 13 is not limited to one. That is, the fifth information processing device 19 may be plural. In this manner, data transmission/reception, information sharing, or the like may be performed via a plurality of information processing apparatuses.

[Other authentication processing examples]
Alternatively, authentication may utilize, for example, identification (ID), password, IP address, geolocation, callback, biometrics, or a combination thereof.

[Example of functional configuration]
FIG. 10 is a diagram illustrating a functional configuration example. For example, the information processing system 1 has a first information processing device 11 , a second information processing device 12 and a third information processing device 13 . In addition, the information processing system 1 is always or temporarily connected to the fourth information processing device 14 and the like.

Note that the information processing system 1 does not always have to include the fourth information processing device 14 and the like. That is, the first information processing device 11, the second information processing device 12, or the third information processing device 13 may be connected only when communicating with the fourth information processing device .

The first information processing device 11 has, for example, a functional configuration including a first identification information storage unit 1F1, a request unit 1F2, a communication unit 1F12, and the like.

The second information processing device 12 has, for example, a functional configuration including a permission unit 1F5, a communication unit 1F12, and the like.

The third information processing device 13 includes, for example, a first identification information acquisition unit 1F3, a notification unit 1F4, a response reception unit 1F6, a seed generation unit 1F7, a first transmission data generation unit 1F8, a first transmission data transmission unit 1F9, a second It is a functional configuration including a transmission data generation unit 1F10, a second transmission data transmission unit 1F11, and the like.

The fourth information processing device 14 has, for example, the user information 16 and the like in advance. Note that the fourth information processing device 14 may manage, generate, and transmit the first identification information and the like in response to a request.

In the information processing system 1, for example, it is desirable that the third information processing device 13 further includes an authentication unit 1F13, a sharing unit 1F14, and the like.

The first identification information storage unit 1F1 performs a first identification information storage procedure for storing the first identification information. For example, the first identification information storage unit 1F1 is realized by the storage device 11H2 or the like.

The request unit 1F2 performs a request procedure for transmitting a service request from the second information processing device 12 to the third information processing device 13 . For example, the request part 1F2 is realized by the interface 11H3 or the like.

The first identification information acquisition unit 1F3 performs a first identification information acquisition procedure for acquiring the first identification information. For example, the first identification information acquisition unit 1F3 is realized by the interface 11H3 or the like.

Upon receiving the request from the first information processing apparatus 11, the notification unit 1F4 performs a notification procedure of inquiring whether or not to permit the request to the second information processing apparatus 12. FIG. For example, the notification unit 1F4 is realized by the interface 11H3 or the like.

Upon receiving the notification from the notification unit 1F4 from the third information processing device 13, the permission unit 1F5 performs a permission procedure of sending a response to the third information processing device 13 to permit the request if the notification is permitted. For example, the permitting unit 1F5 is realized by the interface 11H3 or the like. Note that the permitting unit 1F5 may determine whether to permit or reject based on the result of a check by authentication of the first information processing device 11 or the third information processing device 13 or the like.

The response reception unit 1F6 performs a response reception procedure for receiving a response to the notification from the second information processing device 12. FIG. For example, the reply receiving unit 1F6 is realized by the interface 11H3 or the like.

The seed generation unit 1F7 performs a seed generation procedure for generating basic information of a key or a seed indicating a key. For example, the seed generation unit 1F7 is realized by the CPU 11H1 or the like.

When the request is permitted by the reply received by the reply receiving unit 1F6, the first transmission data generating unit 1F8 uses the seed, the first shared information, the time information, the first identification information, and the first communication information. A first transmission data generating procedure for generating 1 transmission data is performed. For example, the first transmission data generator 1F8 is implemented by the CPU 11H1 or the like.

The first transmission data transmission unit 1F9 performs a first transmission data transmission procedure for transmitting the first transmission data to the first information processing device 11. FIG. For example, the first transmission data transmission unit 1F9 is realized by the interface 11H3 or the like.

The second transmission data generation unit 1F10 performs a second transmission data generation procedure for generating second transmission data including a seed when the request is permitted by the response received by the response reception unit 1F6. For example, the second transmission data generator 1F10 is realized by the CPU 11H1 or the like.

