JP4778358B2 - Destination customer protection system, method and program - Google Patents

Description

  The present invention relates to a system for guiding to an electronic network, and in particular, a connected customer protection system for preventing a situation where a mismatch between a service name and an access destination such as phishing is a fatal problem. , Its method and its program.

The primary cause of phishing scams is the user's carelessness. Therefore, it is a story that users should be careful, but phishing scams are a problem related to the foundation of trust in their own business for companies with many general “careless users” as customers. , We need to take some measures to protect our customers. In order to prevent such a phishing scam that has become a major social problem, the following conventional techniques exist.
2. Description of the Related Art Conventionally, announcements for raising attention about phishing scams have been made on advertisements in newspapers, televisions, etc., and their websites. For example, as a countermeasure method for preventing a phishing scam or the like, there is a mechanism that prompts the user to alert the user like the Thunderbird phishing countermeasure. This displays a warning for an email that may be a phishing scam (see, for example, Non-Patent Document 1). Some Web browsers display the link destination URL in an area called a status bar to allow the user to check the link destination URL. In addition, there is a method of introducing a system such as an SSL certificate that can clearly identify a site operating entity.

As an example of a phishing scam prevention technique using an SSL certificate, for example, in a Web browser such as Firefox, whether (1) the SSL certificate is issued from a trusted location, or (2) Check whether the SSL certificate is valid or (3) whether the SSL certificate is issued and the connection destination are in the same domain. A window is opened to call attention.
Mozilla Japan, Mozilla Foundation and Mozilla Corporation, “Thunderbird: Farewell to Spam”, [online], [Search May 1, 2006], Internet <URL: http://www.mozilla-japan.org / products / thunderbird / ＞ Looking for serious dating sites! ! , “Confirmation of one-click fraud Trojan abuse!”, [Online], [Search May 1, 2006], Internet <URL: http://www.majimena-deai.com/akusitusaito/1click /onecliktrojan.html>

However, the SSL certificate does not guarantee that the issued certificate can be trusted in the first place. Certainly, some certificate authorities have a condition for issuing that the SSL certificate is not issued by a fictitious company, but this is not enough. That is, if there is even one certificate authority that is loosely examined, the mechanism of “having an SSL certificate = a trustworthy place” will break down.
Also, in the case of guarantee by SSL certificate, the SSL certificate is sent for the first time after connecting once, and it is verified whether the SSL certificate is valid, and if it is valid, then it is included in the SSL certificate Encrypted communication with the public key. In other words, even if the phishing scam is not completely caught, in the case of guarantee by SSL certificate, if you do not try to connect once, you can not check whether the SSL certificate is valid, the fact that you connected To a malicious phishing site operator. For this reason, even if it is not completely caught by phishing scams, the fact that it is connected is registered, so it is registered in the so-called camolist of phishing scams, and the potential probability of being caught by phishing scams increases was there.

In addition, although it is not a phishing scam as defined, there is also a fraudulent act of collecting email addresses by collecting email addresses because it is necessary for a campaign or service. Even if these fraudulent acts were not connected, we could not confirm that the e-mail address was actually used for the campaign service.
In addition, the display of the URL of the link destination displayed on the status bar can be rewritten to an arbitrary character string using the script language installed in the Web browser, so that the false link destination displayed on the status bar can be changed. There was a problem that a user who believed in the URL was caught by a phishing scam.

  Furthermore, the above-mentioned problem that the connection destination cannot be confirmed unless it is connected once, and the display of the URL of the link destination displayed on the status bar is rewritten to an arbitrary character string. Various problems such as phishing scams, one-click scams, and Trojan horse (virus program) contamination have occurred (see, for example, Non-Patent Document 2).

  According to the present invention, in the connection destination customer protection system including the service providing computer, the guarantee computer, and the communication network connecting the user terminals, the guarantee computer is a combination of the label and the connection destination (hereinafter referred to as valid). And the signature target of the assurance computer is used to create an electronic signature for the signature target. The user terminal verifies the validity of the signature target included in the signed code using the verification computer verification key and the digital signature extracted from the signed code obtained by adding the digital signature to the signature target. Before actually connecting to the connection destination, the user is notified of the signature object whose validity has been confirmed, and allows the user to select whether or not to connect to the connection destination. The service providing computer provides a service to the connected user terminal.

  A third-party certification body can guarantee the connection between a connection destination consisting of numbers, symbols, etc. that can be recognized by a computer, and a label that can be recognized by a human, and before connecting to the connection destination, Since it is possible to confirm whether or not the connection destination is legitimate, it is possible to prevent illegal acts such as phishing scams and one-click scams.

