JP7388707B2 - Information processing device, information processing system, information processing method, and program - Google Patents

Description

The present invention relates to an information processing device, an information processing system, an information processing method, and a program.

In recent years, it has become necessary to manage customers' personal information more thoroughly than ever before. For example, when allowing other companies to access personal information owned by a company through collaboration between companies, it is necessary to thoroughly manage at least the generation, read history, update, and deletion of personal information. It means that there is.

When linking data containing personal information between your company's system and another company's system, in order to control access rights to your company's data for the connected system, it is necessary to determine detailed specifications for each system. must be developed. The more systems there are to connect to, the more combinations there are, and the more complex the system construction for coordination becomes. In particular, if one company is allowed to both read and update data owned by the company, while another company is prohibited from updating but only allowed to read, it is possible to use only combinations between companies. However, it becomes necessary to manage access rights for each data item, and the mechanism for collaboration becomes even more complex.

There is also a technology that manages the granting of access rights to data by applying existing technology without developing individual systems for users. For example, in Patent Document 1, by granting temporary access authority from the patient side, the doctor side stores prescription data in the blockchain, and the pharmacist side refers to the prescription data and stores the dispensing data in the blockchain. We are proposing a technology for storing

JP2019-185642A

The above technology is a technology that stores information regarding prescriptions, that is, the data itself, on the blockchain. Once a blockchain is created, its contents cannot be altered (including deletion). For this reason, blockchain is suitable for storing information that must be stored permanently, such as prescription information, but it is not suitable for storing personal information that the customer may request to be deleted. It is hard to say that it is suitable. In managing personal information, it is desirable to develop technology that not only prevents data containing personal information from leaking, but also clearly states the right to access data.

The present invention has been made in view of these points, and it is an object of the present invention to provide a technology for disclosing data access rights while protecting data from leakage.

A first aspect of the present invention is an information processing device that can communicate with each of a first device and a second device via a communication network. This device includes a first device identifier for identifying the first device, a second device identifier for identifying the second device, and a second device identifier configured for a database managed by the second device. an access data acquisition unit that acquires access data including access right information that is information regarding access rights of a first device; a first public key that is a public key of the first device; and a first public key that is a public key of the first device; a first signature information acquisition unit that acquires first electronic signature data that is data signed with a first private key that is a private key corresponding to the second device from the first device via the communication network; and second electronic signature data, which is data obtained by signing the first electronic signature data with a second private key, which is a private key corresponding to the second public key, a second signature information acquisition unit that acquires from the second device via a network, the first public key, the second public key, a third public key that is the public key of the information processing device, and the second electronic At least the first device, the second device, and the information processing device can refer to signed access data, which is data obtained by signing signature data with a third private key that is a private key corresponding to the third public key. A blockchain registration unit that registers on a blockchain.

The access right information includes processing authority granted to the first device for the database, data types that can be accessed with the processing authority, and an authority period that defines a period during which the first device can access the database. May include.

A second aspect of the present invention is an information processing system including the above-described information processing device, the first device, and the second device. In this system, the first device provides a signature signed with the first private key, which includes the first device identifier, a data identifier for identifying data to be processed, and the processing authority. The second device transmits the data to be accessed already to the second device, and the second device determines whether (1) verification of the signature using the second public key on the signed access data registered in the blockchain is successful; , (2) verification of the signed access target data performed using the first public key registered in the blockchain is successful, and (3) the third public key registered in the blockchain A process permitted by the access right information is executed on the data to be processed received from the first device, on the condition that the signed access data is successfully verified using the key.

When the second device executes a process permitted by the access right information, the second device sends signed processing information signed with the second private key to the processing information including the data identifier and the access right information. At least the first device, the second device, and the information processing device may be registered in a log blockchain that can be referenced via the communication network.