The second transmission data transmission unit 1F11 performs a second transmission data transmission procedure for transmitting the second transmission data to the second information processing device 12 . For example, the second transmission data transmission unit 1F11 is realized by the interface 11H3 or the like.

The communication unit 1F12 first extracts a seed from the first transmission data or the second transmission data to generate a key. Next, the communication unit 1F12 performs a communication procedure for encrypting and communicating using a key. For example, the communication unit 1F12 is realized by the interface 11H3 or the like.

Specifically, the communication unit 1F12 included in the first information processing device 11 extracts the seed from the first transmission data, generates a key, and uses the key to encrypt or decrypt data to be transmitted to and received from the second information processing device 12. Then, the first communication procedure is performed to perform communication. Similarly, the communication unit 1F12 included in the second information processing device 12 extracts the seed from the second transmission data, generates a key, and encrypts or decrypts data to be transmitted to and received from the first information processing device 11 using the key. A second communication procedure for communicating is performed.

The authentication unit 1F13 performs an authentication procedure for authenticating the first information processing device 11 and the like. For example, the authentication unit 1F13 is realized by the interface 11H3 or the like.

The sharing unit 1F14 stores, for example, first shared information, time information, first communication information, second shared information, second identification information, second communication information, public key, public key calculation formula, random number, coefficient, or Share information such as information on combinations of For example, the shared unit 1F14 is realized by the interface 11H3 or the like.

Note that the functional configuration is not limited to the illustrated configuration. That is, each configuration may be partly or wholly in another information processing apparatus. For example, the shared unit 1F14 may be included in another information processing apparatus. Therefore, information sharing may be performed by other information processing devices. Specifically, the shared unit 1F14 may be included in the first information processing apparatus 11 or the like.

The same applies to the authentication unit 1F13 and the like. Therefore, the authentication may be performed mainly by another information processing apparatus.

[Sharing example]
Information such as first shared information, time information, first communication information, second shared information, second identification information, second communication information, public keys, public key calculation formulas, random numbers, and coefficients, for example, is public, Or share by request.

Specifically, when the information to be shared is made public, when the information processing apparatus that makes the information public is accessed, the accessed information processing apparatus can obtain the information.

When a request is made to an information processing device that holds information, the information is returned in response to the request. In this way, the requesting information processing device can acquire the information.

When sharing information, an information processing apparatus that attempts to acquire information may be checked for authentication or the like. Moreover, in sharing, the information may be partially or processed into other information and shared. In other words, the information processing apparatus that has shared the information can acquire the information from part or other information by performing a predetermined process or the like.

Furthermore, sharing does not have to be realized only by communication. That is, sharing may be realized by inputting data in a recording medium or the like, or by verbally conveying information to the user and inputting the information by the user.

[Second embodiment]
The second embodiment differs from the first embodiment in information sharing. In the following, different points will be mainly described, and descriptions of the same contents as in the first embodiment will be omitted.

A case where the first identification information “ID ₁ ” is shared between the first information processing device 11 and the third information processing device 13 will be described below as an example.

For example, it is desirable to manage the first identification information “ID ₁ ” as follows.

FIG. 11 is a diagram showing an example of distributing information in the second embodiment. An example in which the first identification information “ID ₁ ” stored by the first information processing device 11 is shared will be described below.

In the second embodiment, the first information processing device 11 transmits the first identification information "ID ₁ " to the device group 20, and the device group 20 manages the first identification information "ID ₁ ". Therefore, the third information processing device 13 and the like request the device group 20 to acquire the first identification information “ID ₁ ”.

The device group 20 is a plurality of information processing devices. Hereinafter, "N units" of "information processing apparatus 200", "information processing apparatus 210" to "information processing apparatus 2N0" ("N" is a natural number indicating the number of information processing apparatuses) will be described. An example of configuring the group 20 will be described.

Further, in the following example, it is assumed that the information processing device 200 receives a request to the device group 20 . However, unlike the information processing device 200, there may be no information processing device serving as a window. For example, when the third information processing device 13 or the like makes a request to the device group 20, the request may be made to one of the "information processing device 210" to the "information processing device 2N0", or the block A chain or the like may be used.