First Embodiment A connected customer protection system according to a first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a diagram illustrating a functional configuration of a connected customer protection system according to the first embodiment of the present invention. FIG. 2 is a diagram illustrating processing of the connected customer protection system according to the first embodiment of the present invention.
[System configuration]
The connected customer protection system according to the first embodiment of the present invention includes, for example, a guarantee computer 10, a service providing computer 20, a user terminal 30, and a communication network 40 as shown in FIG.
The assurance computer 10 includes, for example, a key creation unit 101, a signature key storage unit 102, a verification application creation unit 103, a verification application storage unit 104, a communication unit 105, a signature unit 106, and a barcode generation unit 107.

The service providing computer 20 includes, for example, an application unit 201, a communication unit 202, a signature confirmation unit 203, a printing unit 204, an HTML creation unit 205, and a service providing unit 206.
The user terminal 30 is a PC terminal, a portable terminal, or the like, and includes, for example, a communication unit 301, a verification application storage unit 302, an authentication unit 303, a guidance unit 311, and an input unit 314. The authentication unit 303 includes, for example, a reading unit 304, a data analysis unit 305, and a verification calculation unit 308. The data analysis unit 305 includes an encoding unit 306 and a syntax analysis unit 307, for example. The verification calculation unit 308 includes, for example, a parameter selection unit 310 and a verification unit 309. The guide unit 311 includes, for example, a label display unit 312 and a connection destination guide unit 313.

[Step 1 (S1)]
The key creation unit 101 of the guarantee computer 10 creates a pair of the signature key and the verification key of the guarantee computer 10. The signature key is a private key of the guarantee computer 10 and the verification key is a public key of the guarantee computer 10. The created signature key is stored in the signature key storage unit 102. The created verification key is output to the verification application creation unit 103.
The verification key of the assurance computer is made public so that any computer / terminal can use it. A plurality of pairs of signature keys and verification keys may be created. In this case, each key can be given an ID so that the correspondence between the signature key and the corresponding verification key can be understood.

[Step 2 (S2)]
The verification application creation unit 103 creates a verification application including the verification key output from the key creation unit 101 and stores the verification application in the verification application storage unit 104. The verification application stored in the verification application storage unit 104 is transferred to the user terminal 30 by an arbitrary method.
As will be described later, the verification application is an application for the user terminal 30 to confirm the validity of the label and the connection destination using the electronic signature.

  For example, the user terminal 30 can download the verification application from the communication unit 105 of the assurance computer 10 with strict attention only once by authenticating the assurance computer using SSL communication. . In this case, the communication unit 105 of the guarantee computer 10 reads the verification application from the verification application storage unit 104 after transmitting authentication / confirmation from the user terminal 30 and transmits the verification application to the user terminal 30. The communication unit 301 of the user terminal 30 receives the verification application and stores it in the verification application storage unit 302 of the user terminal 30. When downloading the verification application, the user terminal 30 needs to carefully check whether the download source server is really correct. However, it is not always necessary to check the validity of the verification application and the validity of the download source server every time the electronic signature is verified. That is, once the validity is confirmed, the same verification application may be used for verification of all the electronic signatures issued by the same assurance computer.

  Further, the verification application may be stored in advance in the verification application storage unit 302 of the user terminal 30 when the user terminal 30 is manufactured. Furthermore, the verification application can be transferred to a reliable place such as a support center of the manufacturer of the user terminal 30 or a customer service center managed by a person who provides services using the connected customer protection system. A transfer terminal may be installed, and the verification application may be transferred and stored in the verification application storage unit 302 of the user terminal 30 from the transfer terminal.

[Step 3 (S3)]
The service providing computer 20 applies to the guarantee computer 10 to have a signature for the combination of the label and the connection destination. Specifically, the application unit 201 of the service providing computer 20 creates an application signal including a label and a connection destination, and the communication unit 202 transmits the application signal to the guarantee computer 10.
Here, the label is the name of a service that the service provider plans to provide. In order to obtain trust from the user, a well-known trademark or house mark that has already been established, accumulated and established in business trust may be combined with the name of the service, and this may be used as a label as a whole. For example, if the service provider is A and the new service name is S, “A's Internet service S” is the label.
The connection destination is a terminal that is being serviced by a service provider. In this embodiment, the URL and mail address of the service providing computer 20 are the connection destination.
Hereinafter, the label and the connection destination are collectively referred to as a signature target.

