JPH10210027A - Information providing system and information security method applied to this system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize an information providing service which surely secures an information security function of a third-party agency and can be spread in a wide range without unnecessary limitation of information providers and users as the result in an information providing system with the third-party agency interposed. SOLUTION: An information providing service system is assumed which has a third-party agency (TTP) 4 interposed and uses an information communication network to present information meeting a request to a user (SUB) 2 from an information provider (SP) 3. A card module 21 where security relevant information is stored is supplied from the TTP 4 to the user SUB 2, and the user SYB 2 uses this card module 21 to request the information provider SP 3 to provide information. The information provider SP 3 executes the decision processing of the reliability of the TTP 4 based on security relevant information and executes the decision processing of the reliability of the card module 21 in the case of the TTP 4 whose reliability is secured.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for providing requested information from an information provider to an information receiver via an information communication network such as a computer network or a digital broadcasting network. In particular, the present invention relates to an information providing system of a type that ensures an information security function by a third party organization.

[0002]

2. Description of the Related Art In recent years, a so-called multimedia information providing service system has been proposed using an information communication network such as a computer network or a digital broadcasting network based on digital satellite broadcasting. In this system, an information receiving apparatus for receiving information from a network is provided to a user such as a home, and multimedia information including video, audio, and text is transmitted by the information receiving apparatus to, for example, a personal computer or a television. Reproduced by the receiver.

When such an information providing service system is constructed, a so-called information security (secur
function) is an important factor. The information security function includes a user authentication function (coditional).
In addition to this, there is a function of protecting the rights of the creator of the multimedia information and the information provider, such as the copyright, in addition to the method of limiting the recipient called an access.

As a means for realizing such an information security function, there is a method in which a card module which is detachably attached to an information receiving device arranged on the user side is used. According to this method, information related to the information security function (herein, referred to as security-related information) is stored in a memory mounted inside the card module, and the card module is distributed to each user. The user can receive the provision service of the requested information by setting the card module in the information receiving device and transmitting the security-related information to the information provider side.

[0005] The security-related information includes, in addition to the information (for example, a user identification code) related to the user authentication function, information related to a function of protecting a right such as a copyright. Specifically, digital finger print, digital watermarking (watermarkin)
g) or information for performing a kind of data embedding process called data hiding. The data embedding process is a content in which, for example, identification data (characters, figures, and the like) indicating a copyright or the like is concealed in digital image information such as a video to be protected. This identification data cannot be confirmed in a hidden state even if the original digital image data is normally reproduced, but can be reproduced by a specific restoration process.
The data embedding process requires an embedding program including the identification data and an algorithm for embedding the identification data in information. That is, the security-related information includes the identification data (hereinafter referred to as FPD) and the embedding program (referred to as FPA as described later) as information related to the function of protecting rights such as copyright. It is.

[0006]

As described above, when constructing an information providing service system using an information communication network, security-related information is stored in a card module to be distributed to each user, and this card module is stored. There has been proposed a method for realizing an information security function by using the information security function. Further, a similar information security function can be realized by a method of storing security-related information inside an information receiving device without using a card module.

[0007] Generally, an information provider distributes a card module or an information receiving device to users. However, the method provided by the information provider is limited to users at the distribution destination, and it is difficult to spread the method to an unspecified number of users. For this reason, when a user supplied with a card module or an information receiving device from a certain information provider intends to receive an information providing service from another information provider, the reliability of the card module or the information receiving device is guaranteed, That is, it is difficult to execute the service from the aspect of the information security function. Also,
If the information provider is a small company, it is difficult to supply only the card module as well as the information receiving device main body.

Therefore, a CA (cert in public key cryptography) is provided between an information provider and an information receiver (user).
A system in which a card module or an information receiving device is supplied from a third party, which intervenes a third party for guaranteeing reliability corresponding to a certification authority (certificate issuing authority), is assumed. However, in a system in which a third party is merely interposed, it is not always possible to guarantee reliability, that is, to ensure an effective information security function.

[0009] It is an object of the present invention to provide an information providing system in which a third-party organization intervenes to ensure the information security function of the third-party organization, and as a result, the information provider and the user are unnecessarily limited. Instead, to provide an information providing service that can be widely spread.