The device group 20 distributes and manages the first identification information “ID ₁ ”. Therefore, when the device group 20 receives the first identification information "ID ₁ ", the device group 20 distributes and manages the first identification information "ID ₁ " in a plurality of information processing devices (hereinafter referred to as "distributed information"). ).

For example, in the device group 20, first, the information processing device 200 receives the first identification information “ID ₁ ” and generates distributed information. Next, when the distributed information is generated, the information processing device 200 distributes the distributed information so that the information is distributed to the information processing devices 210 to 2N0 (the information processing device 200 may be included). to send.

FIG. 12 is a diagram showing an example of distributed information.

The distributed information is, for example, information obtained by dividing the first identification information “ID ₁ ” into small information amounts. For example, the distributed information is information obtained by dividing the first identification information "ID ₁ " into bit units. Specifically, it is assumed that the first identification information “ID ₁ ” has an information amount of 1 byte (byte), that is, 8 bits (bit). Hereinafter, it is assumed that the device group 20 is composed of four information processing devices 210 to 240 (that is, “N=4”).

The first identification information “ID ₁ ” is, for example, “11110000”. Then, the device group 20 divides four pieces of shared information (hereinafter referred to as "first shared information 20D1", "second shared information 20D2", "third shared information 20D3", and "fourth shared information 20D4") for each 2 bits. ) and managed.

The first distributed information 20D1 is information obtained by dividing the information of the first bit and the second bit from the top of the first identification information “ID ₁ ”.

The second distributed information 20D2 is information obtained by dividing the third and fourth bits from the first identification information "ID ₁ ".

The third distributed information 20D3 is information obtained by dividing the information of the fifth and sixth bits from the first identification information "ID ₁ ".

The fourth distributed information 20D4 is information obtained by dividing the information of the 7th and 8th bits from the first identification information "ID ₁ ".

In this example, the shared information is generated by dividing the first identification information “ID ₁ ” into 2 bits. That is, each distributed information is information indicating a part of the first identification information "ID ₁ ".

In this manner, each information processing device of the device group 20 separately manages distributed information.

When the information processing device 200 is requested to acquire the first identification information “ID ₁ ”, the information processing device 200 acquires distributed information from the information processing device 200 and the information processing devices 210 to 2N0. Therefore, the information processing apparatus 200 synthesizes distributed information.

Specifically, the information processing device 200 acquires four pieces of distributed information. Thus, when the shared information is acquired, the information processing device 200 can combine the four pieces of shared information to generate the first identification information “ID ₁ ”.

For example, the information processing device 200 acquires the first distributed information 20D1, the second distributed information 20D2, the third distributed information 20D3, and the fourth distributed information 20D4 from the information processing devices 210 to 240. FIG. Then, the information processing apparatus 200 synthesizes the shared information by combining the first shared information 20D1, the second shared information 20D2, the third shared information 20D3, and the fourth shared information 20D4 in order from the top. By synthesizing in this way, the information processing apparatus 200 can generate the first identification information “ID ₁ ” of “11110000” from the distributed information. Therefore, the information processing apparatus 200 can transmit the first identification information "ID ₁ " to the third information processing apparatus 13 or the like that requests acquisition of the first identification information "ID ₁ ".

With such distributed information, the information processing system 1 can reduce the amount of information managed by each information processing device.

Note that the distributed information does not have to have a uniform amount of information. In other words, the information processing devices constituting the device group 20 may not manage the same amount of distributed information, but the information amount of the distributed information to be managed may be biased.

Distributed information is not limited to dividing information into small pieces of information. For example, distributed information may be a combination of encrypted information and key information (each piece of information may be divided into smaller pieces).

Further, it is not necessarily the information processing apparatus 200 that generates the distributed information, that is, includes the distributed information generation unit 1F15. For example, the distributed information generator 1F15 may be provided in the first information processing device 11 or the like.

With such distributed information, even if the encrypted information can be obtained by some method, it is difficult to obtain the first identification information “ID ₁ ” without the key.

That is, even if part of the distributed information is obtained illegally, if it is difficult to obtain the first identification information “ID ₁ ” as a whole, the distributed information has a format and information Any amount is acceptable.

It is desirable that the device group 20 is specified by, for example, an information processing device configured by Software-Defined anything (hereinafter referred to as “SDx”) or the like as follows.