A third aspect of the present invention is an information processing method. In this method, a processor of an information processing device capable of communicating with each of a first device and a second device via a communication network, a first device identifier for identifying the first device, and a processor for identifying the second device. acquiring access data including a second device identifier for identification and access right information that is information regarding the access right of the first device set to a database managed by the second device; A first public key, which is a public key of the first device, and first electronic signature data, which is data obtained by signing the access data with a first private key, which is a private key corresponding to the first public key, are transmitted through the communication. acquiring a second public key that is a public key of the second device from the first device via a network, and a second public key that is a private key corresponding to the second public key; acquiring second electronic signature data, which is data signed with a private key, from the second device via the communication network; and disclosing the first public key, the second public key, and the information processing device. A third public key, which is a key, and signed access data, which is data obtained by signing the second electronic signature data with a third private key, which is a private key corresponding to the third public key, are transmitted to at least the first device. A step of registering in a blockchain that can be referenced by the second device and the information processing device is performed.

The fourth aspect of the present invention is a program. This program sends a first device identifier for identifying the first device and a computer for identifying the second device to a computer capable of communicating with each of the first device and the second device via a communication network. a function of acquiring access data including a second device identifier and access right information that is information regarding the access right of the first device set to a database managed by the second device; A first public key, which is a public key, and first electronic signature data, which is data obtained by signing the access data with a first private key, which is a private key corresponding to the first public key, are sent via the communication network. a function to obtain from the first device, a second public key that is the public key of the second device, and a signature on the first electronic signature data using a second private key that is a private key corresponding to the second public key. a function of acquiring second electronic signature data, which is data sent from the computer, from the second device via the communication network; key, and signed access data, which is data obtained by signing the second electronic signature data with a third private key that is a private key corresponding to the third public key, at least at the first device, the second device, and the second device. Realizes the ability to register on a blockchain that can be referenced by computers.

In order to provide this program or to update a part of the program, a computer-readable recording medium recording this program may be provided, and this program may be transmitted over a communication line.

Note that arbitrary combinations of the above components and expressions of the present invention converted between methods, apparatuses, systems, computer programs, data structures, recording media, etc. are also effective as aspects of the present invention.

According to the present invention, data access rights can be disclosed while protecting data from leakage.

FIG. 1 is a diagram for explaining an overview of an information processing system according to an embodiment. FIG. 1 is a diagram schematically showing a functional configuration of an information processing device according to an embodiment. FIG. 1 is a diagram schematically showing the configuration of a blockchain according to an embodiment. FIG. 3 is a diagram schematically showing an example of access right information according to an embodiment. FIG. 1 is a diagram schematically showing the configuration of a log blockchain according to an embodiment. It is a sequence diagram for explaining the flow of information processing performed by the first device and the second device according to the embodiment. 12 is a flowchart for explaining the flow of a process of checking whether or not processing of data to be processed is permitted, which is executed by the second device according to the embodiment.

<Overview of embodiment>
FIG. 1 is a diagram for explaining an overview of an information processing system S according to an embodiment. An overview of the embodiment will be described below with reference to FIG.

The first device 2 according to the embodiment includes a blockchain B that registers access rights, an information processing device 1 that manages the blockchain B, and a first device 2 that is managed by each of the companies that are collaborating with each other. It includes a second device 3 and a database 30 that stores personal information managed by the second device 3. The blockchain B can be accessed by at least three parties, the information processing device 1, the first device 2, and the second device 3, via a communication network N such as the Internet. In the information processing system S according to the embodiment, the information processing device 1, the first device 2, and the second device 3 can refer to information registered in the blockchain B at any time. On the other hand, only the information processing device 1 has the authority to register data in the blockchain B. Furthermore, if the first device 2 and the second device 3 are linked, this means that the administrator of each device has obtained consent from each customer to share that customer's personal information. do.

Hereinafter, an overview of the processing flow in the information processing system S will be explained in the order of (1) to (6), and the numbers correspond to (1) to (6) in FIG.

(1) The information processing device 1 uses a first device identifier for identifying the first device 2, a second device identifier for identifying the second device 3, and a database 30 managed by the second device 3. access right information, which is information regarding the access right of the first device 2 that has been set, is acquired from the first device 2 or the second device 3. The access right information is information based on an agreement between the administrator of the first device 2 and the administrator of the second device 3. In FIG. 1 , the information processing device 1 acquires access right information from the first device 2 .