[Step 4 (S4)]
The guarantee computer 10 creates an electronic signature for the combination of the label and the connection destination whose validity has been confirmed. Specifically, the signature unit 106 of the assurance computer 10 creates an electronic signature for the combination of the label and the connection destination whose validity has been confirmed, using the signature key of the assurance computer 10 read from the signature key storage unit 102. .

  For example, when the label is “Internet service S of A” and the connection destination is “abc@def.jp”, the validity of the combination of this label and the connection destination can be confirmed as follows. . After the person who operates the guarantee computer (hereinafter referred to as the guarantor) receives the above application signal, the service provider A describes the service contents and information sufficient to believe that the service provider A is really A. Submitted documents, for example, documents with A's seal certificate. The guarantor has the existence of the service provider A, that is, the service provider A really provides the contents of the service, and the existence of the service S, that is, the service S is the service provider A. Confirm that the contents are as described in the application provided by. After confirming the existence of the service provider A and the service S, the guarantor inputs the combination of the label and the connection destination into the signature unit 106 of the guarantee computer 10.

  Note that a verification key designation part and a process designation part may be included in the target of the electronic signature. The verification key designation part is an area for describing secondary information necessary for signature verification, such as parameters necessary for signature verification, verification key entities, and verification key IDs. The parameter is, for example, public information such as an elliptic curve parameter used in the public key cryptosystem. When the ID of the verification key is described in the verification key designation part, it is necessary to set the ID for each of the plurality of verification keys in advance and include the correspondence between the verification key and the ID in the verification application. .

The process designation portion is an area that designates how to process the relationship between the label and the connection destination. For example, if the connection destination is an e-mail address, specify that an e-mail is to be sent to the e-mail address, and if the connection destination is a URL, specify that the URL is to be connected by a Web browser. Can do.
By describing these pieces of information in the verification key designation part and the process designation part, there is an advantage that, for example, one verification application can be used for a plurality of purposes.

Hereinafter, when there are a verification key designation part and a process designation part, a combination of a label, a connection destination, a verification key designation part, and a process designation part is called a signature target. When there is no verification key designation part and no process designation part, as described above, a combination of a label and a connection destination is called a signature target.
The electronic signature can be performed, for example, by taking a hash value to be signed and encrypting it with the signature key of the guarantee computer 10.

[Step 5 (S5)]
The barcode generation unit 107 of the guarantee computer 10 receives the signature target and the electronic signature from the signature unit 106 and converts them into a barcode such as a QR code (registered trademark). Below, what added the electronic signature to the object of signature is called code with a signature. FIG. 3 illustrates a signed code in the case where there are a verification key designation part and a process designation part. The signed code 500 includes a label portion 502, a connection destination portion 504, a verification key designation portion 506, a process designation portion 508, an electronic signature portion 510, and a free description portion 512 as necessary. Information described in the label portion 502, the connection destination portion 504, the verification key designation portion 506, and the processing designation portion 508 is an electronic signature target, and this electronic signature is described in the electronic signature portion 510. Information described in the free description part is not subject to electronic signature.

The created signed code is transmitted to the service providing computer 20 via the communication unit 105.
When the signature target and the electronic signature are used as a link in an HTML document instead of a barcode, it is not necessary to generate a barcode. In this case, the signature unit 106 transmits the electronic signature or the signature target and the electronic signature to the service providing computer via the communication unit 105. FIG. 4 illustrates a description method when a signed code is used as a link in an HTML document. In this example, first, a connection destination and an electronic signature are described in a tag representing a link, and then a label is described.

[Step 6 (S6)]
The service providing computer 20 confirms whether the signature has been made as requested. After confirming that the signature is applied as requested, the signed code is printed on various media including advertisements and distributed to users.
Specifically, the communication unit 202 of the service providing computer 20 receives the barcode and outputs it to the signature confirmation unit 203. The signature confirmation unit 203 analyzes the barcode received from the communication unit 202 using the verification key of the guarantee computer 10 obtained in advance, and compares the barcode with the content of the signature target applied by the application unit 201. As a result of the comparison, if it can be confirmed that an electronic signature has been created for the same content as the requested signature, the printing unit 204 prints this barcode on an advertisement or the like. An advertisement or the like on which a barcode is printed is distributed to users. Further, the barcode printed by the printing unit 204 may be uploaded as image data to the Web page of the service provider or transmitted to the user using an e-mail.

  When the signed code is used as a link in an HTML document instead of a barcode, the printing unit 204 does not need to print the barcode. In this case, the signature confirmation unit 203 confirms the electronic signature or the signature target and the electronic signature received via the communication unit 202, and then outputs them to the HTML creation unit 205. As shown in FIG. 4, the HTML creating unit 205 creates a link and creates an HTML document including the link. The created HTML document is uploaded to the web page of the service provider or transmitted to the user using e-mail, for example.