FIG. 13 is a diagram showing an example of specifying a group of devices by SDx. For example, as shown in FIG. 12, the case where the first identification information "ID ₁ " has an information amount of 8 bits and is dispersed every 2 bits is taken as an example.

SDx is, for example, a process of specifying the information processing devices 210 to 240 among the N information processing devices in the device group 20 .

As in SDx, if the information processing devices 210 to 240 to be used are specified according to the number of pieces of distributed information, hardware resources such as information processing devices can be efficiently utilized. In addition, by flexibly changing the information processing device to be managed by SDx, it is possible to prevent illegal acquisition of information and improve security more than when the information processing device that manages distributed information is fixed. .

Alternatively, it is desirable that the device group 20 is specified by, for example, an information processing device configured by a Domain Name System (hereinafter referred to as "DNS").

FIG. 14 is a diagram showing an example of specifying a group of devices by DNS. That is, it is desirable for the device group 20 to specify an information processing device constituted by information in the Uniform Resource Locator format (hereinafter simply referred to as “URL”) or the like.

An example in which the URL is "www.aaa.co.jp" will be described below.

For example, the information processing device 200 becomes a DNS server in DNS. First, the first information processing device 11 makes an inquiry to the information processing device 200 using a URL.

When a URL-based inquiry is made, the information processing device 200 makes an inquiry to the root server 300 .

When the root server 300 is queried by DNS, the information processing device is specified by the URL. In this example, the servers responsible for "jp", "co", and "aaa" are specified.

For example, using DNS, the information processing system 1 may configure the device group 20 by specifying a plurality of information processing devices such as the information processing devices 210 to 230 . However, the information processing devices constituting the device group 20 may be information processing devices other than the servers responsible for "jp", "co", and "aaa". For example, when the servers responsible for "jp", "co", and "aaa" are specified, they specify different information processing devices so that they form the device group 20. may

Note that a cache in DNS may be used to specify the device group by DNS.

In this way, when DNS is used, it is possible to flexibly designate the number of information processing apparatuses by URL.

In this way, if the information such as the first identification information "ID ₁ " is distributed and managed, even if part of the information is leaked, only a part of the first identification information "ID ₁ " can be grasped. It can be difficult to grasp the entirety of the identification information "ID ₁ ". In this way, the information processing system 1 can prevent the first identification information “ID ₁ ” from being leaked and improve security.

In addition, in the second embodiment, the target information is not limited to the first identification information "ID ₁ ". That is, the information may be information other than the first identification information "ID ₁ ". For example, the second identification information “ID ₂ ” or the like may be targeted.

Specifically, the second identification information “ID ₂ ” is used by the third information processing device 13 when, for example, the third information processing device 13 generates the second transmission data. Alternatively, the second identification information “ID ₂ ” is used by the third information processing device 13 when, for example, the third information processing device 13 authenticates the second information processing device 12 . In such a case, the third information processing device 13 may use the sharing method or the like described in the second embodiment.

[Example of man-in-the-middle attack]
FIG. 15 is a diagram illustrating an example of a man-in-the-middle attack. For example, in a man-in-the-middle attack, the attacker 18 operates the attacker terminal 17, and the attacker terminal 17 illegally acquires data transmitted and received between the first information processing device 11 and the second information processing device 12. It is a process to connect so that it can be done.

It is assumed that the first information processing apparatus 11, the second information processing apparatus 12, and the like cannot recognize that the attacker terminal 17 is connected or is being connected.

After such a man-in-the-middle attack, the data transmitted/received between the first information processing device 11 and the second information processing device 12 is transmitted/received via the attacker's terminal 17 . Then, the first information processing device 11, the second information processing device 12, and the like determine that data transmission/reception has been successfully completed unless falsification of data, deletion of data, or the like occurs.

Therefore, the first information processing device 11, the second information processing device 12, and the like may not be able to grasp unauthorized acquisition of information by a man-in-the-middle attack.

Therefore, when the data encrypted by the common key method is to be transmitted and received between the first information processing device 11 and the second information processing device 12, the key is transferred to the first information processing device 11 and the second information processing device 12. Direct transmission/reception between the two information processing devices 12 may result in unauthorized acquisition of the key through a man-in-the-middle attack. Therefore, it is desirable not to transmit and receive keys directly between the first information processing device 11 and the second information processing device 12 .