(2) The first device 2 uses the private key of the first device 2 to electronically sign the access data including the access right information.
(3) The first device 2 transmits the signed access data and the public key corresponding to the private key to the information processing device 1.

(4) The second device 3 uses the private key of the second device 3 to further digitally sign the signed access data signed by the first device 2. The second device 3 may acquire the signed access data signed by the first device 2 from the information processing device 1 or from the second device 3.
(5) The second device 3 transmits the access data signed by the first device 2 and the public key corresponding to the private key to the information processing device 1.

(6) The information processing device 1 stores the device identifiers and public keys of the first device 2 and the second device 3, a third public key that is the public key of the information processing device 1, the first device 2 and the second device 3 and 3, and the signed access data signed with the private key corresponding to the third public key are registered in blockchain B. In the blockchain B according to the embodiment, information cannot be registered unless the private key of the information processing device 1 is used. Therefore, only the information processing device 1 can add information to the blockchain B.

In this way, blockchain B stores only the access rights to the data stored in the database 30, rather than the data itself stored in the database 30. Although the data stored in the database 30 can be referenced by any device participating in blockchain B, the data in the database 30 itself will not be leaked. Furthermore, as is known, it is difficult to tamper with the information registered in Blockchain B, so the access rights to the data stored in the database 30 may be tampered with by a third party and the data in the database 30 may be accessed. This situation can also be suppressed.

Thereby, the information processing system S can protect the data stored in the database 30 from leakage, and at the same time disclose access rights to the data stored in the database 30 at any time. Therefore, when the second device 3 stores a customer's personal information in the database 30, even if the customer inquires about the access right to the personal information (information on the partner and the scope of access), the access right will be denied. Information may be disclosed at any time.

<Functional configuration of information processing device 1 according to embodiment>
FIG. 2 is a diagram schematically showing the functional configuration of the information processing device 1 according to the embodiment. The information processing device 1 includes a storage section 10 and a control section 11. In FIG. 2, arrows indicate main data flows, and there may be data flows that are not shown in FIG. In FIG. 2, each functional block shows the configuration of a functional unit, not the configuration of a hardware (device) unit. Therefore, the functional blocks shown in FIG. 2 may be implemented within a single device, or may be implemented separately within multiple devices. Data may be exchanged between functional blocks via any means such as a data bus, a network, or a portable storage medium.

The storage unit 10 includes a ROM (Read Only Memory) that stores the BIOS (Basic Input Output System) of a computer that implements the information processing device 1, a RAM (Random Access Memory) that serves as a work area of the information processing device 1, and an OS (OS). It is a large-capacity storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive) that stores a variety of information that is referred to during the execution of the operating system (Operating System), application programs, and the application programs.

The control unit 11 is a processor such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit) of the information processing device 1, and controls the access data acquisition unit 110 and the first It functions as a signature information acquisition unit 111, a second signature information acquisition unit 112, and a blockchain registration unit 113.

Note that FIG. 2 shows an example in which the information processing device 1 is configured as a single device. However, the information processing device 1 may be realized by calculation resources such as a plurality of processors and memories, such as a cloud computing system, for example. In this case, each unit constituting the control unit 11 is realized by executing a program by at least one of a plurality of different processors.

The information processing device 1 is capable of communicating with each of the first device 2 and the second device 3 via the communication network N. The access data acquisition unit 110 sets a first device identifier for identifying the first device 2, a second device identifier for identifying the second device 3, and a database 30 managed by the second device 3. access right information, which is information regarding the access right of the first device 2 that has been accessed.

The first signature information acquisition unit 111 acquires a first public key, which is the public key of the first device 2, and a first signature information, which is data obtained by signing the access data with a first private key, which is a private key corresponding to the first public key. The electronic signature data is acquired from the first device 2 via the communication network N.

The second signature information acquisition unit 112 uses data obtained by signing the first electronic signature data with a second public key that is the public key of the second device 3 and a second private key that is a private key that corresponds to the second public key. Certain second electronic signature data is acquired from the second device 3 or the information processing device 1 via the communication network N.

Note that the order in which the access data is signed is arbitrary. The second device 3 may first sign the access data and then the first device 2 may sign the data.