[Step 7 (S7)]
The user terminal 30 reads the signed code and verifies the validity of the signature target. Specifically, the reading unit 304 in the authentication unit 303 of the user terminal 30 reads the signed code, and outputs the read data to the encoding unit 306 in the data analysis unit 305. The encoding unit 306 converts the given data so that the parsing unit can process the data by converting the data into a byte string or a bit string. The converted data is output to the syntax analysis unit 307. The parsing unit 307, when there is a label part, a connection destination part, an electronic signature part, and a verification key designation part and a process designation part, in the byte string and bit string data, the verification key designation part, the process designation Divide into parts. The divided byte string and bit string are output to the verification unit 309 in the verification calculation unit 308. The byte string and bit string data relating to the verification key designation part and the process designation part are output to the parameter selection unit 310 in the verification calculation unit 308.

When the signed code is a link described in HTML, the syntax analysis unit 307 can directly divide the signed code without passing through the reading unit 304 and the encoding unit 306.
The parameter selection unit 310 acquires parameter and verification key information necessary for verification from the data of the verification key designation part, the byte string and the bit string related to the process designation part, and outputs them to the verification part 309. The verification unit 309 confirms the validity of the signature target based on the byte string and bit string data subjected to the structural analysis by the syntax analysis unit 307, the information acquired by the parameter selection unit 310, and the verification key of the assurance computer 10. Validate. The verification unit 309 can use a default value when there is no verification key designation part or process designation part in the signed code, or when no information is designated in the verification key designation part or process designation part. For example, when the verification key is not specified in the verification key specification portion, the validity of the signature target is verified using the verification key included in the verification application.

  For example, the validity of the signature target can be verified by comparing whether the hash value for the signature target and the value obtained by decrypting the electronic signature with the verification key of the guarantee computer 10 are the same. The verification unit 309 determines that the signature target is valid if both values are the same, and determines that the signature target is not valid if both values are not the same.

[Step 8 (S8)]
When it is determined that the signature target is valid, the label display unit 312 in the guide unit 311 displays that the signature target is valid and the contents of the signature target, and connects to the connection destination. Let them choose whether to do it. If it is determined that the signature target is not valid, a message indicating that the signature target is not valid and the contents of the signature target are displayed.
The display to the user can be performed not only visually by a method such as displaying on a display but also auditorily by a method such as playing a sound from a speaker.
In this way, before connecting to the connection destination, the user is informed about the validity of the signature target and the content of the signature target including the connection destination information, and it is left to the user's intention to connect to the connection destination. Thus, there is an advantage that fraudulent acts such as phishing can be prevented.

[Step 9 (S9)]
The connection destination guide unit 313 in the guide unit 311 connects to the connection destination via the communication unit 301 by the method specified in the process specification part when the user makes a decision to connect. The user's decision to connect to the connection destination is input by the input unit 314. The input unit 314 is a pointing device such as a keyboard and a mouse, for example.

[Step 10 (S10)]
The service providing unit 206 of the service providing computer 20 provides a service to the connected user terminal 30 via the communication unit 202.
The above is the outline of the functional configuration example and the processing example of the connection destination customer protection system according to the first embodiment.
Conventionally, it has been generally difficult to grasp what a model that guarantees something is, at a minimum, what is trusted and what procedure is guaranteed. According to the present invention, a guarantee is made for a guide destination (connection destination) to a guide (signed code), and a verification application for performing the guarantee is distributed to constitute a system that circulates as a whole. As a result, it is possible to more effectively form a guarantee service model. As a result, it is possible to obtain information safely without being aware of what kind of procedure is surely guaranteed.

Second Embodiment A connected customer protection system according to a second embodiment of the present invention will be described with reference to FIGS. FIG. 5 is a diagram illustrating a functional configuration of a connected customer protection system according to the second embodiment of the present invention. FIG. 6 is a diagram illustrating processing of the connected customer protection system according to the second embodiment of the present invention.
The connection destination customer protection system according to the second embodiment uses the signature key of the first assurance computer for the verification key of the second assurance computer corresponding to the signature key of the second assurance computer 12 for signing the label and the connection destination. It differs from the connected customer protection system according to the first embodiment in that an electronic signature is applied. Further, the signature confirmation unit 213 of the service providing computer 21 and the verification unit 329 of the user terminal 31 first confirm the validity of the verification key of the second assurance computer by using the verification key of the first assurance computer. After confirmation, the verification key of the second assurance computer is used to verify the validity of the label and the connection destination. In other respects, the connected customer protection system according to the second embodiment is substantially the same as the connected customer protection system according to the first embodiment.