According to this embodiment, since the key is not directly transmitted/received between the first information processing device 11 and the second information processing device 12, a Even if a man-in-the-middle attack is performed, it is possible to prevent unauthorized acquisition of the key. Therefore, the information processing system 1 can improve security in communication against unauthorized acquisition of the key.

[Example of attack by “spoofing”]
FIG. 16 is a diagram showing an example of an attack by "spoofing". For example, an attack by “impersonation” is a process in which the attacker 18 operates the attacker terminal 17 to “impersonate” the first information processing device 11 .

The aggressor terminal 17 pretends to be the first information processing device 11 and makes a request or the like. If the request is permitted, the attacker terminal 17 illegally acquires the first transmission data.

Even in such a case, the attacker 18 does not know all of the first identification information, the first shared information, the time information, the first communication information, the hash function, the calculation formula for generating the first transmission data, and the like. Otherwise, it is difficult to extract the seed from the first transmitted data.

Also, if the attacker 18 does not know how to generate the key from the seed, it will be difficult for the attacker 18 to obtain the key.

For example, even if information is illegally acquired by "phishing" or the like, it is often difficult to specify the information such as the seed unless all the information is acquired.

Further, in the case of performing authentication using the first identification information, etc., the attacker 18 is often not authenticated by the third information processing apparatus 13 unless the attacker 18 knows the first identification information.

Furthermore, when the first identification information and the like are managed by distributed information and the like, it is difficult for the attacker 18 to illegally acquire the first identification information and the like.

Therefore, the information processing system 1 can improve security in communication against attacks such as “spoofing” of the first information processing device 11 .

[Other embodiments]
Embodiments may be combinations of the above embodiments.
A key is desirably generated for each communication (for example, in units of sections, or in units of continuous data transmission/reception between the same users). In other words, using a different key for each communication can further improve security.
In the information processing system 1, there is a configuration in which direct authentication is not performed between the first information processing device 11 (including the case where the user 15 is authenticated via the first information processing device 11) and the second information processing device 12. desirable. That is, it is desirable to use a non-interactive zero-knowledge proof or the like between the first information processing device 11 and the second information processing device 12 .
Information about the user 15 (for example, information about the user 15 such as the user information 16) is desirably managed by the fourth information processing device 14 or the like.

The information processing system may be realized by a kernel or the like that constitutes an operating system (OS) in the information processing apparatus. Alternatively, the information processing system may be used for Secure Sockets Layer (SSL), Transport Layer Security (TLS), or the like.

Also, the first identification information and the like may be changed every certain period of time. That is, the first identification information or the like may apply a dynamic specific identity (DSI) or the like that is dynamically switched.

The first information processing device or the like is authenticated by, for example, Open Mobile Alliance-Device Management (OMA-DM), Lightweight Directory Access Protocol (LDAP), or Remote Authentication Dial In User Service (Radius). may be

The first information processing device or the like may be authenticated by an information processing device or the like having functions (AAA) of Authentication, Authorization, and Accounting.

The first identification information or the like may be information specifying hardware or the like. That is, the first identification information or the like may be a physical address or the like. Alternatively, the first identification information or the like may be position information or the like specified by a sensor or the like of the first information processing device.

The present invention is implemented by the information processing method exemplified above or a program (including firmware and programs equivalent thereto; hereinafter simply referred to as "program") that executes processing equivalent to the above-described processing. good too.

That is, the present invention may be realized by a program or the like written in a programming language or the like so as to issue a command to a computer and obtain a predetermined result. Note that the program may be configured such that part of the processing is executed by hardware such as an Integrated Circuit (IC) or an arithmetic unit such as a Graphics Processing Unit (GPU).

The program causes the computer to execute the processes described above by cooperating with the arithmetic device, the control device, the storage device, and the like of the computer. That is, the program is loaded into the main storage device or the like, issues instructions to the arithmetic unit to perform arithmetic operation, and operates the computer.

Also, the program may be provided via a computer-readable recording medium or an electric communication line such as a network.

The present invention may be implemented in a system composed of multiple devices. That is, a system of multiple computers may perform the processes described above redundantly, in parallel, distributed, or any combination thereof. Therefore, the present invention may be realized by devices with hardware configurations other than those shown above, and systems other than those shown above.