[0010]

SUMMARY OF THE INVENTION The present invention relates to an information providing system for providing information according to a request from an information provider to a user using an information communication network with a third party intervening. Assume a system in which security-related information necessary for providing information is supplied from a three-party organization.
The user receives the information provided by the information provider,
There is provided an information receiving means for storing security-related information supplied from a third-party organization and transmitting the security-related information to an information provider when a request for information provision is made.

On the other hand, the information provider determines the reliability of the third party based on the security-related information sent from the information receiving means, and if the reliability is assured by the determination processing, the information provider notifies the information receiver. It has information transmitting means for transmitting information according to the request. The information transmitting means has a means for performing a predetermined process for securing a third party whose reliability is guaranteed when the reliability of the third party cannot be confirmed.

The security-related information of the present invention includes, in addition to the identification information of the user and the identification information of the third party, identification data for protecting rights such as copyrights of the information and an embedding program. As supplied to the user. When users receive information,
When the card module is set in the information receiving means, the information receiving means sends the security-related information stored in the card module to the information provider.

The information transmitting means stores list information of the third party whose reliability is guaranteed in advance in the process of determining the reliability of the third party. If the list information includes the identification information of the third party of the security-related information supplied by the card module of the information receiving means, the information transmitting means can guarantee the reliability of the third party. And sends the requested information to the user who has been supplied with the card module from the third party.

On the other hand, if the assurance of the reliability cannot be confirmed, the information transmitting means sends the predetermined third party selected from the list information the reliability of the third party specified by the security-related information. Claim guarantee. If a guarantee is obtained by this request, it is determined that the guarantee of reliability has been confirmed. If the request does not guarantee the information, the information transmitting means sends the list information to the information receiving means, and requests the user to select a new third party. The third-party organization selected from the list information is treated as an organization whose reliability is guaranteed by the information provider. The user requests the newly selected third party to supply the card module, and the above processing is repeated when the card module is supplied.

According to the system having such a configuration, a card module storing security-related information or an information receiving device having a function of storing security-related information is supplied to a user by a third party.
The information provider does not need to distribute the card module or the information receiving device to the user. On the other hand, the information provider receives the supply of security-related information at the time of a request for information provision from the user, and executes a reliability determination process for a third party. If the reliability of the third party is assured, it is determined that the reliability of the user is also assured, and the requested information is provided. Here, even if the reliability cannot be confirmed by the first determination process, the list information includes an indirect guarantee by a third party or a request for the user to change the list information to a third party. As a result of the predetermined processing, a third-party organization whose reliability is guaranteed can be secured.

Therefore, even if it is difficult for the information provider to distribute the card module or the information receiving device containing the security-related information to the user, the card module or the information receiving device can be guaranteed by a third party which can guarantee the reliability. The device can be distributed to users. As a result, even a small-scale information provider who has difficulty distributing the card module or the information receiving device to the user can function as the information provider using the information providing service system. .

[0017]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram illustrating a main part of an information providing service system related to the present embodiment. FIG. 2 is a conceptual diagram illustrating security related information stored in a card module related to the present embodiment. FIG. 4 is a conceptual diagram for explaining a state of information exchange related to the present embodiment, and FIGS. 4 and 5 are flowcharts for explaining an operation of the present embodiment. (System Configuration) In this embodiment, as shown in FIG. 1, an information provider (SP) 3 and a user (SUB, information receiver) are provided by an information communication network 1 such as a computer network (Internet) or a digital broadcasting network. 2
And an information providing service system in which a third party (TTP) 4 is connected to exchange information.

The information provider (SP) 3 has a user (SU)
B) A provider or an individual provider that provides various information (multimedia information) including video and the like in response to a request from 2 and includes a function of providing information related to the present invention and a function of determining reliability. This is a concept including the information transmitting device 30. Therefore, SP3 and the information transmission device 30 may be described as being synonymous.

On the other hand, in this embodiment, the user (SUB) 2 uses the card module 21 and the information receiving device 20 supplied from a third party (hereinafter referred to as TTP) 4 to provide an information provider (SP). ) Request information provision to 3. Note that the user (SUB) 2 is a card module 2
1 or the information receiving device 20. TTP4 is based on CA (ce
It is a third-party organization for guaranteeing reliability corresponding to a certification authority (certificate issuing authority), and distributes a card module 21 storing security-related information to be described later to a user (SUB) 2.