[System configuration]
The connected customer protection system according to the second embodiment of the present invention includes, for example, a first assurance computer 11, a second assurance computer 12, a service providing computer 21, a user terminal 31, and a communication network 40 as shown in FIG. Is done.
The first assurance computer 11 includes, for example, a key creation unit 111, a signature key storage unit 112, a verification application creation unit 113, a verification application storage unit 114, a communication unit 115, and a signature unit 116.

The second assurance computer 21 includes, for example, a key creation unit 121, a signature key storage unit 122, an application unit 123, a communication unit 124, a signature unit 125, and a barcode generation unit 126.
The service providing computer 21 includes, for example, an application unit 201, a communication unit 202, a signature confirmation unit 213, a printing unit 204, an HTML creating unit 205, and a service providing unit 206. The signature confirmation unit 213 includes, for example, a signature confirmation unit a213a and a signature confirmation unit b213b.

The user terminal 31 is a PC terminal, a portable terminal, or the like, and includes, for example, a communication unit 301, a verification application storage unit 302, an authentication unit 323, a guidance unit 311, and an input unit 314. The authentication unit 323 includes, for example, a reading unit 304, a data analysis unit 325, and a verification calculation unit 328. The data analysis unit 325 includes an encoding unit 306 and a syntax analysis unit 327, for example. The verification calculation unit 328 includes, for example, a parameter selection unit 310 and a verification unit 329. The verification unit 329 includes, for example, a verification unit a329a and a verification unit b329b.
The guide unit 311 includes, for example, a label display unit 312 and a connection destination guide unit 313.

[Step 1 (S1)]
The key creation unit 111 of the first assurance computer 11 generates a set of a signature key and a verification key for the first assurance computer. The generated signature key of the first assurance computer is stored in the signature key storage unit 112, and the generated verification key of the first assurance computer is output to the verification application creation unit 113. In addition, the key creation unit 121 of the second assurance computer 12 generates a pair of the signature key and the verification key of the second assurance computer 121. The generated signature key of the second assurance computer is stored in the signature key storage unit 122, and the generated verification key of the second assurance computer is output to the application unit 123.

The signature key of the first assurance computer is the private key of the first assurance computer, and the verification key of the first assurance computer is the public key of the first assurance computer. The signature key of the second assurance computer is the private key of the second assurance computer, and the verification key of the second assurance computer is the public key of the second assurance computer.
The verification key of the first assurance computer is made public so that any computer / terminal can use it.

[Step 2 (S2)]
The verification application creation unit 113 of the first assurance computer 11 creates a verification application. The verification application includes a verification key created by the key creation unit 111. The created verification application is stored in the verification application storage unit 114.
The verification application is stored in the verification application storage unit 302 of the user terminal 31 by the same method as described in the connection destination customer protection system according to the first embodiment.

[Step 2a (S2a)]
The application unit 123 of the second proof computer 12 makes an application to the first proof computer 11 so that an electronic signature is put on the combination of the verification key of the second proof computer and the second proof computer. Specifically, the application unit 123 of the second assurance computer 12 creates an application signal including the name of the second assurance computer and the verification key of the second assurance computer, and the communication unit 124 transmits the application signal to the first assurance computer. It transmits to the computer 11.
Hereinafter, a combination of the name of the second assurance computer and the verification key of the second assurance computer is referred to as a first signature target.

[Step 2b (S2b)]
The signature unit 116 of the first assurance computer 11 creates an electronic signature for the first signature object whose validity has been confirmed. Specifically, the signature unit 116 of the first assurance computer 11 uses the private key of the first assurance computer read from the signature key storage unit 112 and the name and second name of the second assurance computer whose validity has been confirmed. Create an electronic signature for the combination of verification computer verification keys. The created electronic signature is transmitted to the second assurance computer 12 via the communication unit 115. The first electronic signature received by the communication unit 124 of the second assurance computer is stored in a temporary storage unit of the signature unit 125 not shown in FIG. The first signature object is also stored in a temporary storage unit of the signature unit 125 not shown in FIG.
Hereinafter, the electronic signature is referred to as a first electronic signature.
The validity of the first signature target can be confirmed by the same method as described in step 4 of the connected customer protection system according to the first embodiment.

[Step 3 (S3)]
The service providing computer 21 applies to the second assurance computer 12 so that a signature is put on the combination of the label and the connection destination. Specifically, the application unit 201 of the service providing computer 21 creates an application signal including a label and a connection destination, and the communication unit 202 transmits the application signal to the second assurance computer 12.
In the connection destination customer protection system according to the second embodiment, the verification key designation part and the process designation part may be included in the target of the electronic signature. In this case, it is possible to describe that there are two stages in the process designation portion.