In addition, the present invention is not limited to each embodiment illustrated above. Therefore, the present invention can be added or modified without departing from the technical scope. Therefore, all technical matters included in the technical idea described in the claims are covered by the present invention. In addition, embodiment illustrated above is a suitable specific example in implementation. A person skilled in the art can implement various modifications from the disclosed contents, and such modifications are included in the technical scope described in the claims.

1: information processing system 1F1: first identification information storage unit 1F10: second transmission data generation unit 1F11: second transmission data transmission unit 1F12: communication unit 1F13: authentication unit 1F14: sharing unit 1F15: distributed information generation unit 1F2: request Part 1F3: First identification information acquisition part 1F4: Notification part 1F5: Permission part 1F6: Response reception part 1F7: Seed generation part 1F8: First transmission data generation part 1F9: First transmission data transmission part 2N0: Information processing device 11: First information processing device 12 : Second information processing device 13 : Third information processing device 14 : Fourth information processing device 15 : User 16 : User information 17 : Attacker terminal 18 : Attacker 19 : Fifth information processing device 20 : Device group 20D1 : First distributed information 20D2 : Second distributed information 20D3 : Third distributed information 20D4 : Fourth distributed information 200 : Information processing device 210 : Information processing device 230 : Information processing device 240 : Information processing device

Claims (11)