In this embodiment, it is assumed that the card module 21 is used to realize an information security function. Since the present invention can be applied to a method that does not use the card module 21, a method in which the information receiving device 20 stores security-related information may be used. In this case, it is desirable that the information receiving device 20 be supplied to the user by TTP4 from the viewpoint of ensuring reliability.

The information receiving apparatus 20 basically has a function of receiving multimedia information transmitted via the network 1 and outputting the multimedia information to a personal computer or a television receiver selected by the user for reproduction. More specifically, the information receiving apparatus 20 extracts necessary information (various control information such as decryption key information) from the received information, and restores the scrambled information to its original state. And various signal processing circuits such as a descrambler for performing the descrambling process. (Configuration of Card Module) The card module 21
As described above, in the present embodiment, the information is supplied from the TTP 4 for each user, and generally includes a microprocessor (CPU) and a memory. As shown in FIG. 2, the card module 21 has TT
Security related information preset by P4 is stored. The security-related information of this embodiment is F
P program (FPA), identification data (FPD), descrambling key information (KS), user identification information (UI
D), TTP identification information (TTPID), card management number (CID), and shared key information (Kut).

As described above, the FP program (FPA) and the identification data (FPD) are information related to a function for protecting a right such as a copyright. That is, digital
Fingerprint, digital watermarking
ing) or data hiding (hiding)
This is information for performing a type of data embedding process referred to as “data embedding process”. The FP program (FPA) stores the identification data (F
This is an embedding program including an algorithm for embedding (PD) in information. By using the FPA and the FPD, the card module 21 or the information receiving device 20 can be used.
Performs a data embedding process on the provided information. The descrambling key information (KS) is information for causing the descrambler included in the information receiving device 20 to function. (Operation of this Embodiment) The operation of this embodiment will be described below with reference to FIGS.

First, this embodiment assumes that the user (SUB) 2 acquires the card module 21 from the TTP 4 as shown in FIG. 3A (step S).
1). Further, as described above, the user (SUB) 2
The information receiving device 20 may be obtained from TP4.

It is assumed that the card module 21 stores the security-related information of the present embodiment in advance as shown in FIG. This security-related information
It is stored in a state that cannot be easily modified on the user side.

The user (SUB) 2 is configured to be able to provide information by setting the card module 21 in the information receiving device 20. Here, in the present embodiment, as the information provider (SP) 3, a digital broadcast network transmitting multimedia information such as video,
Or multimedia information such as a movie (video / video) at the request of the user via a computer network.
On-demand) providers or individual providers are assumed.

The card module 21 is connected to the information receiving device 20
Is set to, the user (SUB) 2 requests the TTP 4 to issue a management number (SID) and session key information (Kse) for receiving information provision (step S2). The SID and Kse are update information issued from the TTP 4 for each information provision request (each time) and are information included in the security-related information of the present invention. In response to this request, as shown in FIG.
P4 uses SID and Kse information as shared key information (Ku).
The encrypted data is transmitted according to t) (step S3).

[0027] The user (SUB) 2 receives the SI from TTP4.
Upon receiving D and Kse, the information receiving device 20 requests the information provider (SP) 3 to provide information (Req (V)).
Is performed (step S4). At this time, the user (SU
B) 2, via the information receiving device 20, as shown in FIG. 3C, security-related information (SID, TTPID, UID, eKse (CI
D), FPA, FPD) to the information provider (SP) 3. Here, the eKse (CID) is obtained by encrypting the card management number (CID) with the session key information (Kse) obtained from TTP4. As described later, the information provider (SP) 3 provides the information eKse
(CID) is transmitted to TTP4. When transferring such security-related information, a predetermined communication protocol is used to prepare for an information security threat.

On the other hand, when the information provider (SP) 3 receives the information provision request, the information provider (SP) 3 executes a process of determining the reliability of the user (SUB) 2, that is, the card module 21 or the information receiving device 20 (step S5). . In this determination process, a reliability determination process for TTP4 is performed as described later. That is, when the information provider (SP) 3 can confirm the guarantee of the reliability of the TTP 4, the information provider (SP) 3 executes the reliability determination processing for the card module 21 of the user (SUB) 2 (YES in step S6, S7, S7). S8).

Here, it is assumed that the assurance of the reliability of TTP4 has been confirmed. As shown in FIG. 3 (D), the information provider (SP) 3 specifies a management number (SI
D), user identification information (UID), eKse (CID)
And makes a transfer request of FPA and FPD which endorses the validity of the card module 21 (step S).
7).