The blockchain registration unit 113 stores a first public key, a second public key, a third public key which is a public key of the information processing device 1, and a third public key which is a private key corresponding to the third public key. Signed access data, which is data signed with the third private key, is registered in the blockchain B that can be referenced by at least the first device 2, the second device 3, and the information processing device 1.

FIG. 3 is a diagram schematically showing the configuration of blockchain B according to the embodiment. As shown in FIG. 3, blockchain B is information in which multiple blocks are connected. Each of the plurality of blocks includes a hash value of information indicating the immediately preceding block, a nonce value, the registration date and time of the block, signed access data, a first public key, a second public key, and a third public key. . A nonce value is information used to ensure that a hash value of a block satisfies a specific condition. Further, the access data includes a first device identifier, a second device identifier, and access right information, and includes a first electronic signature that is the electronic signature of the first device 2 and an electronic signature of the second device 3. A second electronic signature and a third electronic signature, which is the electronic signature of the information processing device 1, are attached.

FIG. 4 is a diagram schematically showing an example of access right information according to the embodiment. The access right information includes processing authority for the database 30 that is granted to the first device 2, data types that can be accessed with the processing authority, and an authority period that defines the period during which the first device 2 can access the database 30. I'm here.

In the example shown in FIG. 4, "read" is set as the processing authority, "address, name, etc." is set as the data type, and "February 14, 2020 to March 14, 2020" is set as the authority period. This indicates that the first device 2 can read the address and name stored in the database 30 between February 14, 2020 and March 14, 2020. Although not shown, the processing authority can be set to "create", "update", "delete", etc. in addition to "read".

In this way, by storing the processing authority for the database 30 granted to the first device 2 by the information processing device 1 in the blockchain B, the first device 2 and the second device 3 can check the status of the processing authority at any time. can do. Furthermore, since blockchain B has strong resistance to tampering by a third party, it is possible to prevent the processing authority stored in blockchain B from being tampered with by the second device 3 or a third party. Therefore, data in the database 30 can be prevented from being leaked due to access based on access rights that are not originally granted.

(Access to database 30)
Next, a description will be given of a process performed when the second device 3 having processing authority for the database 30 actually accesses the database 30.

The first device 2 signs the access target data used to access data stored in the database 30 with the first private key, and transmits the signed access target data to the second device 3 . Here, the access target data is data including a first device identifier that is the identifier of the first device 2, a data identifier for specifying data to be processed, and processing authority. The data identifier is information for specifying the processing target data stored in the database 30 when the processing content is reading and deletion, and is information for identifying the data to be processed stored in the database 30 when the processing content is generation and updating. This information includes the data itself.

The second device 3 verifies the validity of the signed access data registered in the blockchain B using the second public key held by the second device 3. The second device 3 verifies the validity of the access target signature using the first public key registered in the blockchain B. The second device 3 further verifies the validity of the signed access data using the third public key registered in the blockchain B. The second device 3 receives the processing object received from the first device 2 on the condition that the second public key and the signed access data using the second public key are successfully verified and the access target signature is successfully verified. Execute the processing permitted by the access right information on the data.

In this way, the second device 3 first verifies that the signed access data stored in the blockchain B is valid using the second public key that is its own public key. Check the validity of B itself. Next, by confirming the validity of the access target signature received from the first device 2 using the first public key stored in the blockchain B whose validity has been confirmed, the first device that sent the access target data 1 confirms the validity of device 2. In addition, the second device 3 verifies the validity of the signed access data using the third public key stored in the blockchain B, so that the access right information is transferred to the blockchain B by the information processing device 1. Confirm that it has been registered.

In this way, the second device 3 executes processing on the data in the database 30 after confirming the validity of the first device 2 and the validity of the processing authority of the second device 3. Thereby, the first device 2 can guarantee that those who are permitted to access the data in the database 30 will execute the processing within the permitted range.

As described above, the blockchain B is a blockchain for storing the processing authority of the first device 2 with respect to the database 30 managed by the second device 3. In addition, if you store not only access privileges but also access logs for the database 30, you can track when and by whom the data in the database 30 was created, updated, read, and deleted. It's convenient.

Therefore, when the second device 3 executes a process permitted by the access right information, the second device 3 adds a second processing information signature, which is a signature using the second private key, to the processing information including the data identifier and the access right information. The signed processing information may be registered in a log blockchain that can be referenced by at least the first device 2, the second device 3, and the information processing device 1 via the communication network N. The log blockchain may be shared with blockchain B for storing the above-mentioned access data, or may be a dedicated blockchain different from blockchain B.

FIG. 5 is a diagram schematically showing the configuration of the log blockchain according to the embodiment, and is a diagram showing the log blockchain when it is a dedicated blockchain different from blockchain B. Similar to blockchain B, the log blockchain is also information in which multiple blocks are connected. Each of the plurality of blocks includes a hash value of information indicating the immediately preceding block, a nonce value, and the registration date and time of the block. Further, each block in the log blockchain includes signed processing information with a second processing information signature, which is a signature using a second private key. Although not shown, the signed processing information may be further signed by the first private key.

As described above, processing information is information that includes a data identifier and access right information. Therefore, the information processing device 1, the first device 2, and the second device 3 can confirm when and by whom the data specified by the data identifier was generated, updated, read, or deleted. .

<Processing flow of the information processing method executed by the information processing device 1>
FIG. 6 is a sequence diagram for explaining the flow of information processing executed by the first device 2 and the second device 3 according to the embodiment.

The first device 2 provides signed access to data to be accessed that includes three pieces of information: a first device identifier, a data identifier for identifying data to be processed, and processing authority, signed with a first private key. The target data is transmitted to the second device 3 (S2).

The second device 3 receives the signed access target data from the second device 3 (S4). The second device 3 checks whether processing of the signed processing target data received from the first device 2 is permitted (S6).

If the processing is permitted (Yes in S8), the second device 3 executes the processing permitted by the processing authority on the data specified by the data identifier (S10). The second device 3 registers the processing history in the log blockchain (S12). If the process is not permitted (No in S8), the second device 3 does not perform any special process.

FIG. 7 is a flowchart for explaining the flow of the confirmation process executed by the second device 3 according to the embodiment to determine whether processing of data to be processed is permitted. Step S6 in FIG. 6 is explained in more detail. FIG.

The second device 3 uses the second private key and the first and third public keys acquired from the blockchain B to apply an electronic signature to the signed access data stored in the blockchain B. The validity of the information is verified (S60). If the validity of the electronic signature is successfully verified (Yes in S61), the second device 3 verifies whether or not it is within the authorized period included in the access right information (S62).

If it is within the authority period (Yes in S63), the second device 3 verifies whether the processing authority included in the access target data is registered in blockchain B (S64). If the verification is successful (Yes in S65), the second device 3 permits processing on the data specified by the data identifier (S66). If verification of the validity of the electronic signature fails (No in S61), if verification of the authority period fails (No in S63), or if verification of processing authority fails (No in S65), the second device 3 prohibits processing on the data specified by the data identifier (S67).

<Effects achieved by the information processing device 1 according to the embodiment>
As described above, according to the information processing device 1 according to the embodiment, data access rights can be disclosed while protecting data from leakage.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes can be made within the scope of the gist. be. For example, all or part of the device can be functionally or physically distributed and integrated into arbitrary units. In addition, new embodiments created by arbitrary combinations of multiple embodiments are also included in the embodiments of the present invention. The effects of the new embodiment resulting from the combination have the effects of the original embodiment.

<First modification example>
In the above, the second device 3 verified the validity of the information processing device 1 and the first device 2 by verifying the validity of the electronic signature attached to the signed access data. Alternatively or in addition to this, the second device 3 may verify the validity of the data transmission source device using the IP (Internet Protocol) address of the transmission source device.

<Second modification example>
In the above, a case has been described in which the third public key, which is the public key of the information processing device 1, is registered in the blockchain B. Alternatively, the blockchain B may not hold the third public key, and the second device 3 may securely hold the third public key. In this case, the administrator of the information processing device 1 passes the third public key to the administrator of the second device 3 in advance. This is advantageous in that the security of data access between the first device 2 and the second device 3 can be further improved because it is possible to further limit who can use the third public key.

10...Storage unit 11...Control unit 110...Access data acquisition unit 111...First signature information acquisition unit 112...Second signature information acquisition unit 113...Block chain registration unit 2. ...First device 3...Second device 30...Database B...Blockchain N...Communication network S...Information processing system

Claims (6)

An information processing device capable of communicating with each of a first device and a second device via a communication network,
a first device identifier for identifying the first device; a second device identifier for identifying the second device; and access of the first device set to a database managed by the second device. an access data acquisition unit that acquires access data including access right information that is information regarding rights;
A first public key that is a public key of the first device, and first electronic signature data that is data obtained by signing the access data with a first private key that is a private key that corresponds to the first public key. a first signature information acquisition unit that acquires from the first device via a communication network;
a second public key that is a public key of the second device; and second electronic signature data that is data obtained by signing the first electronic signature data with a second private key that is a private key corresponding to the second public key. a second signature information acquisition unit that acquires from the second device via the communication network;
The first public key, the second public key, a third public key that is a public key of the information processing device, and a third private key that is a private key that corresponds to the second electronic signature data and the third public key. a blockchain registration unit that registers signed access data, which is data signed by the user, in a blockchain that can be referenced by at least the first device, the second device, and the information processing device;
An information processing device comprising: The access right information includes processing authority granted to the first device for the database, data types that can be accessed with the processing authority, and an authority period that defines a period during which the first device can access the database. include,
The information processing device according to claim 1. An information processing system comprising the information processing device according to claim 2, the first device, and the second device,
The first device generates signed access target data signed with the first private key, which includes the first device identifier, a data identifier for identifying data to be processed, and the processing authority. to the second device;
The second device may (1) successfully verify the signature using the second public key on the signed access data registered in the blockchain, and (2) verify the signed access data registered in the blockchain. (3) verification of the signed access data performed using the third public key registered in the blockchain is successful; and (3) verification of the signed access data performed using the third public key registered in the blockchain. performing a process permitted by the access right information on the data to be processed received from the first device, on the condition that the process is successful;
Information processing system. When the second device executes a process permitted by the access right information, the second device sends signed processing information signed with the second private key to the processing information including the data identifier and the access right information. registering at least the first device, the second device, and the information processing device in a log blockchain that can be referenced via the communication network;
The information processing system according to claim 3. A processor of an information processing device capable of communicating with each of the first device and the second device via a communication network,
a first device identifier for identifying the first device; a second device identifier for identifying the second device; and access of the first device set to a database managed by the second device. obtaining access data including access right information that is information regarding rights;
A first public key that is a public key of the first device, and first electronic signature data that is data obtained by signing the access data with a first private key that is a private key that corresponds to the first public key. obtaining from the first device via a communication network;
a second public key that is a public key of the second device; and second electronic signature data that is data obtained by signing the first electronic signature data with a second private key that is a private key corresponding to the second public key. from the second device via the communication network;
The first public key, the second public key, a third public key that is a public key of the information processing device, and a third private key that is a private key that corresponds to the second electronic signature data and the third public key. registering the signed access data, which is the data signed by the user, in a blockchain that can be referenced by at least the first device, the second device, and the information processing device;
An information processing method that performs. a computer capable of communicating with each of the first device and the second device via a communication network;
a first device identifier for identifying the first device; a second device identifier for identifying the second device; and access of the first device set to a database managed by the second device. a function to acquire access data including access right information, which is information regarding rights;
A first public key that is a public key of the first device, and first electronic signature data that is data obtained by signing the access data with a first private key that is a private key that corresponds to the first public key. a function of acquiring from the first device via a communication network;
a second public key that is a public key of the second device; and second electronic signature data that is data obtained by signing the first electronic signature data with a second private key that is a private key corresponding to the second public key. from the second device via the communication network;
Sign the first public key, the second public key, a third public key that is the public key of the computer, and the second electronic signature data with a third private key that is a private key corresponding to the third public key. a function of registering the signed access data, which is the data obtained, in a blockchain that can be referenced by at least the first device, the second device, and the computer;
A program that makes this possible.

Images