[Step 4 (S4)]
The second assurance computer 12 creates an electronic signature for the combination of the label and the connection destination whose validity has been confirmed. Specifically, the signature unit 125 of the second assurance computer 12 uses the signature key of the second assurance computer 12 read from the signature key storage unit 122 to electronically check the combination of the label and the connection destination whose validity has been confirmed. Create a signature.
The validity of the combination of the label and the connection destination can be confirmed by the same method as described in Step 4 of the connection destination customer protection system according to the first embodiment.
Hereinafter, a combination of a label and a connection destination is referred to as a second signature target. When there are a verification key designation part and a process designation part, the combination of the label and the connection destination, the verification key designation part, and the process designation part become the second signature target. The electronic signature for the second signature target is called a second electronic signature.

[Step 5 (S5)]
The barcode generation unit 126 of the second assurance computer 12 receives from the signature unit 125 the second signature object and the second electronic signature, and the first electronic signature and the first signature object stored in the temporary storage unit of the signature unit 125. Are converted into a bar code such as a QR code (registered trademark). The created barcode is transmitted to the service providing computer 21 via the communication unit 124.
When the signature target and the electronic signature are used as a link in HTML instead of a barcode, it is not necessary to generate a barcode. In this case, the signature unit 125 transmits the second electronic signature, the second signature object, the first electronic signature, and the first signature object to the service providing computer 21 via the communication unit 124.
Hereinafter, a code obtained by adding the second electronic signature, the first electronic signature, and the first signature object to the second signature object is referred to as a signed code.

[Step 6 (S6)]
The service providing computer 21 checks whether or not the signature is signed as requested. After confirming that the signature is applied as requested, the signed code is printed on various media including advertisements and distributed to users.
Specifically, the communication unit 202 of the service providing computer 20 receives the barcode and outputs it to the signature confirmation unit 213. The signature verification unit 213 analyzes the barcode received from the communication unit 202 using the verification key of the first assurance computer 11 obtained in advance, and compares the barcode with the content of the second signature target applied by the application unit 201. As a result of the comparison, if it can be confirmed that an electronic signature has been created for the same content as the requested second signature object, the printing unit 204 prints this barcode on an advertisement or the like. An advertisement or the like on which a barcode is printed is distributed to users. Further, the barcode printed by the printing unit 204 may be uploaded as image data to the Web page of the service provider or transmitted to the user using an e-mail.

  For example, the signature confirmation unit a213a in the signature confirmation unit 213 decrypts the first electronic signature in the signed code using the verification key of the first guarantee computer 11 obtained in advance. Further, the hash value of the first signature target in the signed code is calculated. The decryption result and the hash value are compared, and if they are the same, it is determined that the first signature target, that is, the combination of the name of the second assurance computer and the verification key of the second assurance computer is valid. If it is determined to be valid, a signal to that effect is output to the signature confirmation unit b213b in the signature confirmation unit 213.

  The signature confirmation unit b213b that has received the signal indicating that the signal is valid decrypts the second electronic signature in the signed code using the verification key. Further, the hash value of the second signature target in the signed code is calculated. If the decryption result and the hash value are compared, and if they are the same, it can be determined that the second signature target, that is, the combination of the label and the connection destination is valid.

  When the signed code is used as a link in an HTML document instead of a barcode, the printing unit 204 does not need to print the barcode. In this case, the signature confirmation unit 213 confirms the signed code received via the communication unit 202 and then outputs the code to the HTML creation unit 205. The HTML creation unit 205 creates a link and creates an HTML document including the link. The created HTML document is, for example, uploaded as image data to the Web page of the service provider, or transmitted to the user using e-mail.

[Step 7 (S7)]
The user terminal 31 reads the signed code and verifies the validity of the second signature target. Specifically, the reading unit 304 in the authentication unit 323 of the user terminal 31 reads the signed code, and outputs the read data to the encoding unit 306 in the data analysis unit 325. The encoding unit 306 converts the given data so that the syntax analysis unit 327 can process the data by converting the data into a byte string or a bit string. The converted data is output to the syntax analysis unit 327. The syntax analysis unit 327 converts the byte string and bit string data into the second signature target label part, the second signature target connection destination part, the second electronic signature part, and the name of the second signature computer as the first signature target. If there are a verification key part of the second assurance computer to be signed, and a verification key designation part and a process designation part, it is divided into a verification key designation part and a process designation part. The divided byte string and bit string are output to the verification unit 329 in the verification calculation unit 328. The byte string and bit string data relating to the verification key designation part and the process designation part are output to the parameter selection unit 310 in the verification calculation unit 328.

If the signed code is a link described in HTML, the syntactic analysis unit 327 can directly divide the signed code without passing through the reading unit 304 and the encoding unit 306.
The parameter selection unit 310 acquires parameters and verification key information necessary for verification from the data of the verification key designation part, the byte string and the bit string related to the process designation part, and outputs them to the verification part 329. Based on the byte string and bit string data subjected to the structural analysis by the syntax analysis unit 327, the information acquired by the parameter selection unit 310, and the verification key of the first assurance computer 11 obtained in advance, the verification unit 329 2 Verify the validity of the signature target. The verification unit 329 can also use a default value when there is no verification key designation part or process designation part in the signed code, or when no information is designated in the verification key designation part or process designation part. For example, when the verification key is not specified in the verification key specification portion, the validity of the second signature target is verified using the verification key included in the verification application.

For example, the verification unit a319a in the verification unit 319 decrypts the first electronic signature in the signed code using the verification key of the first guarantee computer 11 obtained in advance. Further, the hash value of the first signature target in the signed code is calculated. The decryption result and the hash value are compared, and if they are the same, it is determined that the first signature target, that is, the combination of the name of the second assurance computer and the verification key of the second assurance computer is valid. If it is determined to be valid, a signal indicating that it is valid is output to the verification unit b 319 b in the verification unit 319.
Next, the verification unit b319b that has received the signal indicating that it is legitimate uses the verification key to decrypt the second electronic signature in the signed code. Further, the hash value of the second signature target in the signed code is calculated. If the decryption result and the hash value are compared, and if they are the same, it can be determined that the second signature target, that is, the combination of the label and the connection destination is valid.

[Step 8 (S8)] to [Step 10 (S10)]
This is the same as steps 8 to 10 in the connected customer protection system according to the first embodiment.
The above is the outline of the functional configuration example and the processing example of the connection destination customer protection system according to the second embodiment. In this way, the first assurance computer performs the electronic signature on the verification key of the second assurance computer, whereby the signature processing can be distributed and a more efficient assurance service can be implemented.

In the connection-destination customer protection system according to the second embodiment, such as a modification , the first assurance computer has made an electronic signature for the verification key of the second assurance computer, but another assurance computer has the verification key of the first assurance computer. An electronic signature may be performed. Furthermore, a chain in which another guarantee computer performs an electronic signature on a verification key of a certain guarantee computer may be performed in multiple stages an arbitrary number of times.
The processing function in the user terminal constituting the connection destination customer protection system can be realized by a computer. In this case, the processing content of the function that the user terminal should have is described by a program. By executing this program on a computer, the processing functions in the user terminal are realized on the computer as shown in FIG.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is provided for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

In this embodiment, the user terminal is configured by executing a predetermined program on the computer. However, at least a part of the processing contents may be realized by hardware.
In addition to the above-described embodiments, the connected customer protection system / method according to the present invention is not limited to the above-described embodiments, and can be appropriately changed without departing from the spirit of the present invention.

The figure which illustrated the functional composition of the connecting point customer protection system by a 1st embodiment. The figure which illustrated processing of the connecting customer protection system by a 1st embodiment. The figure which illustrated the code with a signature. The figure which illustrated the description method of a link. The figure which illustrated the functional composition of the connecting point customer protection system by a 2nd embodiment. The figure which illustrated processing of the connecting customer protection system by a 2nd embodiment. The figure which illustrated the functional structure when the user terminal which comprises the connecting customer protection system by this invention is performed with a computer.

Claims (10)