As shown in FIG. 3E, TTP4 to FTP
When the PA and FPD are transferred, the information provider (SP) 3
Executes a comparison determination process between the FPA and FPD transferred from the TTP 4 and the FPA and FPD transferred from the user (SUB) 2 (step S8). If the results of the comparison match, the information provider (SP) 3 identifies the user (SU).
B) It is determined that the card module 21 of 2 has guaranteed reliability, and the requested information is provided to the user (SUB) 2 (YES in step S9, S10).

Here, if the comparison and determination results do not match,
For example, as described later, as shown in steps S25 and S26 in FIG. 5, the processing shifts to processing for requesting a new card module (NO in step S9). (TTP Reliability Determination Process) Here, the reliability determination process for the TTP 4 of the information provider (SP) 3 will be described with reference to the flowchart of FIG. This reliability determination processing is performed in steps S5 and S6 in FIG.
And a predetermined process.

The information provider (SP) 3 stores in advance list information of a plurality of TTPs whose reliability is guaranteed. The information provider (SP) 3 includes TTP identification information (TTPID) in the security-related information from the user (SUB) 2.
Is determined, and whether or not it is included in the list information is determined (step S20). As a result of this determination, if the TTP 4 contracted with the user (SUB) 2 (to which the card module 21 was supplied) is included in the list information, the information provider (SP) 3 determines that the reliability has been confirmed.
Thereby, the card module 2 of the user (SUB) 2
Then, the process proceeds to the process of determining the reliability of
YES, S7).

On the other hand, when the information is not included in the list information, the information provider (SP) 3 applies a predetermined TTP (b) included in the list information to the TTP 4 to be determined.
If the inquiry of (a) is performed and the reliability can be guaranteed, a certificate issuance is requested (NO in step S21, S
22, S23, S24). In this case, the inquiry is made to a plurality of TTPs included in the list information. When a certificate for guaranteeing the reliability is issued from any of the TTPs, the information provider (SP) 3 determines that the reliability has been confirmed. Thereby, the user (SUB)
The process proceeds to the reliability determination process for the second card module 21 (YES in step S6, S7).

A plurality of TTs included in the list information
If no guarantee of reliability can be obtained from any of P,
The information provider (SP) 3 transmits the list information to the user (SUB).
2 and requests to newly select a TTP included in the list information and acquire a new card module 21 (NO in step S23, S25, S2).
6). When the user (SUB) 2 acquires a new card module 21 from a new TTP, the above-described processing is repeated (processing from step S2).

As described above, according to the present embodiment, in the system in which the card module 21 storing the security-related information for receiving the information provision is supplied from the TTP 4, the information provider (SP) 3 Based on this, first, the reliability determination processing of TTP4 is performed, and further, the reliability determination processing of the card module 21 is performed. Therefore, the information provider (SP) 3 can confirm the reliability of the card module 21 supplied from the TTP 4 whose reliability is ensured, and provides the information providing service to the user whose reliability is guaranteed. Can be performed. At this time, since the guarantee of the reliability of the card module 21 can be confirmed, the data embedding process by the FPA and the FPD provided in the card module 21 is surely executed, and the information provider's right such as copyright is protected. be able to.

With the information providing service system having such a function of guaranteeing reliability, the information provider does not need to supply the card module or the information receiving device to each user, and the information provider concentrates on the information providing business. it can. Therefore,
Even a small-scale information provider who is difficult to supply a card module and an information receiving device can provide an information providing service using the information providing service system.
As a result, the information providing service can be spread without limiting the information provider.

Further, with a system in which a third party (TTP) is interposed, there is an effect that both the fraud by the information provider (SP) 3 and the fraud on the user side can be prevented. In addition, even in the case of a large-scale information provider that can supply a card module or an information receiving device, the information providing service can be started without supplying the card module or the information receiving device. , The required time can be greatly reduced.

In this embodiment, the system using the card module 21 has been described. However, as described above, the TTP is applied to the information receiving apparatus 20 without using the card module 21. A method of supplying relation information may be used. In this method, of course, the information provider, together with the process of determining the reliability of TTP,
The reliability determination process for the information receiving device 20 is executed.