A first information processing device used by a user, a second information processing device connected to the first information processing device, and a third information processing device connected to the first information processing device and the second information processing device. An information processing system,
The first information processing device is
a first identification information storage unit that stores first identification information that identifies the user;
a request unit for transmitting a service request from the second information processing device to the third information processing device;
The third information processing device is
a first identification information acquisition unit that acquires the first identification information;
a notification unit that, when receiving the request from the first information processing device, notifies the second information processing device of whether or not to permit the request;
a response receiving unit that receives a response to the notification from the second information processing device;
a seed generation unit that generates a seed that is basic information of a key;
When the request is permitted by the response, the seed, first shared information shared with the first information processing device, time information determined by communication time with the first information processing device, the first identification information, and a first transmission data generation unit that generates first transmission data using first communication information determined for each communication with the first information processing device;
a first transmission data transmission unit that transmits the first transmission data to the first information processing device;
a second transmission data generation unit that generates second transmission data including the seed when the request is permitted by the reply;
a second transmission data transmission unit that transmits the second transmission data to the second information processing device;
The second information processing device is
a permitting unit that, when receiving the notification from the third information processing device, sends the response permitting the request to the third information processing device when permitting the notification;
The first information processing device and the second information processing device are
An information processing system, each further comprising a communication unit that performs encryption using the key generated by extracting the seed from the first transmission data or the second transmission data and performing communication. The third information processing device is
2. When the permission by the reply is accepted from the second information processing device, the first information processing device determines whether or not the first identification information is stored, and authenticates the first information processing device. The information processing system according to . The first information processing device and the third information processing device,
sharing a public key, a public key calculation formula for calculating the public key, and coefficients constituting the public key calculation formula;
The third information processing device is
a first random number generator that generates a first random number;
a first random number transmission unit that transmits the first random number to the first information processing device;
The first information processing device is
a second random number generator that generates a second random number;
a first calculation unit that calculates a first calculated value determined by substituting the coefficient and the second random number into the public key calculation formula;
a first calculated value transmission unit that transmits the first calculated value to the third information processing device;
a second calculation unit that calculates a second calculated value using an order determined from the second random number, the first identification information, the first random number, and the coefficient;
a second calculated value transmission unit that transmits the second calculated value to the third information processing device;
The third information processing device is
a third calculation unit that, upon receiving the second calculated value, calculates a third calculated value by substituting the coefficient and the second calculated value into the public key calculation formula;
a fourth calculation unit that, upon receiving the first calculated value, calculates a fourth calculated value using the first calculated value, the public key, and the first random number;
3. The information processing system according to claim 2, wherein the third calculated value and the fourth calculated value are compared to authenticate whether or not the information processing device that has transmitted the request is the first information processing device. . The first information processing device and the third information processing device,
sharing a first shared value, a second shared value having a relationship indicated by a relational expression defined by a constant with the first shared value, and a shared function for calculating a specific calculation result for the argument;
The first information processing device is
Substituting the first identification information for the constant,
a third random number generator that generates a third random number;
a fifth calculation unit that calculates a fifth calculated value by multiplying the third random number and the first shared value;
a fifth calculated value transmission unit that transmits the fifth calculated value to the third information processing device;
a sixth calculation unit that calculates a sixth calculated value using the shared function with the first shared value, the second shared value, and the fifth calculated value as the arguments;
a seventh calculation unit that calculates a seventh calculated value using the third random number, the first identification information, and the sixth calculated value;
a seventh calculated value transmission unit that transmits the seventh calculated value to the third information processing device;
The third information processing device is
an eighth calculation unit that, upon receiving the fifth calculated value, calculates an eighth calculated value using the shared function with the first shared value, the second shared value, and the fifth calculated value as the arguments; ,
a ninth calculator that, upon receiving the seventh calculated value, calculates a ninth calculated value by multiplying the seventh calculated value and the first shared value;
a tenth calculation unit that calculates a tenth calculated value using the fifth calculated value, the eighth calculated value, and the second shared value;
3. The information processing system according to claim 2, wherein the ninth calculated value and the tenth calculated value are compared to authenticate whether or not the information processing device that has transmitted the request is the first information processing device. . A device group, which is a plurality of information processing devices,
a distributed information generating unit that uses the second identification information for identifying the second information processing device or the first identification information as distributed information;
Each information processing device that constitutes the device group,
When the acquisition of the first identification information or the second identification information is requested, each of the distributed information is transmitted,
5. The information processing system according to any one of claims 1 to 4, wherein the first identification information or the second identification information is generated by synthesizing the distributed information. The second transmission data generation unit,
The seed, the second shared information shared with the second information processing device, the time information, the second identification information for identifying the second information processing device, and a number determined for each communication with the second information processing device. 6. The information processing system according to any one of claims 1 to 5, wherein the second transmission data is generated using 2 communication information. The first information processing device or the third information processing device,
7. The apparatus according to any one of claims 1 to 6, further comprising a sharing unit for sharing the first shared information, the time information, the first identification information, the first communication information, or a combination thereof with other information processing apparatuses. or the information processing system according to item 1. The first identification information is
User information about the user, or generated using a part of the user information,
8. The information processing system according to any one of claims 1 to 7, which is connected to a fourth information processing device holding said user information. Before sending said request,
The first information processing device is
registering the user information in the fourth information processing device;
The first identification information is
9. The information processing system according to claim 8, which is generated using said user information or part of said user information. A first information processing device used by a user, a second information processing device connected to the first information processing device, and a third information processing device connected to the first information processing device and the second information processing device. An information processing method performed by an information processing system,
a first identification information procedure in which the first information processing device stores first identification information identifying the user;
a request procedure in which the first information processing device transmits a service request by the second information processing device to the third information processing device;
a first identification information obtaining procedure in which the third information processing device obtains the first identification information;
a notification procedure in which, when the third information processing device receives the request from the first information processing device, a notification is sent to the second information processing device to inquire whether or not to permit the request;
a reply receiving procedure for the third information processing device to receive a reply to the notification from the second information processing device;
a seed generation procedure in which the third information processing device generates a seed serving as key basic information;
When the third information processing device permits the request by the reply, time information determined by the seed, the first shared information shared with the first information processing device, and the time of communication with the first information processing device. , a first transmission data generation procedure for generating first transmission data using the first identification information and first communication information determined for each communication with the first information processing device;
a first transmission data transmission procedure in which the third information processing device transmits the first transmission data to the first information processing device;
a second transmission data generation procedure in which the third information processing device generates second transmission data including the seed when the request is permitted by the reply;
a second transmission data transmission procedure in which the third information processing device transmits the second transmission data to the second information processing device;
a permitting step of, when the second information processing device receives the notification from the third information processing device, sending the response permitting the request to the third information processing device when permitting the notification;
Communication in which the first information processing device and the second information processing device encrypt and communicate using the key generated by extracting the seed from the first transmission data or the second transmission data An information processing method comprising: A program for causing a computer to execute the information processing method according to claim 10.

Images