In the connected customer protection system composed of a communication network connecting a service providing computer, a guarantee computer and a user terminal,
(A) The warranty computer is
A signing means for inputting a verified combination of a label and a connection destination (hereinafter referred to as a signature target) and creating an electronic signature for the signature target using a signature key of the assurance computer;
With
(B) The user terminal
Authentication means for verifying the validity of the signature target included in the signed code using a verification key of the assurance computer and an electronic signature extracted from the signed code obtained by adding the electronic signature to the signature target;
Before actually connecting to the connection destination, perceptual means for notifying the user of the signature object whose validity has been confirmed and for allowing the user to perceive whether to connect to the connection destination;
An input means for allowing the user to selectively input whether or not to connect;
When the user inputs a selection to connect to the connection destination, guidance means for connecting to the connection destination;
With
(C) The service providing computer
A service providing means for providing a service to a connected user terminal;
Comprising
Connected customer protection system characterized by that. In the connected customer protection system according to claim 1,
The service providing computer further includes:
An application means for transmitting an application signal including the signature object to the assurance computer;
Connected customer protection system characterized by that. In the connected customer protection system according to claim 1 or 2,
The connected customer protection system, wherein the signed code is a bar code. In the connected customer protection system according to claim 1 or 2,
The signed code above is
An electronic signature is described in a tag representing a link in HTML.
Connected customer protection system characterized by that. In the connected customer protection system according to any one of claims 1 to 3,
The signature target includes a verification key designating part for designating parameters necessary for verification of the electronic signature, a verification key, an ID, etc., and a process designating part for designating how the relationship between the label and the connection destination is processed. Connected customer protection system. In a connected customer protection system comprising a service providing computer, a first assurance computer, a second assurance computer, and a user terminal,
(A) The second warranty computer
A verified combination of label and connection destination (hereinafter referred to as second signature target) is input, and a second electronic signature for the second signature target is created using the signature key of the second assurance computer Second signing means,
With
(B) The first assurance computer
The combination of the name of the second guaranteed computer and the verification key of the second computer (hereinafter referred to as the first signature target) whose validity has been confirmed is input, and the first signature is obtained using the signature key of the first guaranteed computer. First signature means for creating a first electronic signature for the object;
With
(C) The user terminal
Using the verification key of the first assurance computer and the first electronic signature extracted from the signed code in which the second electronic signature and the first electronic signature are added to the second signature object. First authentication means for verifying the validity of the computer verification key;
Using the verification key of the second guaranteed computer whose validity is confirmed and the second electronic signature extracted from the signed code, the second signature target verified in the signed code is verified for validity. 2 authentication means;
Before actually connecting to the connection destination, the user is informed of the second signature object whose validity has been confirmed, and perceptual means for allowing the user to perceive whether to connect to the connection destination;
An input means for allowing the user to selectively input whether or not to connect;
When the user inputs a selection to connect to the connection destination, guidance means for connecting to the connection destination;
With
(D) The service providing computer
A service providing means for providing a service to a connected user terminal;
Comprising
Connected customer protection system characterized by that. In the connected customer protection system according to claim 6,
The second assurance computer further includes:
A first application means for transmitting an application signal including a first signature object to the first assurance computer;
The service providing computer further includes:
An application signal including the second signature target, and a second application means for transmitting to the second assurance computer;
Connected customer protection system characterized by that. A signature that the signature means of the assurance computer creates an electronic signature for the combination of the label and the connection destination (hereinafter referred to as a signature target) that is input after the validity is confirmed using the signature key of the assurance computer Process,
The authenticating means of the user terminal uses the verification key of the assurance computer and the electronic signature extracted from the signed code obtained by adding the electronic signature to the signed object, and the validity of the signed object included in the signed code An authentication process to verify
A perceptual process in which the perception means of the user terminal informs the user of the signature object whose validity has been confirmed before actually connecting to the connection destination, and makes the user perceive whether to connect to the connection destination;
An input process for allowing the user to select whether or not the input means of the user terminal is connected; and
When the user's guidance means inputs that the user connects to the connection destination, a guidance process of connecting to the connection destination;
A service providing process in which the service providing means of the service providing computer provides a service to the connected user terminal;
A connected customer protection method characterized by comprising: Authentication means for verifying the validity of the signature target included in the signed code using a verification key of the assurance computer and an electronic signature extracted from the signed code in which the electronic signature is added to the signature target;
Actually, before connecting to the connection destination included in the signature target, the perceptual means for notifying the user of the signature target whose validity has been confirmed and causing the user to perceive whether to connect to the connection destination;
An input means for allowing the user to selectively input whether or not to connect;
When a selection by the user to connect to the connection destination is input, guidance means for connecting to the connection destination,
As a program to make the computer function as. Verification of the second assurance computer using the verification key of the first assurance computer and the first electronic signature extracted from the signed code obtained by adding the second electronic signature and the first electronic signature to the second signature object First authentication means for verifying the validity of the key;
Using the verification key of the second guaranteed computer whose validity is confirmed and the second electronic signature extracted from the signed code, the second signature target verified in the signed code is verified for validity. 2 authentication means;
Actually, before connecting to the connection destination included in the second signature target, the perception means for notifying the user of the second signature target whose validity has been confirmed and allowing the user to perceive whether to connect to the connection destination. When,
An input means for allowing the user to selectively input whether or not to connect;
When a selection by the user to connect to the connection destination is input, guidance means for connecting to the connection destination,
As a program to make the computer function as.

Images