[0039]

As described above in detail, according to the present invention, in an information providing system in which a third party is interposed, the information provider performs reliability determination processing for both the third party and the user. By doing so, it is possible to confirm the guarantee of reliability. Therefore, in providing information as a result, the information security function by the third party can be reliably guaranteed. As a result, the information provider can provide an information providing service to the user without supplying a reliable information receiving device or the like. In other words, the information provider and the user are not unnecessarily limited, and the information providing service can be widely spread.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a system configuration related to an embodiment of the present invention.

FIG. 2 is a conceptual diagram showing contents of storage information of a card module related to the embodiment.

FIG. 3 is a conceptual diagram for explaining a state of information exchange related to the embodiment.

FIG. 4 is a flowchart for explaining the operation of the embodiment.

FIG. 5 is a flowchart for explaining the operation of the embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Network 2 ... User (SUB) 3 ... Information provider (SP) 4 ... Third party organization (TTP, certificate issuing organization) 20 ... Information receiving apparatus 21 ... Card module 30 ... Information transmitting apparatus

Claims (11)

[Claims] Claims 1. An information provider provides information to an information receiver according to a request using an information communication network, and the information is provided by a third party which is an intermediary between the information provider and the information receiver. An information providing system having a security function, comprising: receiving information provided by the information provider, and providing security-related information required when receiving information provision from the information provider from the third party. Receive and save,
Information receiving means for transmitting the security-related information to the information provider at the time of requesting the information provision; and, based on the security-related information transmitted from the information receiving means at the time of the information provision request from the information receiver. The reliability of the third party is determined, and if the reliability is assured by the determination process, the information according to the request is transmitted to the information receiver, and the reliability cannot be confirmed by the determination process. An information transmitting means for performing a predetermined process for securing a third-party organization whose reliability is guaranteed in such a case. 2. The security-related information includes identification information of the information receiver, identification information of the third-party organization, and encryption key information, and the information receiving unit transmits the security-related information to the information provider. When transmitting the security-related information, the information-transmitting means includes means for encrypting predetermined information included in the security-related information using the encryption key information. Based on the security-related information requested to the three-party organization, the reliability of the third party is determined, and if the reliability is guaranteed, the reliability of the information receiver is guaranteed. 2. The information providing system according to claim 1, further comprising means for checking. 3. The information transmitting means prepares list information of a third party whose reliability is guaranteed in advance, and when the reliability cannot be confirmed by a determination process for determining the reliability of the information receiver. Means for requesting a third party selected from the list information to guarantee the reliability of the third party that sent the security-related information to the information receiving means. Means for sending the list information to the information receiving means when the guarantee cannot be obtained, and requesting the information receiver to select a new third party organization. The information providing system according to claim 1, wherein 4. The information security function includes the identification data included in the security-related information and the embedding program, the identification data for protecting a right such as a copyright of the information, and the identification data included in the information. Means for concealingly embedding the identification data in the information provided by the information provider using the embedding program for executing data embedding processing for concealing embedding in the information receiving means The information providing system according to claim 1, further comprising: 5. Sending a request of an information receiver to an information provider using an information communication network, receiving information provided by the information provider, and determining the information provider and the information receiver. An information receiving apparatus for receiving and storing security-related information related to an information security function from a third-party organization that is an intermediary of the identification data and the embedding program included in the security-related information, Providing the information by using the identification data for protecting a right such as a copyright of the information and the embedding program for executing a data embedding process for concealingly embedding the identification data in the information; Means for concealingly embedding the identification data in information provided by a user, and an information receiver when receiving information provision from the information provider Sending means for sending the identification information, the identification information of the third-party organization, the identification data and the embedding program to the information provider, and the security-related information sent by the sending means. After the information provider has performed the reliability determination process based on the information provider, if the information provider cannot confirm the assurance of the reliability, the third party is renewed in response to a request from the information provider. Means for requesting the supply of new security-related information by changing to a third-party organization. 6. An information receiver transmits information in response to a request from an information receiver to an information provider using an information communication network, and receives information from a third party which is an intermediary between the information provider and the information receiver. An information transmission device having a function of determining the reliability of the information recipient based on security-related information related to an information security function, wherein the security-related information is identification information of the information recipient,
In addition to the identification information of the third-party organization, the identification data for protecting the copyright and other rights of the information and the data for executing a data embedding process for concealingly embedding the identification data in the information. Means for requesting the information receiver from the information receiver at the time of requesting information provision from the information receiver, and storing list information of a third-party organization whose reliability is guaranteed in advance. Means, when determining the reliability of the third party based on the security-related information, if the assurance of reliability can be confirmed, send information to the information receiver in response to a request, If the assurance of reliability cannot be confirmed, the reliability of the third party that sent the security-related information to the information receiving means to the third party selected from the list information Requesting a certificate, and if a guarantee corresponding to the request cannot be obtained, sending the list information to the information receiving means and selecting a new third party for the information receiver. Requesting means. 7. An information provider provides information according to a request to an information receiver using an information communication network, and the information is provided by a third party organization that is an intermediary between the information provider and the information receiver. An information providing system to which security-related information related to a security function is supplied, comprising: receiving information provided by the information provider and the security-related information supplied by the third party;
An information receiving device that sends the security-related information to the information provider at the time of the information providing request; and an information receiving device that is detachably attached to the information receiving device and supplied from the third party through the information receiving device. A card module for storing the security-related information and outputting the security-related information to the information receiving device when the information provision request is made; and transmitting the information from the information receiving device when the information recipient requests information provision. Determining the reliability of the information receiver based on the security-related information obtained, transmitting information according to the request to the information receiver whose reliability is guaranteed by the determination processing, and determining the reliability by the determination processing. If the assurance of the third party cannot be confirmed, an information transmitting device for performing processing for ensuring the reliability of the third party is provided. Information providing system to. 8. The information transmitting apparatus stores in advance list information of a third party whose reliability is guaranteed, and when the reliability of the third party is determined based on the security-related information, If the assurance of reliability cannot be confirmed, a request is made to the third party selected from the list information for assurance of the reliability of the third party that sent the security-related information to the information receiving device. Means for sending the list information to the information receiving apparatus when the corresponding guarantee cannot be obtained, and requesting the information receiver to select a new third party organization. The information providing system according to claim 7, wherein: 9. The security-related information includes, in addition to the identification information of the information receiver and the identification information of the third party organization, the identification data for protecting rights such as copyright of the information and the identification data. The card module includes the embedding program for executing a data embedding process for concealing embedding in the card module, the card module stores the identification data by the stored embedding program, and the information receiving device transmits the identification data from the information transmitting device. Means for executing a process of embedding in the received information, wherein the information transmitting device confirms the reliability of the third party based on the security related information, and then requests the third party The identification data and the embedding program included in the relationship information, and the car via the information receiving device. 8. The apparatus according to claim 7, further comprising means for comparing and determining the identification data obtained from a module with each of the embedding programs, and executing authentication processing of the information receiver based on a result of the comparison and determination. The information providing system according to claim 8. 10. An information provider provides information according to a request to an information receiver using an information communication network, and information is provided by a third party which is an intermediary between the information provider and the information receiver. An information providing system having a security function, wherein the information receiver has a function of storing and supplying security-related information necessary when the information receiver receives information provision from the information provider from the third party organization. Information security applied to the information providing system having information transmitting means having means for determining the reliability of the third party when the information provider requests information provision from the information receiver. A method wherein the information receiving means receives the security-related information from the third party organization and stores the information in a storage means; Executing a request for information provision to the information provider via a receiving means, and transmitting the security-related information to the information provider; and the information provider performs a determination function of the information transmitting means,
A process of determining the reliability of the third party based on the security-related information transmitted from the information receiving means; and a case where the reliability of the third party is confirmed by the determination result of the determination function. The reliability of the information receiver is determined by comparing and determining the security-related information transmitted from the third-party organization and the security-related information transmitted from the information receiving means. Sending the information according to the request to the information receiver, and if the third party's assurance of reliability cannot be confirmed by the determination result of the determination function, And a process of requesting the information recipient to re-execute a series of processes in response to the request for providing the information. 11. The information transmitting means stores in advance list information of a third party whose reliability is guaranteed, and determines the reliability of the third party based on the security-related information. If the guarantee of reliability cannot be confirmed, a process of requesting the third party selected from the list information to guarantee the reliability of the third party that sent the security-related information to the information receiving device; If a guarantee corresponding to this request cannot be obtained, the list information is sent to the information receiving means to request the information receiver to select a new third party. 11. The information security method according to claim 10, wherein: