WO2009113154A1 - Id managing system and id managing method - Google Patents
Id managing system and id managing method Download PDFInfo
- Publication number
- WO2009113154A1 WO2009113154A1 PCT/JP2008/054321 JP2008054321W WO2009113154A1 WO 2009113154 A1 WO2009113154 A1 WO 2009113154A1 JP 2008054321 W JP2008054321 W JP 2008054321W WO 2009113154 A1 WO2009113154 A1 WO 2009113154A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- management
- main
- sub
- management device
- allocation
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
Definitions
- the present invention relates to an ID management system and an ID management method for managing a primary ID and a secondary ID issued in response to a request from a user.
- the service user may have a large number of IDs for each use, such as a company employee ID, a supermarket customer ID, and an insurance contractor ID.
- IDs for each use, such as a company employee ID, a supermarket customer ID, and an insurance contractor ID.
- a company employee ID such as a company employee ID, a supermarket customer ID, and an insurance contractor ID.
- an insurance contractor ID such as a company employee ID, a supermarket customer ID, and an insurance contractor ID.
- the student ID and policyholder ID are owned by the same person. It may be necessary to manage something. Therefore, conventionally, for example, an ID management device provided in an insurance company that needs to manage that a student ID and a contractor ID are held by the same person is contracted with the student ID. The correspondence with the person ID is associated and managed.
- the present invention has been made to solve the above-described problems of the prior art, and an ID management system and an ID that can prevent the correspondence between different types of IDs having different uses from being exposed.
- the purpose is to provide a management method.
- the present invention provides a user terminal used by a user, a main ID management device that manages a main ID for identifying the user for the first use,
- An ID management system including a secondary ID management device for managing a secondary ID for identifying a user for the second use, wherein the primary ID management device includes a primary ID and the secondary ID management.
- the sub-ID management means for managing the sub ID, the main ID management device ID for specifying the main ID management device, and the allocation management ID in association with each other is a requirement.
- the sub ID management means manages the main ID management device ID and the allocation management ID that are different for each main ID management device in association with the sub ID. To do.
- the secondary ID management device requests a secondary ID generation means for generating a secondary ID and a login by a primary ID when receiving a secondary ID issue request from the user terminal.
- the main ID to be associated with the sub-ID generated by the sub-ID generation means is whether or not the user of the user terminal that is the user and the user of the user terminal that is the transmission source of the sub-ID issue request is the same person.
- the same person confirmation means for confirming in cooperation with the managing main ID management device, the user terminal user who requests the login request, and the user terminal user who is the transmission source of the sub ID issue request are the same person.
- an allocation management ID generating unit that generates an allocation management ID to be indicated; and an allocation management that transmits the allocation management ID generated by the allocation management ID generating unit to a main ID management device that manages a main ID to be associated with the sub ID
- a sub-ID allocation management information recording unit that records the allocation management ID generated by the generating unit in association with each other; and when the recording by the sub-ID allocation management information recording unit is completed, the transmission source of the sub-ID issue request A sub-ID transmission unit that transmits the sub-ID generated by the sub-ID generation unit to the user terminal, wherein the main ID management device An allocation management ID receiving means for receiving an allocation management ID from the D management apparatus; an allocation management ID
- the present invention also issues and manages a primary ID for identifying a user for the first use, and issues and manages a sub-ID for identifying the user for the second use.
- An ID management method wherein a primary ID management device that manages a primary ID includes a primary ID, a secondary ID management device ID for specifying a secondary ID management device that manages a secondary ID, a secondary ID, and a primary ID.
- the secondary ID management device that manages the secondary ID includes a primary ID management step that causes the primary ID management device to manage the primary ID management device in association with the allocation management ID for specifying the correspondence relationship.
- the secondary ID management device manages the secondary ID and the primary ID. It is a requirement to include a sub-ID management step in which a main ID management device ID for specifying an ID management device and an allocation management ID are associated with each other and managed by the sub-ID management device.
- the present invention requires that the sub ID management step manages a different main ID management device ID and allocation management ID for each main ID management device in association with the sub ID. To do.
- the secondary ID management device when receiving a secondary ID issue request from a user terminal used by a user, a secondary ID generation step of generating a secondary ID, a user of a user terminal requesting login by a primary ID, Cooperation with the main ID management apparatus that manages the main ID to be associated with the sub ID generated by the sub ID generation step, as to whether or not the user of the user terminal that is the transmission source of the sub ID issue request is the same person
- the same person confirmation step confirms that the user of the user terminal that requests the login request and the user of the user terminal that is the transmission source of the sub ID issue request are the same person. If confirmed, it indicates the correspondence between the sub ID generated in the sub ID generation step and the main ID to be associated with the sub ID.
- a transmission step, a sub ID generated by the sub ID generation step, a main ID management device ID for specifying a main ID management device that manages a main ID to be associated with the sub ID, and the allocation management ID generation When the recording by the sub ID allocation management information recording step for recording the allocation management ID associated with the step in association with each other and the recording by the sub ID allocation management information recording step are completed, the transmission source of the sub ID issue request is A sub-ID transmission step of transmitting the sub-ID generated by the sub-ID generation step to a certain user terminal.
- the primary ID management device includes an allocation management ID receiving step for receiving an allocation management ID from the secondary ID management device, an allocation management ID received by the allocation management ID receiving step, and a transmission source of the allocation management ID. It is a requirement that it further includes a main ID assignment management information recording step of recording a sub ID management device ID for specifying a certain sub ID management device in association with a main ID that has requested login.
- the anonymity of the primary ID and the secondary ID is maintained, and the secondary ID can be issued on the condition that the primary ID exists.
- FIG. 1 is a diagram for explaining the outline and features of the ID management system according to the first embodiment.
- FIG. 2 is a diagram illustrating a system configuration of the ID management system according to the first embodiment.
- FIG. 3 is a block diagram illustrating the configuration of the main ID management apparatus according to the first embodiment.
- FIG. 4 is a diagram illustrating a configuration example of the main ID management information and the sub ID management information according to the first embodiment.
- FIG. 5 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the first embodiment.
- FIG. 6 is a diagram illustrating a process flow of the ID management system according to the first embodiment.
- FIG. 7 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the second embodiment.
- FIG. 1 is a diagram for explaining the outline and features of the ID management system according to the first embodiment.
- FIG. 2 is a diagram illustrating a system configuration of the ID management system according to the first embodiment.
- FIG. 3 is a block diagram illustrating the configuration of
- FIG. 8 is a diagram illustrating a process flow of the ID management system according to the second embodiment.
- FIG. 9 is a diagram illustrating a process flow of the ID management system according to the second embodiment.
- FIG. 10 is a diagram for explaining the features of the ID management system according to the third embodiment.
- FIG. 11 is a diagram illustrating a system configuration of the ID management system according to the third embodiment.
- FIG. 12 is a diagram illustrating a configuration example of main ID management information and sub ID management information according to the third embodiment.
- FIG. 13 is a diagram illustrating a process flow of the ID management system according to the third embodiment.
- FIG. 14 is a diagram illustrating a process flow of the ID management system according to the third embodiment.
- FIG. 15 is a diagram illustrating a process flow of the ID management system according to the third embodiment.
- FIG. 16 is a diagram illustrating an overview of an ID management system according to the fourth embodiment.
- Example 1 will be described as an embodiment of the ID management system according to the present invention, and then other embodiments included in the ID management system according to the present invention will be described in other examples.
- FIG. 1 is a diagram for explaining the outline and features of the ID management system according to the first embodiment.
- the ID management system outlines the management of the primary ID and the secondary ID issued in response to a request from the user, but the correspondence between different types of IDs with different uses is exposed.
- the main feature is to prevent.
- the ID management system includes a user terminal used by a user and a main ID management device that manages a main ID that issues a main ID for uniquely identifying the user. And a sub-ID management device that issues a sub-ID for uniquely identifying a virtual person used by the user on the network.
- the main ID management device uses the main ID, the sub ID management device ID for specifying the sub ID management device, the allocation management ID for specifying the correspondence between the sub ID and the main ID, and the main ID.
- Personal information for example, user bank account information and credit number information for use in a payment processing service, name and address for use in a logistics service, etc. is managed in association with each other.
- the secondary ID management device manages the secondary ID, the primary ID management device ID for specifying the primary ID management device, and the allocation management ID in association with each other.
- the ID management system according to the first embodiment can prevent the correspondence between different types of IDs having different uses from being exposed, like the main feature described above.
- FIG. 2 is a diagram illustrating a system configuration of the ID management system according to the first embodiment.
- FIG. 3 is a block diagram illustrating the configuration of the main ID management apparatus according to the first embodiment.
- FIG. 4 is a diagram illustrating a configuration example of the main ID management information and the sub ID management information according to the first embodiment.
- FIG. 5 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the first embodiment.
- the ID management system includes a user terminal 300 used by a user, and a main ID management device 100 that manages a main ID that issues a main ID for uniquely identifying the user. And a sub ID management device 200 that issues a sub ID for uniquely identifying a virtual person used by the user on the network. Further, the user terminal 300, the main ID management device 100, and the sub ID management device 200 are connected to each other so that they can communicate with each other via a network, and the main ID management device 100 and the sub ID management device 200 are connected to each other. They are connected so that they can communicate with each other via a network.
- the main ID management device 100 includes a storage unit 110 and a control unit 120.
- the storage unit 110 is a storage unit that stores data and programs necessary for various processes performed by the control unit 120.
- the storage unit 110 includes main ID management information 111 that is closely related to the present invention.
- the main ID management information 111 corresponds to “main ID management means” described in the claims.
- the main ID management information 111 includes a main ID issued in advance for uniquely identifying a user and a main ID for authenticating the user of the user terminal 300 that has logged in using the main ID.
- Authentication data for example, a password
- a sub ID management device ID for specifying the sub ID management device 200 connected in a communicable state
- An allocation management ID for specifying the correspondence relationship with the main ID (link relationship between the sub-ID and the main ID), and personal information (for example, a payment processing service) of the user specified by the main ID (not shown)
- the control unit 120 has a predetermined control program, a program defining various processing procedures, and an internal memory for storing necessary data, and executes various processes using these, and is particularly suitable for the present invention.
- a data transmission / reception unit 121, an owner confirmation unit 122, and a data registration unit 123 are provided.
- the data transmission / reception unit 121 is a processing unit that performs transmission / reception of data between the user terminal 300 and the sub-ID management device 200. Specifically, the data transmission / reception unit 121 receives the main ID and the main ID password when accepting login from the user terminal 300.
- the data transmitting / receiving unit 121 receives a request for assigning a main ID to a sub ID from the user terminal 300 and also receives an assignment management ID from the sub ID management device 200.
- This assignment processing request includes data for identity verification.
- the data transmission / reception unit 121 receives a request for assigning a main ID to a sub-ID from the user terminal 300, the authentication result of the main ID by the owner confirmation unit 122, which will be described later, and the personal identification data included in the assignment processing request
- the allocation management ID issuance request combined with the above is transmitted to the secondary ID management device 200.
- the data transmission / reception unit 121 transmits a main ID assignment process completion notification to the user terminal 300.
- the owner confirmation unit 122 is a processing unit that authenticates the main ID when a login by the main ID is accepted. Specifically, the owner confirmation unit 122 confirms whether or not the main ID acquired at the time of login is already registered in the main ID management information 111. When the main ID is already registered, the owner confirmation unit 122 acquires the main ID password stored in the main ID management information 111 in association with the main ID, and logs in the main ID at the time of login. Compared with the main ID password received together with the ID, authentication is performed as to whether or not the owner is a valid owner of the main ID.
- the data registration unit 123 is a processing unit that registers assignment management IDs and the like. Specifically, when the data management unit 121 receives the allocation management ID from the data transmission / reception unit 121, the data registration unit 123 identifies the allocation management ID and the secondary ID management device 200 that is the transmission source of the allocation management ID. The ID management device ID and the main ID acquired at the time of login reception are stored in the main ID management information 111 in association with each other.
- the secondary ID management device 200 includes a storage unit 210 and a control unit 220.
- the storage unit 210 is a storage unit that stores data and programs necessary for various processes performed by the control unit 220.
- the storage unit 210 includes sub-ID management information 211 that is closely related to the present invention.
- the secondary ID management information 211 corresponds to “secondary ID management means” recited in the claims.
- the sub ID management information 211 includes a sub ID issued to uniquely identify a virtual person used by the user on the network, and the user terminal 300 that logs in using the sub ID.
- sub-ID authentication data for example, password
- main ID management device ID for specifying the main ID management device 100 connected in a communicable state
- sub-ID management device 200 An allocation management ID for specifying the correspondence between the sub ID issued to the user and the main ID (link relationship between the sub ID and the main ID) is stored.
- the primary ID “aaaaaa” in the primary ID management information is changed to the secondary ID “FJS” in the secondary ID management information, It is associated with the allocation management ID “8h49i”.
- the control unit 220 has a predetermined control program, a program defining various processing procedures, and an internal memory for storing necessary data, and performs various processing using these, and is particularly suitable for the present invention.
- a data transmission / reception unit 221, a sub ID generation unit 222, an identity verification data generation unit 223, an allocation management ID generation unit 224, and a data registration unit 225 are provided.
- the data transmission / reception unit 221 is a processing unit that transmits and receives data between the user terminal 300 and the main ID management device 100. Specifically, a sub ID issue request, a personal identification data issue request, and a sub ID transmission request are received from the user terminal 300, and a sub ID and a sub ID password generated by a sub ID generation unit 222, which will be described later, The identity verification data generated by the identity verification data generation unit 223 is transmitted to the user terminal 300.
- the data transmission / reception unit 221 receives an allocation management ID issue request from the main ID management device 100 and transmits an allocation management ID to the main ID management device 100.
- the secondary ID generation unit 222 is a processing unit that generates a secondary ID. Specifically, when the data transmission / reception unit 221 receives a sub ID issue request from the user terminal 300, it generates a sub ID and a sub ID password.
- the personal identification data generation unit 223 is a processing unit that generates personal identification data. Specifically, when the data transmission / reception unit 221 receives a personal identification data issuance request from the user terminal 300, personal identification data is generated.
- the allocation management ID generation unit 224 is a processing unit that generates an allocation management ID for specifying the correspondence between the sub ID and the main ID (the link relationship between the sub ID and the main ID). Specifically, when the data transmission / reception unit 221 receives an allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID. When the personal identification data included in the allocation management ID issuance request matches the personal identification data transmitted to the user terminal 300, an allocation management ID is generated.
- the data registration unit 225 is a processing unit that registers a sub ID, an allocation management ID, and the like. Specifically, in order to identify the secondary ID generated by the secondary ID generation unit 222, the allocation management ID generated by the allocation management ID generation unit 224, and the main ID management device 100 that is the transmission destination of the allocation management ID. Are stored in the secondary ID management information 211 in association with each other.
- FIG. 6 is a diagram illustrating a process flow of the ID management system according to the first embodiment.
- the sub ID management apparatus 200 when the user terminal 300 transmits a sub ID issue request to the sub ID management apparatus 200 (step S601), the sub ID management apparatus 200 generates a sub ID and a sub ID password (step S602). ) And stored in the sub ID management information 211 (step S603).
- the user terminal 300 transmits a request for issuing personal identification data to the sub ID management device 200. (Step S605).
- the secondary ID management device 200 generates identity verification data (step S606), and transmits the generated identity verification data to the user terminal 300 (step S607).
- the user terminal 300 When the user terminal 300 receives the personal identification data from the secondary ID management device 200, the user terminal 300 attempts to log in to the main ID management device 100 using the main ID and the main ID password received from the user (step S608).
- the main ID management device 100 checks whether or not the main ID acquired at the time of login is already registered in the main ID management information 111 (step S609).
- the main ID management device 100 acquires the main ID password stored in the main ID management information 111 in association with the main ID, and logs in the main ID at the time of login. Compared with the main ID password received together with the ID, authentication is performed as to whether or not the owner is a valid owner of the main ID (step S610).
- the user terminal 300 transmits a request for assigning the main ID to the sub ID following the login to the main ID management apparatus 100 (step S611).
- the main ID management device 100 receives the request for assigning the main ID to the sub-ID from the user terminal 300, the assignment management ID issuance request that combines the authentication result of the main ID and the personal identification data included in the assignment processing request. Is transmitted to the secondary ID management device 200 (step S612).
- the secondary ID management device 200 When the secondary ID management device 200 receives the allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID and the allocation management. It is confirmed whether or not the identity confirmation data included in the ID issuance request matches the identity confirmation data transmitted to the user terminal 300 (step S613). Then, the secondary ID management device 200 generates an allocation management ID when the personal identification data included in the allocation management ID issuance request matches the personal identification data transmitted to the user terminal 300 (step S614). .
- the secondary ID management device 200 identifies the allocation management ID and the primary ID management device 100 that is the transmission destination of the allocation management ID in association with the secondary ID that has been generated and registered in the secondary ID management information 211.
- the main ID management device ID is stored (step S615), and the allocation management ID is transmitted to the main ID management device 100 (step S616).
- the primary ID management device 100 is acquired at the time of log-in reception, the allocation management ID received from the secondary ID management device 200, the secondary ID management device ID for identifying the secondary ID management device 200 that is the transmission source of the allocation management ID.
- the main ID is stored in the main ID management information 111 in association with each other (step S617), and a main ID assignment process completion notification is transmitted to the user terminal 300 (step S618).
- the user terminal 300 When the user terminal 300 receives the main ID assignment processing completion notification from the main ID management device 100, the user terminal 300 transmits a sub ID transmission request to the sub ID management device 200 (step S619).
- the secondary ID management device 200 transmits the secondary ID and the secondary ID password to the user terminal 300 (step S620).
- the user terminal 300 notifies the user of the sub ID and the sub ID password received from the sub ID management device 200 (step S621).
- the main ID management device 100 has a correspondence between the main ID, the sub ID management device ID for specifying the sub ID management device 200, and the sub ID and the main ID.
- the sub-ID management device 200 manages the sub-ID and the main ID management device 100 in association with the assignment management ID for specifying the ID and the personal information of the user specified by the main ID in association with each other.
- the ID management device ID and the allocation management ID are managed in association with each other.
- the main ID management apparatus 100 and the sub ID management apparatus 200 are distributed and managed, and the main ID, the sub ID, and the allocation management ID are associated with each other, thereby informing the main ID management apparatus 100 of the sub ID.
- necessary information can be exchanged between the devices based on the assigned management ID without notifying the secondary ID management device 200 of the primary ID, and it is assumed that the primary ID management device 100 or the secondary ID management device 200 Even if any one of the managed information is exposed, it is possible to prevent the correspondence between the primary ID and the secondary ID from being exposed.
- the secondary ID management device 200 when the main ID management device 100 authenticates that the main ID of the user who logs in to the main ID management device 100 is the main ID of a valid user, the secondary ID management device 200 Since the sub ID is provided and assigned to the main ID in response to a request from the user, the anonymity of the main ID and the sub ID can be maintained and the sub ID can be issued on condition that the main ID exists. There is an effect. In addition, when a problem occurs in providing a service using the sub-ID, there is an effect that the responsibility corresponding to the user corresponding to the main ID can be pursued as necessary.
- the issuing procedure of the sub ID of the ID management system according to the present invention is not limited to the issuing procedure (see FIG. 6) described in the first embodiment. Therefore, in the following second embodiment, another form of the sub ID issuing procedure will be described.
- FIG. 7 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the second embodiment.
- the configuration of the ID management system according to the second embodiment is basically the same as that of the ID management system according to the first embodiment, but differs in the points described below.
- the encryption main ID acquired at the time of login is a secret key corresponding to the public key used for encryption.
- the main ID is obtained by decryption, and it is confirmed whether or not this main ID is already registered in the main ID management information 111.
- the owner confirmation unit 122 of the main ID management device 100 stores the main ID password stored in the main ID management information 111 in association with the main ID. And authenticate whether or not it is a legitimate owner of the main ID by comparing the main ID password obtained by decrypting the encrypted main ID password received with the encryption main ID at the time of login with a secret key. Do.
- the data transmission / reception unit 121 of the main ID management device 100 transmits an allocation management ID issuance request including the authentication result of the main ID by the owner confirmation unit 122 to the sub ID management device 200.
- the data transmission / reception unit 121 of the main ID management apparatus 100 transmits a main ID assignment process completion notification to the sub ID management apparatus 200.
- the main ID authentication request unit 226 of the sub ID management device 200 uses the data transmission / reception unit 221 to transfer the sub ID to the sub ID together with the main ID management device ID, the encryption main ID, and the encryption main ID password.
- the main ID assignment processing request is received from the user terminal 300, login to the main ID management device 100 is attempted using the encryption main ID and the encryption main ID password.
- the allocation management ID generation unit 224 of the secondary ID management device 200 receives the allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID. If it is, an allocation management ID is generated.
- the data transmission / reception unit 221 of the secondary ID management device 200 When the data transmission / reception unit 221 of the secondary ID management device 200 receives the main ID assignment processing completion notification from the main ID management device 100, it transfers the main ID assignment processing completion notification to the user terminal 300.
- the owner confirmation unit 122 of the main ID management device 100 generates confirmation data (challenge data) and transmits it to the sub ID management device 200 when the main ID is already registered.
- the owner confirmation unit 122 of the main ID management device 100 receives the encryption confirmation data from the sub ID management device 200, the owner confirmation unit 122 associates the main ID management information 111 with the main ID that has been confirmed as being registered first. Obtain the stored main ID password, compare the encryption confirmation data created by encrypting the confirmation data using the main ID password, and the encryption confirmation data received from the secondary ID management device 200, Authentication is performed as to whether or not the owner of the main ID is valid.
- the main ID authentication request unit 226 of the secondary ID management device 200 receives a request for assigning a primary ID to the secondary ID from the user terminal 300 together with the primary ID management device ID and the encryption main ID by the data transmission / reception unit 221. Then, login to the main ID management device 100 is attempted using the encryption main ID.
- the data transmission / reception unit 221 of the secondary ID management device 200 When the data transmission / reception unit 221 of the secondary ID management device 200 receives the confirmation data from the main ID management device 100, the data transmission / reception unit 221 transfers the received confirmation data to the user terminal 300 and receives the encryption confirmation data from the user terminal 300. The confirmation data is transferred to the main ID management device 100.
- FIGS. 8 and 9 are diagrams illustrating a process flow of the ID management system according to the second embodiment.
- Steps S804 to S815, steps S819, and S820 shown in FIG. 8 are different from the processing of the ID management system according to the first embodiment.
- the user terminal 300 when the user terminal 300 receives input of the main ID, the main ID password, and the main ID management device ID from the user (step S804), the user terminal 300 acquires the public key of the main ID management device 100 (step S805).
- the main ID is encrypted using the key to create an encrypted main ID (step S806).
- the user terminal 300 encrypts the main ID password using the public key of the main ID management device 100 to create an encrypted main ID password (step S807), and the main ID management device ID, encryption main ID, and encryption Along with the main ID password, a request for assigning the main ID to the sub ID is transmitted to the sub ID management apparatus 200 (step S808).
- the secondary ID management device 200 When the secondary ID management device 200 receives a request for assigning the primary ID to the secondary ID together with the primary ID management device ID, the cryptographic primary ID, and the cryptographic primary ID password from the user terminal 300, the secondary ID management device 200 uses the cryptographic primary ID and the cryptographic primary ID. A login to the main ID management device 100 is attempted using the password (step S809).
- the main ID management device 100 When receiving the login from the secondary ID management device 200, the main ID management device 100 acquires the main ID by decrypting the encryption main ID acquired at the time of login with the private key corresponding to the public key used for encryption. (Step S810), it is confirmed whether or not the main ID is already registered in the main ID management information 111 (Step S811).
- the main ID management device 100 decrypts the encryption main ID password received together with the encryption main ID at the time of login with the secret key, and obtains the main ID password. Whether it is a legitimate owner of the main ID as compared with the main ID password stored in the main ID management information 111 in association with the main ID acquired (step S812) and confirmed as registered No authentication is performed (step S813).
- the main ID management device 100 transmits an allocation management ID issue request including the authentication result of the main ID to the sub ID management device 200 (step S814).
- the main ID management apparatus 100 transmits a main ID allocation process completion notification to the secondary ID management apparatus 200 (step S819).
- the secondary ID management apparatus 200 Upon receiving the main ID assignment process completion notification from the main ID management apparatus 100, the secondary ID management apparatus 200 transfers the main ID assignment process completion notice to the user terminal 300 (step S820).
- processing of the ID management system shown in FIG. 9 is different from the processing described above with reference to FIG. 8 in the points described below.
- the user terminal 300 encrypts the main ID using the public key of the main ID management device 100 to create an encrypted main ID (step S906), and sends the sub ID to the sub ID together with the main ID management device ID and the encryption main ID.
- the main ID assignment processing request is transmitted to the sub ID management device 200 (step S907).
- the secondary ID management device 200 When the secondary ID management device 200 receives a request for assigning a primary ID to the secondary ID together with the primary ID management device ID and the encryption main ID from the user terminal 300, the secondary ID management device 200 attempts to log in to the primary ID management device 100 using the encryption main ID. (Step S908).
- the main ID management device 100 When the main ID is already registered, the main ID management device 100 generates confirmation data (challenge data) and transmits it to the sub ID management device 200 (step S912).
- the sub ID management device 200 When the sub ID management device 200 receives the confirmation data from the main ID management device 100, the sub ID management device 200 transfers the received confirmation data to the user terminal 300 (step S913).
- the user terminal 300 When the user terminal 300 receives the confirmation data from the secondary ID management apparatus 200, the user terminal 300 encrypts the confirmation data using the main ID password and creates encrypted confirmation data (step S914). Then, the user terminal 300 transmits the encryption confirmation data to the sub ID management device 200 (step S915). When receiving the encryption confirmation data from the user terminal 300, the secondary ID management device 200 transfers the received encryption confirmation data to the main ID management device 100 (step S916).
- the primary ID management device 100 When the primary ID management device 100 receives the encryption confirmation data from the secondary ID management device 200, the primary ID password stored in the primary ID management information 111 in association with the primary ID that has been previously confirmed as registered. And the encryption confirmation data created by encrypting the confirmation data using the main ID password is compared with the encryption confirmation data received from the sub-ID management device 200, and the authorized owner of the main ID Authentication of whether or not there is is performed (step S917).
- the present invention is not limited to this and is separately provided for each type of personal information of the user. Information of a plurality of main ID management devices that hold the personal information may be managed respectively.
- the features, configuration, and processing of the ID management system according to the third embodiment will be described in order.
- FIG. 10 is a diagram for explaining the features of the ID management system according to the third embodiment.
- the ID management system outlines the management of the main ID and the sub ID issued in response to a request from the user, as in the above-described embodiment, but for each type of personal information of the user.
- the main feature is that each piece of information of a plurality of main ID management devices having separate personal information is managed.
- main ID management device A main ID management device ID: 0020
- main ID management apparatus B for example, information that supports logistics such as address and family register information
- main ID for example, “kx010”
- the secondary ID management device S manages information.
- the secondary ID management device S has a secondary ID (for example, “FJS”) issued in response to a request from the user and a primary ID (for example, “aaaaaa”) issued by the primary ID management device A to the user.
- a secondary ID for example, “FJS”
- a primary ID for example, “aaaaaa”
- the main ID management device ID “0020” and the assignment of the main ID management device A The management ID “8h49i”, the main ID management device ID “3350” and the allocation management ID “00230” of the main ID management device B are managed together.
- the main information managing personal information associated with the process is managed. It is possible to exchange with the ID management device individually.
- FIG. 11 is a diagram illustrating a system configuration of the ID management system according to the third embodiment.
- FIG. 12 is a diagram illustrating a configuration example of main ID management information and sub ID management information according to the third embodiment.
- the ID management system according to the third embodiment has basically the same configuration as the above-described embodiment, but differs in the points described below.
- the ID management system includes a user terminal 300 used by a user and a plurality of main IDs that manage a main ID that issues a main ID for uniquely identifying the user.
- the management apparatus 100 includes a secondary ID management apparatus 200 that issues a secondary ID for uniquely identifying a virtual person used by a user on the network.
- the user terminal 300, each main ID management device 100, and the sub ID management device 200 are connected to each other so that they can communicate with each other via a network, and each main ID management device 100 and each sub ID management device 200 are connected. Are connected to each other so that they can communicate with each other via a network.
- the sub ID management information 211 includes a sub ID issued to uniquely identify a virtual person used by the user on the network, and a user terminal that logs in using the sub ID.
- Sub ID authentication data for example, a password
- main ID management device ID for identifying each main ID management device 100 connected in a communicable state
- sub ID management The apparatus 200 is configured to store an allocation management ID for specifying a correspondence relationship (link relationship between the sub ID and the main ID) between the sub ID issued to the user by the device 200 and the main ID.
- FIGS. 13 to 15 are flowcharts illustrating the processing flow of the ID management system according to the third embodiment.
- the user terminal 300 when the user terminal 300 receives the assignment processing completion notification from the main ID management device 100 (see A in FIG. 13), it confirms whether or not acquisition of all the main IDs to be assigned to the sub-IDs has been completed. (Step S1304).
- Step S1321 the process flows in the same manner as the process described in the above embodiment (see FIG. 6).
- step S1305 if all the main IDs have not been acquired as a result of the confirmation (No at step S1305), the main ID, the main ID password and the main ID management device ID of the next main ID management device 100 are input. After being received and acquired from the user (step S1306), an identity verification data issuance request is transmitted to the secondary ID management device 200 (step S1307), and the process is the same as the process described in the above embodiment (see FIG. 6). Flowing.
- FIG. 14 differs from the process described with reference to FIG. 8 in the above embodiment in the following points.
- Step S1404 when the user terminal 300 receives the allocation process completion notification from the secondary ID management device 200 (see A in FIG. 14), it confirms whether or not acquisition of all the primary IDs to be allocated to the secondary ID has been completed.
- Step S1405 If all the main IDs have been acquired as a result of the confirmation (Yes in step S1405, see B in FIG. 13), the user terminal 300 transmits a sub ID transmission request to the sub ID management device 200. (Step S1423), the process flows in the same manner as the process described in the above embodiment (see FIG. 8).
- step S1404 if all the main IDs have not been acquired as a result of the confirmation (No at step S1404), the next main ID, main ID password, and main ID management device ID are input.
- step S1406 After receiving and acquiring from the user (step S1406), the public key of the main ID management apparatus 100 is acquired (step S1407), and the main ID is encrypted using this public key to create an encrypted main ID (step S1408).
- step S1408 The process flows in the same manner as the process described in the above embodiment (see FIG. 8).
- FIG. 15 differs from the process described with reference to FIG. 9 in the above embodiment in the following points.
- Step S1504 when the user terminal 300 receives the allocation process completion notification from the secondary ID management device 200 (see A in FIG. 15), it confirms whether or not acquisition of all the primary IDs to be allocated to the secondary ID has been completed.
- Step S1505 If all the main IDs have been acquired as a result of the confirmation (Yes at step S1505, see FIG. 15B), the user terminal 300 sends a sub ID transmission request to the sub ID management device 200. (Step S1527), the process flows in the same manner as the process described in the above embodiment (see FIG. 9).
- step S1505 if acquisition of all the main IDs is not completed as a result of the confirmation (No at step S1505), input of the main ID, main ID password, and main ID management device ID of the next main ID management device 100 is performed. After receiving and acquiring from the user (step S1506), the public key of the main ID management apparatus 100 is acquired (step S1507), and the main ID is encrypted using this public key to create an encrypted main ID (step S1508).
- the process flows in the same manner as the process described in the above embodiment (see FIG. 9).
- FIG. 16 is a diagram illustrating an overview of an ID management system according to the fourth embodiment.
- the ID management system includes a user terminal X, a user terminal Y, a real person management apparatus A (corresponding to the main ID management apparatus described in the above embodiment), virtual person management.
- a device corresponding to the sub ID management device described in the above embodiment
- a real person management device B corresponding to the main ID management device described in the above embodiment
- a plurality of service providing devices job search site, SNS (Social Networking Service), shopping site.
- the user terminal X is connected in a communicable state with the real person management apparatus A, the virtual person management apparatus, and each service providing apparatus, and the user terminal Y is connected to the real person management apparatus B, the virtual person management apparatus, and each service providing apparatus. Connected in a communicable state.
- the user X of the user terminal X obtains the real person ID (corresponding to the main ID) “XX” from the real person management apparatus A, and the virtual person ID (sub ID) that is a virtual personality when using the service from the virtual person management apparatus. Equivalent to) “x11” is acquired.
- the user Y of the user terminal Y acquires the real person ID “YY” from the real person management apparatus B and also acquires the virtual person ID “y22” from the virtual person management apparatus.
- the real person management apparatus A associates the personal information of the user X, the real person ID “XX” issued to the user X, and the real person ID “XX” and the virtual person ID managed by the virtual person management apparatus.
- the allocation management ID “10kx” is managed in association with each other.
- the real person management apparatus B associates the personal information of the user Y, the real person ID “YY” issued to the user Y, and the real person ID “YY” with the virtual person ID managed by the virtual person management apparatus. Are associated with the management ID “yh2k”.
- the virtual person management apparatus issues a virtual person ID “x11” issued to the user X, and an assignment management ID “10 kx” for associating the virtual person ID “x11” with the real person ID managed by the real person management apparatus A.
- the real person management apparatus ID for specifying the real person management apparatus A that manages the real person ID associated with the virtual person ID “x11” is managed in association with the virtual person ID “y22” issued to the user Y. ”.
- the real person management apparatus ID for identifying the real person management apparatus B to be managed is associated and managed.
- the user X and the user Y use the virtual person ID “x11” and the virtual person ID “y22” acquired from the virtual person management apparatus to access and operate each service providing apparatus.
- the user X and the user Y can use the virtual person ID to act on the service providing apparatus without disclosing personal information.
- each of the user X and the user Y accesses the service providing apparatus (SNS) using the virtual person ID, and the virtual person ID “x11” and the virtual person
- SNS service providing apparatus
- User Y transmits the mail and the mail transmission request to the virtual person management apparatus in order to request the transmission of the mail having the virtual person ID “y22” as the sender and the virtual person ID “x11” as the destination.
- the virtual person management apparatus When receiving the mail transmission request from the user terminal Y, the virtual person management apparatus manages the real person ID associated with the virtual person ID “x11” that is the destination of the mail from the managed information.
- a real person management device ID for identifying A, a virtual person ID “x11”, and an assignment management ID “10 kx” for associating the real person ID managed by the real person management device A are acquired,
- the real person management apparatus A corresponding to the real person management apparatus ID is requested to send the mail received from the user Y to the user corresponding to the assignment management ID “10 kx”.
- the real person management apparatus A When the real person management apparatus A receives the mail transmission request from the virtual person management apparatus, the real person management apparatus A acquires the mail address of the user X corresponding to the assignment management ID “10 kx” that is the destination of the mail from the managed information. , Forward the mail to this mail address. In this way, mail can be exchanged between the virtual person ID “x11” and the virtual person ID “y22” that are met on the service providing device (SNS) while keeping private information confidential.
- SNS service providing device
- the service providing apparatus performs an article sales transaction between the virtual person ID “x11” and the virtual person “y22”. An outline of the processing when sending the price from “y22” to “x11” will be described.
- the user Y transmits the price and the remittance request to the virtual person management apparatus in order to request the remittance of the price with “y22” as the remittance source and “x11” as the remittance destination.
- the virtual person management apparatus like the above-described mail transfer example, from the managed information, the real person management apparatus A and the allocation management ID “10 kx” of the real person management apparatus A corresponding to the remittance destination “x11”. And requests the real person management apparatus A to remit money from the user Y to the user corresponding to the allocation management ID “10 kx”.
- the real person management apparatus A acquires the account number of the user X corresponding to the allocation management ID “10 kx” as the remittance destination from the information managed as in the mail transfer example described above, and this account number Send money to.
- the real person ID and the virtual person ID are linked by the allocation management ID, and the real person ID, the personal information, and the virtual person ID are managed in a distributed manner, and exchange of information necessary when using the service While maintaining the function to perform the management, even if one of the information managed by the real person management apparatus and the virtual person management apparatus leaks, the correspondence relationship between the virtual person and the real person can be prevented from being exposed to the outside. Therefore, it is possible to prevent the personal information of the user who uses the service from being identified using the virtual person ID and leaked to the outside.
- each component of the main ID management device 100 shown in FIG. 3 and the sub ID management device shown in FIG. 5 is functionally conceptual, and is not necessarily physically configured as shown. You don't need to be. That is, the specific form of distribution / integration of the main ID management device 100 and the sub ID management device 200 is not limited to the illustrated one, and the data transmission / reception unit 121 and the owner confirmation unit 122 of the main ID management device 100 shown in FIG. And the data registration unit 123, and the data transmission / reception unit 221, the sub ID generation unit 222, the personal identification data generation unit 223, and the allocation management ID generation unit 224 of the sub ID management device 200 shown in FIG. For example, all or a part of them may be integrated and functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions.
- each processing function (FIGS. 6, 8, and 13, 13 to 15) performed in the main ID management device 100 and the sub ID management device 200 is entirely or arbitrarily part of the CPU and the It can be realized by a program that is analyzed and executed by the CPU.
- the computer functioning as the primary ID management device 100 and the secondary ID management device 200 reads out and executes a program recorded in a predetermined recording medium, thereby executing each processing function similar to the above-described embodiment (FIGS. 6 and 6). 8 and FIG. 9 and FIGS. 13 to 15).
- the predetermined recording medium includes the main ID management apparatus 100 in addition to “portable physical medium” such as a flexible disk (FD), a CD-ROM, an MO disk, a DVD disk, a magneto-optical disk, and an IC card.
- HDD hard disk drive
- a “fixed physical medium” such as RAM and ROM, a public line connected via a modem, and the like It can be read by a computer functioning as the primary ID management device 100 and the secondary ID management device 200 such as a “communication medium” that holds the program in a short time when transmitting the program, such as a LAN / WAN to which a computer system and server are connected.
- a “communication medium” that holds the program in a short time when transmitting the program, such as a LAN / WAN to which a computer system and server are connected.
- the program referred to in the other embodiments is recorded on a recording medium such as the above-mentioned “portable physical medium”, “fixed physical medium”, and “communication medium” in a computer-readable manner.
- the computer functioning as the primary ID management device 100 and the secondary ID management device 200 reads out the program from such a recording medium and executes it to execute each processing function similar to the above-described embodiment (FIGS. 6, 8, and FIG. 9 and FIGS. 13 to 15).
- the program in this other embodiment is not limited to being executed by a computer functioning as the primary ID management device 100 and the secondary ID management device 200, but is executed by another computer system or server.
- the present invention can be similarly applied to the case where the programs are executed in cooperation with each other.
- the secondary ID management device 200 receives a secondary ID issue request from a user terminal used by the user, a secondary ID generation step for generating a secondary ID, and a user of the user terminal that requests login by the primary ID,
- the main ID management device that manages the main ID to be associated with the sub ID generated by the sub ID generation step as to whether or not the user of the user terminal that is the transmission source of the sub ID issuance request is the same person
- the same person confirmation step that confirms in cooperation with the user, the user of the user terminal that requests the login request, and the user of the user terminal that is the transmission source of the sub ID issue request are the same person
- An allocation management ID generation step for generating an allocation management ID indicating a relationship, and the allocation management ID generated by the allocation management ID generation step are transmitted to a main ID management device that manages a main ID to be associated with the sub ID.
- the main ID management device further includes an allocation management ID receiving step for receiving an allocation management ID from the sub ID management device, an allocation management ID received by the allocation management ID receiving step, and transmission of the allocation management ID
- An ID management method including a main ID assignment management information recording step of recording a sub ID management device ID for specifying the original sub ID management device in association with a main ID that has requested login is realized. To do.
- the manager of the main ID management device 100 and the manager of the sub-ID management device 200 exchange allocation management IDs according to a request from the user by mail or the like.
- the management apparatus 100 pre-registers the main ID, the allocation management ID, and personal information in association with each other, the sub-ID management apparatus 200 associates the sub-ID and the allocation management ID in advance with registration management, and has static information.
- the primary ID management device 100 and the secondary ID management device 200 may be caused to execute processing accompanying a service request to the service providing device.
- the ID management system and the ID management method according to the present invention are useful for managing the primary ID and the secondary ID issued in response to a request from the user, and in particular, between different types of IDs having different uses. It is suitable for preventing the correspondence relationship from being exposed.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
A main ID managing device manages a main ID, an auxiliary ID managing device ID for specifying an auxiliary ID managing device, an allocation management ID for specifying a correspondence relation of the auxiliary ID and the main ID, and individual information of a user specified by the main ID (information on a bank account or a credit number of a user, which are used for settlement processing service, and a name and an address, which are used for physical distribution service, for example) by associating them with one another. The auxiliary ID managing device correspondingly manages the auxiliary ID, the main ID managing device ID for specifying the main ID managing device and the allocation management ID.
Description
この発明は、ユーザからの要求に応じて発行した主IDおよび副IDを管理するID管理システムおよびID管理方法に関する。
The present invention relates to an ID management system and an ID management method for managing a primary ID and a secondary ID issued in response to a request from a user.
従来より、ネットワークを介したサービスを提供することを目的として、サービス利用者の情報を管理する技術が存在する(例えば、特許文献1参照)。
2. Description of the Related Art Conventionally, there is a technique for managing service user information for the purpose of providing a service via a network (see, for example, Patent Document 1).
また、サービス利用者は、会社の従業員ID、スーパーマーケットの顧客ID、保険の契約者IDなどのように、用途ごとに多数のIDを保有する場合がある。このような場合に、用途ごとに異なる多数のIDが同一人物によって保有されているものであることを管理することが必要となるケースが存在する。
In addition, the service user may have a large number of IDs for each use, such as a company employee ID, a supermarket customer ID, and an insurance contractor ID. In such a case, there is a case where it is necessary to manage that a large number of IDs different for each application are held by the same person.
例えば、学生が、学生IDを利用して学生向け保険の契約を結び、保険の契約者IDの発行を受けるといったケースでは、学生IDと契約者IDとが同一の人物によって保有されているものであることを管理することが必要となる場合がある。そのため、従来では、例えば、学生IDと契約者IDとが同一の人物によって保有されているものであることを管理することが必要となる保険会社に備えられたID管理装置が、学生IDと契約者IDとの対応関係を対応付けて管理していた。
For example, in a case where a student makes a student insurance contract using a student ID and is issued an insurance policyholder ID, the student ID and policyholder ID are owned by the same person. It may be necessary to manage something. Therefore, conventionally, for example, an ID management device provided in an insurance company that needs to manage that a student ID and a contractor ID are held by the same person is contracted with the student ID. The correspondence with the person ID is associated and managed.
しかしながら、従来では、一つの装置内に用途が異なる異種IDを対応付けて管理していたので、用途が異なる異種ID間の対応関係が暴露されてしまう場合があるという問題点があった。
However, conventionally, since different types of IDs having different uses are associated and managed in one apparatus, there is a problem that the correspondence between different types of IDs having different uses may be exposed.
上記したように、用途が異なる異種ID間の対応関係が暴露されてしまうと、異種IDのそれぞれに対応する様々な情報が同一人物のものであることが公になってしまうという問題が引き起こされる。例えば、学生IDと契約者IDとの対応関係が暴露されてしまった場合には、学生IDに対応する情報である学業成績と、契約者IDに対応する情報である保険料未納情報とが同一人物のものとして公になってしまう。
As described above, if the correspondence between different types of IDs with different uses is exposed, there is a problem that various information corresponding to the different types of IDs are made public by the same person. . For example, when the correspondence between the student ID and the contractor ID has been exposed, the academic achievement that is the information corresponding to the student ID is the same as the non-payment of premium information that is the information corresponding to the contractor ID. It becomes public as a person's.
そこで、この発明は、上述した従来技術の課題を解決するためになされたものであり、用途が異なる異種ID間の対応関係が暴露されてしまうことを防止することが可能なID管理システムおよびID管理方法を提供することを目的とする。
Accordingly, the present invention has been made to solve the above-described problems of the prior art, and an ID management system and an ID that can prevent the correspondence between different types of IDs having different uses from being exposed. The purpose is to provide a management method.
上述した課題を解決し、目的を達成するため、本発明は、ユーザが利用するユーザ端末と、第1の用途のためにユーザを識別するための主IDを管理する主ID管理装置と、第2の用途のためにユーザを識別するための副IDを管理する副ID管理装置とを含んで構成されるID管理システムであって、前記主ID管理装置は、主IDと、前記副ID管理装置を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDとを対応付けて管理する主ID管理手段を備え、前記副ID管理装置は、副IDと、前記主ID管理装置を特定するための主ID管理装置IDと、割当管理IDとを対応付けて管理する副ID管理手段を備えたことを要件とする。
In order to solve the above-described problems and achieve the object, the present invention provides a user terminal used by a user, a main ID management device that manages a main ID for identifying the user for the first use, An ID management system including a secondary ID management device for managing a secondary ID for identifying a user for the second use, wherein the primary ID management device includes a primary ID and the secondary ID management. A secondary ID management device ID for specifying a device, and a primary ID management means for managing an association management ID for specifying a correspondence relationship between the secondary ID and the primary ID in association with each other; The sub-ID management means for managing the sub ID, the main ID management device ID for specifying the main ID management device, and the allocation management ID in association with each other is a requirement.
また、本発明は、上記の発明において、前記副ID管理手段は、副IDに対応付けて、前記主ID管理装置ごとに異なる主ID管理装置IDおよび割当管理IDをそれぞれ管理することを要件とする。
Further, according to the present invention, in the above invention, the sub ID management means manages the main ID management device ID and the allocation management ID that are different for each main ID management device in association with the sub ID. To do.
また、本発明は、上記の発明において、前記副ID管理装置は、前記ユーザ端末からの副ID発行依頼を受信した場合に、副IDを生成する副ID生成手段と、主IDによるログインを要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であるか否かについて、前記副ID生成手段により生成された副IDに対応付ける対象の主IDを管理する主ID管理装置と連携して確認する同一人物確認手段と、前記ログイン要求を要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であることが前記同一人物確認手段により確認された場合には、前記副ID生成手段により生成された副IDと、当該副IDに対応付ける対象の主IDとの対応関係を示す割当管理IDを生成する割当管理ID生成手段と、前記割当管理ID生成手段により生成された割当管理IDを、前記副IDに対応付ける対象の主IDを管理する主ID管理装置に送信する割当管理ID送信手段と、前記副ID生成手段により生成された副IDと、当該副IDに対応付ける対象の主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、前記割当管理ID生成手段により生成された割当管理IDとを対応付けて記録する副ID割当管理情報記録手段と、前記副ID割当管理情報記録手段による記録が完了した場合には、前記副ID発行依頼の送信元であるユーザ端末に対して、前記副ID生成手段により生成された副IDを送信する副ID送信手段と、をさらに備え、前記主ID管理装置は、前記副ID管理装置から割当管理IDを受信する割当管理ID受信手段と、前記割当管理ID受信手段により受信された割当管理IDと、当該割当管理IDの送信元である副ID管理装置を特定するための副ID管理装置IDと、ログインを要求した主IDとを対応付けて記録するする主ID割当管理情報記録手段をさらに備えたことを要件とする。
Also, in the present invention, in the above invention, the secondary ID management device requests a secondary ID generation means for generating a secondary ID and a login by a primary ID when receiving a secondary ID issue request from the user terminal. The main ID to be associated with the sub-ID generated by the sub-ID generation means is whether or not the user of the user terminal that is the user and the user of the user terminal that is the transmission source of the sub-ID issue request is the same person. The same person confirmation means for confirming in cooperation with the managing main ID management device, the user terminal user who requests the login request, and the user terminal user who is the transmission source of the sub ID issue request are the same person. Is confirmed by the same person confirmation unit, the correspondence between the sub ID generated by the sub ID generation unit and the main ID to be associated with the sub ID An allocation management ID generating unit that generates an allocation management ID to be indicated; and an allocation management that transmits the allocation management ID generated by the allocation management ID generating unit to a main ID management device that manages a main ID to be associated with the sub ID An ID transmission unit, a sub ID generated by the sub ID generation unit, a main ID management device ID for specifying a main ID management device that manages a main ID to be associated with the sub ID, and the allocation management ID A sub-ID allocation management information recording unit that records the allocation management ID generated by the generating unit in association with each other; and when the recording by the sub-ID allocation management information recording unit is completed, the transmission source of the sub-ID issue request A sub-ID transmission unit that transmits the sub-ID generated by the sub-ID generation unit to the user terminal, wherein the main ID management device An allocation management ID receiving means for receiving an allocation management ID from the D management apparatus; an allocation management ID received by the allocation management ID receiving means; and a sub-ID management apparatus that is a transmission source of the allocation management ID It is a requirement that the apparatus further includes a main ID assignment management information recording unit that records the sub ID management device ID and the main ID that has requested login in association with each other.
また、本発明は、第1の用途のためにユーザを識別するための主IDを発行して管理するとともに、第2の用途のためにユーザを識別するための副IDを発行して管理するID管理方法であって、主IDを管理する主ID管理装置は、主IDと、副IDを管理する副ID管理装置を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDとを対応付けて主ID管理装置に管理させる主ID管理ステップを含み、副IDを管理する副ID管理装置は、副IDと、主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、割当管理IDとを対応付けて副ID管理装置に管理させる副ID管理ステップを含んだことを要件とする。
The present invention also issues and manages a primary ID for identifying a user for the first use, and issues and manages a sub-ID for identifying the user for the second use. An ID management method, wherein a primary ID management device that manages a primary ID includes a primary ID, a secondary ID management device ID for specifying a secondary ID management device that manages a secondary ID, a secondary ID, and a primary ID. The secondary ID management device that manages the secondary ID includes a primary ID management step that causes the primary ID management device to manage the primary ID management device in association with the allocation management ID for specifying the correspondence relationship. The secondary ID management device manages the secondary ID and the primary ID. It is a requirement to include a sub-ID management step in which a main ID management device ID for specifying an ID management device and an allocation management ID are associated with each other and managed by the sub-ID management device.
また、本発明は、上記の発明において、前記副ID管理ステップは、副IDに対応付けて、前記主ID管理装置ごとに異なる主ID管理装置IDおよび割当管理IDをそれぞれ管理することを要件とする。
Further, in the present invention, the present invention requires that the sub ID management step manages a different main ID management device ID and allocation management ID for each main ID management device in association with the sub ID. To do.
前記副ID管理装置は、ユーザが利用するユーザ端末からの副ID発行依頼を受信した場合に、副IDを生成する副ID生成ステップと、主IDによるログインを要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であるか否かについて、前記副ID生成ステップにより生成された副IDに対応付ける対象の主IDを管理する主ID管理装置と連携して確認する同一人物確認ステップと、前記ログイン要求を要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であることが前記同一人物確認ステップにより確認された場合には、前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDとの対応関係を示す割当管理IDを生成する割当管理ID生成ステップと、前記割当管理ID生成ステップにより生成された割当管理IDを、前記副IDに対応付ける対象の主IDを管理する主ID管理装置に送信する割当管理ID送信ステップと、前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、前記割当管理ID生成ステップにより生成された割当管理IDとを対応付けて記録する副ID割当管理情報記録ステップと、前記副ID割当管理情報記録ステップによる記録が完了した場合には、前記副ID発行依頼の送信元であるユーザ端末に対して、前記副ID生成ステップにより生成された副IDを送信する副ID送信ステップと、をさらに含み、前記主ID管理装置は、前記副ID管理装置から割当管理IDを受信する割当管理ID受信ステップと、前記割当管理ID受信ステップにより受信された割当管理IDと、当該割当管理IDの送信元である副ID管理装置を特定するための副ID管理装置IDと、ログインを要求した主IDとを対応付けて記録するする主ID割当管理情報記録ステップと、をさらに含んだことを要件とする。
The secondary ID management device, when receiving a secondary ID issue request from a user terminal used by a user, a secondary ID generation step of generating a secondary ID, a user of a user terminal requesting login by a primary ID, Cooperation with the main ID management apparatus that manages the main ID to be associated with the sub ID generated by the sub ID generation step, as to whether or not the user of the user terminal that is the transmission source of the sub ID issue request is the same person The same person confirmation step confirms that the user of the user terminal that requests the login request and the user of the user terminal that is the transmission source of the sub ID issue request are the same person. If confirmed, it indicates the correspondence between the sub ID generated in the sub ID generation step and the main ID to be associated with the sub ID. An allocation management ID generating step for generating an allocation management ID, and an allocation management ID for transmitting the allocation management ID generated by the allocation management ID generation step to a main ID management device that manages a main ID to be associated with the sub ID. A transmission step, a sub ID generated by the sub ID generation step, a main ID management device ID for specifying a main ID management device that manages a main ID to be associated with the sub ID, and the allocation management ID generation When the recording by the sub ID allocation management information recording step for recording the allocation management ID associated with the step in association with each other and the recording by the sub ID allocation management information recording step are completed, the transmission source of the sub ID issue request is A sub-ID transmission step of transmitting the sub-ID generated by the sub-ID generation step to a certain user terminal. The primary ID management device includes an allocation management ID receiving step for receiving an allocation management ID from the secondary ID management device, an allocation management ID received by the allocation management ID receiving step, and a transmission source of the allocation management ID. It is a requirement that it further includes a main ID assignment management information recording step of recording a sub ID management device ID for specifying a certain sub ID management device in association with a main ID that has requested login.
本発明によれば、用途が異なる異種ID間の対応関係が暴露されてしまうことを防止することができるという効果を奏する。
According to the present invention, there is an effect that it is possible to prevent the correspondence between different kinds of IDs having different uses from being exposed.
また、本発明によれば、主IDおよび副IDの匿名性を保持するとともに、主IDが存在することを条件に副IDを発行することができるという効果を奏する。
In addition, according to the present invention, the anonymity of the primary ID and the secondary ID is maintained, and the secondary ID can be issued on the condition that the primary ID exists.
100 主ID管理装置
110 記憶部
111 主ID管理情報
120 制御部
121 データ送受信部
122 所有者確認部
123 データ登録部
200 副ID管理装置
210 記憶部
211 副ID管理情報
220 制御部
221 データ送受信部
222 副ID生成部
223 本人確認データ生成部
224 割当管理ID生成部
225 データ登録部
226 主ID認証依頼部
300 ユーザ端末 DESCRIPTION OFSYMBOLS 100 Main ID management apparatus 110 Storage part 111 Main ID management information 120 Control part 121 Data transmission / reception part 122 Owner confirmation part 123 Data registration part 200 Sub ID management apparatus 210 Storage part 211 Sub ID management information 220 Control part 221 Data transmission / reception part 222 Sub ID generation unit 223 Identity verification data generation unit 224 Allocation management ID generation unit 225 Data registration unit 226 Main ID authentication request unit 300 User terminal
110 記憶部
111 主ID管理情報
120 制御部
121 データ送受信部
122 所有者確認部
123 データ登録部
200 副ID管理装置
210 記憶部
211 副ID管理情報
220 制御部
221 データ送受信部
222 副ID生成部
223 本人確認データ生成部
224 割当管理ID生成部
225 データ登録部
226 主ID認証依頼部
300 ユーザ端末 DESCRIPTION OF
以下に添付図面を参照して、この発明に係るID管理システムおよびID管理方法を実施するための一実施形態について詳細に説明する。なお、以下では、本発明に係るID管理システムの一実施形態として実施例1を説明した後に、本発明に係るID管理システムに含まれる他の実施形態について他の実施例で説明する。
Hereinafter, an embodiment for carrying out an ID management system and an ID management method according to the present invention will be described in detail with reference to the accompanying drawings. In the following, Example 1 will be described as an embodiment of the ID management system according to the present invention, and then other embodiments included in the ID management system according to the present invention will be described in other examples.
[ID管理システムの概要および特徴(実施例1)]
まず、図1を用いて、実施例1に係るID管理システムの概要および特徴を説明する。図1は、実施例1に係るID管理システムの概要および特徴を説明するための図である。 [Outline and Features of ID Management System (Example 1)]
First, the outline and characteristics of the ID management system according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram for explaining the outline and features of the ID management system according to the first embodiment.
まず、図1を用いて、実施例1に係るID管理システムの概要および特徴を説明する。図1は、実施例1に係るID管理システムの概要および特徴を説明するための図である。 [Outline and Features of ID Management System (Example 1)]
First, the outline and characteristics of the ID management system according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram for explaining the outline and features of the ID management system according to the first embodiment.
実施例1に係るID管理システムは、ユーザからの要求に応じて発行した主IDおよび副IDを管理することを概要とするが、用途が異なる異種ID間の対応関係が暴露されてしまうことを防止することに主たる特徴がある。
The ID management system according to the first embodiment outlines the management of the primary ID and the secondary ID issued in response to a request from the user, but the correspondence between different types of IDs with different uses is exposed. The main feature is to prevent.
すなわち、図1に示すように、実施例1に係るID管理システムは、ユーザが利用するユーザ端末と、ユーザを一意に特定するための主IDを発行する主IDを管理する主ID管理装置と、ネットワーク上でユーザにより用いられる仮想人物を一意に特定するための副IDを発行する副ID管理装置とを含んで構成される。
That is, as shown in FIG. 1, the ID management system according to the first embodiment includes a user terminal used by a user and a main ID management device that manages a main ID that issues a main ID for uniquely identifying the user. And a sub-ID management device that issues a sub-ID for uniquely identifying a virtual person used by the user on the network.
そして、主ID管理装置は、主IDと、副ID管理装置を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDと、主IDにより特定されるユーザの個人情報(例えば、決済処理サービスに用いるための利用者の銀行口座の情報やクレジット番号の情報、物流サービスに用いるための氏名や住所など)とを対応付けて管理する。
The main ID management device uses the main ID, the sub ID management device ID for specifying the sub ID management device, the allocation management ID for specifying the correspondence between the sub ID and the main ID, and the main ID. Personal information (for example, user bank account information and credit number information for use in a payment processing service, name and address for use in a logistics service, etc.) is managed in association with each other.
また、副ID管理装置は、副IDと、主ID管理装置を特定するための主ID管理装置IDと、割当管理IDとを対応付けて管理する。
Also, the secondary ID management device manages the secondary ID, the primary ID management device ID for specifying the primary ID management device, and the allocation management ID in association with each other.
このようにして、主IDと副IDとを直接対応付けて管理することなく、割当管理IDで対応付けて管理することで、仮に主ID管理装置側で管理されている情報が暴露されてしまったとしても、主IDと副IDの対応関係が暴露されることはない。
In this way, information managed on the main ID management apparatus side is exposed by managing the main ID and the sub ID in association with the allocation management ID without directly managing them in association with each other. Even so, the correspondence between the primary ID and the secondary ID is not revealed.
すなわち、実施例1に係るID管理システムは、上述した主たる特徴のように、用途が異なる異種ID間の対応関係が暴露されてしまうことを防止することができる。
That is, the ID management system according to the first embodiment can prevent the correspondence between different types of IDs having different uses from being exposed, like the main feature described above.
[ID管理システムの構成(実施例1)]
次に、図2~図5を用いて、実施例1に係るID管理システムの構成を説明する。図2は、実施例1に係るID管理システムのシステム構成を示す図である。図3は、実施例1に係る主ID管理装置の構成を示すブロック図である。図4は、実施例1に係る主ID管理情報および副ID管理情報の構成例を示す図である。図5は、実施例1に係る副ID管理装置の構成を示すブロック図である。 [Configuration of ID management system (Example 1)]
Next, the configuration of the ID management system according to the first embodiment will be described with reference to FIGS. FIG. 2 is a diagram illustrating a system configuration of the ID management system according to the first embodiment. FIG. 3 is a block diagram illustrating the configuration of the main ID management apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of the main ID management information and the sub ID management information according to the first embodiment. FIG. 5 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the first embodiment.
次に、図2~図5を用いて、実施例1に係るID管理システムの構成を説明する。図2は、実施例1に係るID管理システムのシステム構成を示す図である。図3は、実施例1に係る主ID管理装置の構成を示すブロック図である。図4は、実施例1に係る主ID管理情報および副ID管理情報の構成例を示す図である。図5は、実施例1に係る副ID管理装置の構成を示すブロック図である。 [Configuration of ID management system (Example 1)]
Next, the configuration of the ID management system according to the first embodiment will be described with reference to FIGS. FIG. 2 is a diagram illustrating a system configuration of the ID management system according to the first embodiment. FIG. 3 is a block diagram illustrating the configuration of the main ID management apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of the main ID management information and the sub ID management information according to the first embodiment. FIG. 5 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the first embodiment.
図2に示すように、実施例1に係るID管理システムは、ユーザが利用するユーザ端末300と、ユーザを一意に特定するための主IDを発行する主IDを管理する主ID管理装置100と、ネットワーク上でユーザにより用いられる仮想人物を一意に特定するための副IDを発行する副ID管理装置200と含んで構成される。また、ユーザ端末300と、主ID管理装置100および副ID管理装置200とが相互にネットワークを介した通信が可能な状態に接続されるとともに、主ID管理装置100と副ID管理装置200とが相互にネットワークを介した通信が可能な状態に接続される。
As illustrated in FIG. 2, the ID management system according to the first embodiment includes a user terminal 300 used by a user, and a main ID management device 100 that manages a main ID that issues a main ID for uniquely identifying the user. And a sub ID management device 200 that issues a sub ID for uniquely identifying a virtual person used by the user on the network. Further, the user terminal 300, the main ID management device 100, and the sub ID management device 200 are connected to each other so that they can communicate with each other via a network, and the main ID management device 100 and the sub ID management device 200 are connected to each other. They are connected so that they can communicate with each other via a network.
図3に示すように、主ID管理装置100は、記憶部110および制御部120を備えて構成される。
As shown in FIG. 3, the main ID management device 100 includes a storage unit 110 and a control unit 120.
記憶部110は、制御部120による各種処理に必要なデータおよびプログラムを記憶する記憶部であり、特に本発明に密接に関連するものとしては、主ID管理情報111を備える。なお、主ID管理情報111は、請求の範囲に記載の「主ID管理手段」に対応する。
The storage unit 110 is a storage unit that stores data and programs necessary for various processes performed by the control unit 120. In particular, the storage unit 110 includes main ID management information 111 that is closely related to the present invention. The main ID management information 111 corresponds to “main ID management means” described in the claims.
主ID管理情報111は、図4に示すように、ユーザを一意に特定するためにあらかじめ発行された主IDと、主IDを用いてログインしてきたユーザ端末300のユーザを認証するための主ID用認証データ(例えば、パスワード)と、通信可能な状態で接続されている副ID管理装置200を特定するための副ID管理装置IDと、副ID管理装置200によりユーザに発行される副IDと主IDとの対応関係(副IDと主IDとのリンク関係)を特定するための割当管理IDと、図には示していないが主IDにより特定されるユーザの個人情報(例えば、決済処理サービスに用いるための利用者の銀行口座の情報やクレジット番号の情報、物流サービスに用いるための氏名や住所など)とを記憶して構成される。
As shown in FIG. 4, the main ID management information 111 includes a main ID issued in advance for uniquely identifying a user and a main ID for authenticating the user of the user terminal 300 that has logged in using the main ID. Authentication data (for example, a password), a sub ID management device ID for specifying the sub ID management device 200 connected in a communicable state, and a sub ID issued to the user by the sub ID management device 200 An allocation management ID for specifying the correspondence relationship with the main ID (link relationship between the sub-ID and the main ID), and personal information (for example, a payment processing service) of the user specified by the main ID (not shown) Information on the bank account of the user, information on credit numbers, and name and address for use in logistics services).
制御部120は、所定の制御プログラム、各種の処理手順などを規定したプログラムおよび所要データを格納するための内部メモリを有し、これらによって種々の処理を実行する処理部であり、特に本発明に密接に関連するものとしては、データ送受信部121と、所有者確認部122と、データ登録部123とを備える。
The control unit 120 has a predetermined control program, a program defining various processing procedures, and an internal memory for storing necessary data, and executes various processes using these, and is particularly suitable for the present invention. As closely related, a data transmission / reception unit 121, an owner confirmation unit 122, and a data registration unit 123 are provided.
データ送受信部121は、ユーザ端末300および副ID管理装置200との間でデータの送受信を行う処理部である。具体的には、データ送受信部121は、ユーザ端末300からのログイン受付時に、主IDおよび主ID用パスワードを受信する。
The data transmission / reception unit 121 is a processing unit that performs transmission / reception of data between the user terminal 300 and the sub-ID management device 200. Specifically, the data transmission / reception unit 121 receives the main ID and the main ID password when accepting login from the user terminal 300.
また、データ送受信部121は、副IDへの主IDの割当処理依頼をユーザ端末300から受信するとともに、副ID管理装置200から割当管理IDを受信する。この割当処理依頼には本人確認用データが含まれる。
Further, the data transmitting / receiving unit 121 receives a request for assigning a main ID to a sub ID from the user terminal 300 and also receives an assignment management ID from the sub ID management device 200. This assignment processing request includes data for identity verification.
また、データ送受信部121は、副IDへの主IDの割当処理依頼をユーザ端末300から受信すると、後述する所有者確認部122による主IDの認証結果、および割当処理依頼に含まれる本人確認データを合わせた割当管理ID発行依頼を副ID管理装置200に送信する。さらに、データ送受信部121は、後述するデータ登録部123による登録が完了すると、主IDの割当処理完了通知をユーザ端末300に送信する。
In addition, when the data transmission / reception unit 121 receives a request for assigning a main ID to a sub-ID from the user terminal 300, the authentication result of the main ID by the owner confirmation unit 122, which will be described later, and the personal identification data included in the assignment processing request The allocation management ID issuance request combined with the above is transmitted to the secondary ID management device 200. Furthermore, when the registration by the data registration unit 123 described later is completed, the data transmission / reception unit 121 transmits a main ID assignment process completion notification to the user terminal 300.
所有者確認部122は、主IDによるログインを受け付けた場合に、主IDの認証を行う処理部である。具体的には、所有者確認部122は、ログイン時に取得された主IDが主ID管理情報111内に登録済みのものであるかどうか確認する。そして、所有者確認部122は、主IDが登録済みのものである場合には、この主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードを取得し、ログイン時に主IDとともに受け付けられた主ID用パスワードと比較して、主IDの正当な所有者であるか否かの認証を行う。
The owner confirmation unit 122 is a processing unit that authenticates the main ID when a login by the main ID is accepted. Specifically, the owner confirmation unit 122 confirms whether or not the main ID acquired at the time of login is already registered in the main ID management information 111. When the main ID is already registered, the owner confirmation unit 122 acquires the main ID password stored in the main ID management information 111 in association with the main ID, and logs in the main ID at the time of login. Compared with the main ID password received together with the ID, authentication is performed as to whether or not the owner is a valid owner of the main ID.
データ登録部123は、割当管理ID等の登録を行う処理部である。具体的には、データ登録部123は、データ送受信部121により割当管理IDが受信されると、この割当管理IDと、割当管理IDの送信元である副ID管理装置200を特定するための副ID管理装置IDと、ログイン受付時に取得された主IDとを対応付けて主ID管理情報111に保存する。
The data registration unit 123 is a processing unit that registers assignment management IDs and the like. Specifically, when the data management unit 121 receives the allocation management ID from the data transmission / reception unit 121, the data registration unit 123 identifies the allocation management ID and the secondary ID management device 200 that is the transmission source of the allocation management ID. The ID management device ID and the main ID acquired at the time of login reception are stored in the main ID management information 111 in association with each other.
図5に示すように、副ID管理装置200は、記憶部210および制御部220を備えて構成される。
As shown in FIG. 5, the secondary ID management device 200 includes a storage unit 210 and a control unit 220.
記憶部210は、制御部220による各種処理に必要なデータおよびプログラムを記憶する記憶部であり、特に本発明に密接に関連するものとしては、副ID管理情報211を備える。なお、副ID管理情報211は、請求の範囲に記載の「副ID管理手段」に対応する。
The storage unit 210 is a storage unit that stores data and programs necessary for various processes performed by the control unit 220. In particular, the storage unit 210 includes sub-ID management information 211 that is closely related to the present invention. The secondary ID management information 211 corresponds to “secondary ID management means” recited in the claims.
副ID管理情報211は、図4に示すように、ネットワーク上でユーザにより用いられる仮想人物を一意に特定するために発行される副IDと、副IDを用いてログインしてくるユーザ端末300のユーザを認証するための副ID用認証データ(例えば、パスワード)と、通信可能な状態で接続されている主ID管理装置100を特定するための主ID管理装置IDと、副ID管理装置200によりユーザに発行される副IDと主IDとの対応関係(副IDと主IDとのリンク関係)を特定するための割当管理IDとを記憶して構成される。
As shown in FIG. 4, the sub ID management information 211 includes a sub ID issued to uniquely identify a virtual person used by the user on the network, and the user terminal 300 that logs in using the sub ID. By sub-ID authentication data (for example, password) for authenticating a user, a main ID management device ID for specifying the main ID management device 100 connected in a communicable state, and the sub-ID management device 200 An allocation management ID for specifying the correspondence between the sub ID issued to the user and the main ID (link relationship between the sub ID and the main ID) is stored.
主IDと副IDとの対応関係について簡単に説明すると、図4に示すように、例えば、主ID管理情報内の主ID「aaaaa」は、副ID管理情報内の副ID「FJS」と、割当管理ID「8h49i」により紐付けられる。
The correspondence between the primary ID and the secondary ID will be briefly described. As shown in FIG. 4, for example, the primary ID “aaaaaa” in the primary ID management information is changed to the secondary ID “FJS” in the secondary ID management information, It is associated with the allocation management ID “8h49i”.
制御部220は、所定の制御プログラム、各種の処理手順などを規定したプログラムおよび所要データを格納するための内部メモリを有し、これらによって種々の処理を実行する処理部であり、特に本発明に密接に関連するものとしては、データ送受信部221と、副ID生成部222と、本人確認データ生成部223と、割当管理ID生成部224と、データ登録部225とを備える。
The control unit 220 has a predetermined control program, a program defining various processing procedures, and an internal memory for storing necessary data, and performs various processing using these, and is particularly suitable for the present invention. As closely related, a data transmission / reception unit 221, a sub ID generation unit 222, an identity verification data generation unit 223, an allocation management ID generation unit 224, and a data registration unit 225 are provided.
データ送受信部221は、ユーザ端末300および主ID管理装置100との間でデータの送受信を行う処理部である。具体的には、ユーザ端末300から副ID発行依頼や本人確認データ発行依頼、副ID送信依頼を受信し、後述する副ID生成部222により生成された副IDおよび副ID用パスワードや、後述する本人確認データ生成部223により生成された本人確認データをユーザ端末300に対して送信する。
The data transmission / reception unit 221 is a processing unit that transmits and receives data between the user terminal 300 and the main ID management device 100. Specifically, a sub ID issue request, a personal identification data issue request, and a sub ID transmission request are received from the user terminal 300, and a sub ID and a sub ID password generated by a sub ID generation unit 222, which will be described later, The identity verification data generated by the identity verification data generation unit 223 is transmitted to the user terminal 300.
また、データ送受信部221は、主ID管理装置100から割当管理ID発行依頼を受信し、主ID管理装置100に対して割当管理IDを送信する。
Further, the data transmission / reception unit 221 receives an allocation management ID issue request from the main ID management device 100 and transmits an allocation management ID to the main ID management device 100.
副ID生成部222は、副IDを生成する処理部である。具体的には、データ送受信部221がユーザ端末300から副ID発行依頼を受信すると、副IDおよび副ID用パスワードを生成する。
The secondary ID generation unit 222 is a processing unit that generates a secondary ID. Specifically, when the data transmission / reception unit 221 receives a sub ID issue request from the user terminal 300, it generates a sub ID and a sub ID password.
本人確認データ生成部223は、本人確認データを生成する処理部である。具体的には、データ送受信部221がユーザ端末300から本人確認データ発行依頼を受信すると、本人確認データを生成する。
The personal identification data generation unit 223 is a processing unit that generates personal identification data. Specifically, when the data transmission / reception unit 221 receives a personal identification data issuance request from the user terminal 300, personal identification data is generated.
割当管理ID生成部224は、副IDと主IDとの対応関係(副IDと主IDとのリンク関係)を特定するための割当管理IDを生成する処理部である。具体的には、データ送受信部221が主ID管理装置100から割当管理ID発行依頼を受信すると、割当管理ID発行依頼に含まれる認証結果が主IDの正当な所有者を証明するものであるとともに、割当管理ID発行依頼に含まれる本人確認データと、ユーザ端末300に対して送信した本人確認データが一致する場合には、割当管理IDを生成する。
The allocation management ID generation unit 224 is a processing unit that generates an allocation management ID for specifying the correspondence between the sub ID and the main ID (the link relationship between the sub ID and the main ID). Specifically, when the data transmission / reception unit 221 receives an allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID. When the personal identification data included in the allocation management ID issuance request matches the personal identification data transmitted to the user terminal 300, an allocation management ID is generated.
データ登録部225は、副IDや割当管理ID等の登録を行う処理部である。具体的には、副ID生成部222により生成された副IDと、割当管理ID生成部224により生成された割当管理IDと、割当管理IDの送信先である主ID管理装置100を特定するための主ID管理装置IDとを対応付けて副ID管理情報211に保存する。
The data registration unit 225 is a processing unit that registers a sub ID, an allocation management ID, and the like. Specifically, in order to identify the secondary ID generated by the secondary ID generation unit 222, the allocation management ID generated by the allocation management ID generation unit 224, and the main ID management device 100 that is the transmission destination of the allocation management ID. Are stored in the secondary ID management information 211 in association with each other.
[ID管理システムの処理(実施例1)]
続いて、図6を用いて、実施例1に係るID管理システムの処理を説明する。図6は、実施例1に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (Example 1)]
Subsequently, processing of the ID management system according to the first embodiment will be described with reference to FIG. FIG. 6 is a diagram illustrating a process flow of the ID management system according to the first embodiment.
続いて、図6を用いて、実施例1に係るID管理システムの処理を説明する。図6は、実施例1に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (Example 1)]
Subsequently, processing of the ID management system according to the first embodiment will be described with reference to FIG. FIG. 6 is a diagram illustrating a process flow of the ID management system according to the first embodiment.
同図に示すように、ユーザ端末300が副ID管理装置200に副ID発行依頼を送信すると(ステップS601)、副ID管理装置200は、副IDおよび副ID用パスワードを生成して(ステップS602)、副ID管理情報211に保存する(ステップS603)。
As shown in the figure, when the user terminal 300 transmits a sub ID issue request to the sub ID management apparatus 200 (step S601), the sub ID management apparatus 200 generates a sub ID and a sub ID password (step S602). ) And stored in the sub ID management information 211 (step S603).
次に、ユーザ端末300は、主ID、主ID用パスワードおよび主ID管理装置IDの入力をユーザから受け付けて取得すると(ステップS604)、本人確認データの発行依頼を副ID管理装置200に送信する(ステップS605)。
Next, when the user terminal 300 receives and acquires the input of the main ID, the main ID password, and the main ID management device ID from the user (step S604), the user terminal 300 transmits a request for issuing personal identification data to the sub ID management device 200. (Step S605).
副ID管理装置200は、本人確認データを生成して(ステップS606)、生成された本人確認データをユーザ端末300に送信する(ステップS607)。
The secondary ID management device 200 generates identity verification data (step S606), and transmits the generated identity verification data to the user terminal 300 (step S607).
ユーザ端末300は、副ID管理装置200から本人確認データを受信すると、ユーザからの入力を受け付けた主IDおよび主ID用パスワードにより、主ID管理装置100に対するログインを試みる(ステップS608)。
When the user terminal 300 receives the personal identification data from the secondary ID management device 200, the user terminal 300 attempts to log in to the main ID management device 100 using the main ID and the main ID password received from the user (step S608).
主ID管理装置100は、ユーザ端末300からのログインを受け付けると、ログイン時に取得された主IDが主ID管理情報111内に登録済みのものであるかどうか確認する(ステップS609)。そして、主ID管理装置100は、主IDが登録済みのものである場合には、この主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードを取得し、ログイン時に主IDとともに受け付けられた主ID用パスワードと比較して、主IDの正当な所有者であるか否かの認証を行う(ステップS610)。
When the main ID management device 100 accepts the login from the user terminal 300, the main ID management device 100 checks whether or not the main ID acquired at the time of login is already registered in the main ID management information 111 (step S609). When the main ID is already registered, the main ID management device 100 acquires the main ID password stored in the main ID management information 111 in association with the main ID, and logs in the main ID at the time of login. Compared with the main ID password received together with the ID, authentication is performed as to whether or not the owner is a valid owner of the main ID (step S610).
ユーザ端末300は、主ID管理装置100へのログインに続いて、副IDへの主IDの割当処理依頼を送信する(ステップS611)。主ID管理装置100は、ユーザ端末300から副IDへの主IDの割当処理依頼を受信すると、主IDの認証結果、および割当処理依頼に含まれる本人確認データとを合わせた割当管理ID発行依頼を副ID管理装置200に送信する(ステップS612)。
The user terminal 300 transmits a request for assigning the main ID to the sub ID following the login to the main ID management apparatus 100 (step S611). When the main ID management device 100 receives the request for assigning the main ID to the sub-ID from the user terminal 300, the assignment management ID issuance request that combines the authentication result of the main ID and the personal identification data included in the assignment processing request. Is transmitted to the secondary ID management device 200 (step S612).
副ID管理装置200は、主ID管理装置100から割当管理ID発行依頼を受信すると、割当管理ID発行依頼に含まれる認証結果が主IDの正当な所有者を証明するものであるとともに、割当管理ID発行依頼に含まれる本人確認データと、ユーザ端末300に対して送信した本人確認データが一致するか否かを確認する(ステップS613)。そして、副ID管理装置200は、割当管理ID発行依頼に含まれる本人確認データと、ユーザ端末300に対して送信した本人確認データが一致する場合には、割当管理IDを生成する(ステップS614)。
When the secondary ID management device 200 receives the allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID and the allocation management. It is confirmed whether or not the identity confirmation data included in the ID issuance request matches the identity confirmation data transmitted to the user terminal 300 (step S613). Then, the secondary ID management device 200 generates an allocation management ID when the personal identification data included in the allocation management ID issuance request matches the personal identification data transmitted to the user terminal 300 (step S614). .
次に、副ID管理装置200は、先に生成して副ID管理情報211に登録した副IDに対応付けて、割当管理IDと、割当管理IDの送信先である主ID管理装置100を特定するための主ID管理装置IDとを保存し(ステップS615)、割当管理IDを主ID管理装置100に送信する(ステップS616)。
Next, the secondary ID management device 200 identifies the allocation management ID and the primary ID management device 100 that is the transmission destination of the allocation management ID in association with the secondary ID that has been generated and registered in the secondary ID management information 211. The main ID management device ID is stored (step S615), and the allocation management ID is transmitted to the main ID management device 100 (step S616).
主ID管理装置100は、副ID管理装置200から受信した割当管理IDと、割当管理IDの送信元である副ID管理装置200を特定するための副ID管理装置IDと、ログイン受付時に取得された主IDとを対応付けて主ID管理情報111に保存し(ステップS617)、主IDの割当処理完了通知をユーザ端末300に送信する(ステップS618)。
The primary ID management device 100 is acquired at the time of log-in reception, the allocation management ID received from the secondary ID management device 200, the secondary ID management device ID for identifying the secondary ID management device 200 that is the transmission source of the allocation management ID. The main ID is stored in the main ID management information 111 in association with each other (step S617), and a main ID assignment process completion notification is transmitted to the user terminal 300 (step S618).
ユーザ端末300は、主ID管理装置100から主IDの割当処理完了通知を受信すると、副IDの送信依頼を副ID管理装置200に送信する(ステップS619)。副ID管理装置200は、ユーザ端末300に副IDおよび副ID用パスワードを送信する(ステップS620)。ユーザ端末300は、副ID管理装置200から受信した副IDおよび副ID用パスワードをユーザに通知する(ステップS621)。
When the user terminal 300 receives the main ID assignment processing completion notification from the main ID management device 100, the user terminal 300 transmits a sub ID transmission request to the sub ID management device 200 (step S619). The secondary ID management device 200 transmits the secondary ID and the secondary ID password to the user terminal 300 (step S620). The user terminal 300 notifies the user of the sub ID and the sub ID password received from the sub ID management device 200 (step S621).
[実施例1による効果]
上述してきたように、実施例1によれば、主ID管理装置100は、主IDと、副ID管理装置200を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDと、主IDにより特定されるユーザの個人情報とを対応付けて管理し、副ID管理装置200は、副IDと、主ID管理装置100を特定するための主ID管理装置IDと、割当管理IDとを対応付けて管理する。このように、主ID管理装置100および副ID管理装置200で分散させて管理される主IDと副IDと割当管理IDで紐付けておくことで、主ID管理装置100に副IDを知らせることなく、副ID管理装置200に主IDを知らせることなく、割当管理IDに基づいて必要な情報のやり取りを装置間で実行することができ、仮に、主ID管理装置100または副ID管理装置200で管理される情報のいずれか一方が暴露されてしまっても、主IDと副IDとの対応関係が暴露されてしまうことを防止することできるという効果を奏する。 [Effects of Example 1]
As described above, according to the first embodiment, the mainID management device 100 has a correspondence between the main ID, the sub ID management device ID for specifying the sub ID management device 200, and the sub ID and the main ID. The sub-ID management device 200 manages the sub-ID and the main ID management device 100 in association with the assignment management ID for specifying the ID and the personal information of the user specified by the main ID in association with each other. The ID management device ID and the allocation management ID are managed in association with each other. As described above, the main ID management apparatus 100 and the sub ID management apparatus 200 are distributed and managed, and the main ID, the sub ID, and the allocation management ID are associated with each other, thereby informing the main ID management apparatus 100 of the sub ID. In addition, necessary information can be exchanged between the devices based on the assigned management ID without notifying the secondary ID management device 200 of the primary ID, and it is assumed that the primary ID management device 100 or the secondary ID management device 200 Even if any one of the managed information is exposed, it is possible to prevent the correspondence between the primary ID and the secondary ID from being exposed.
上述してきたように、実施例1によれば、主ID管理装置100は、主IDと、副ID管理装置200を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDと、主IDにより特定されるユーザの個人情報とを対応付けて管理し、副ID管理装置200は、副IDと、主ID管理装置100を特定するための主ID管理装置IDと、割当管理IDとを対応付けて管理する。このように、主ID管理装置100および副ID管理装置200で分散させて管理される主IDと副IDと割当管理IDで紐付けておくことで、主ID管理装置100に副IDを知らせることなく、副ID管理装置200に主IDを知らせることなく、割当管理IDに基づいて必要な情報のやり取りを装置間で実行することができ、仮に、主ID管理装置100または副ID管理装置200で管理される情報のいずれか一方が暴露されてしまっても、主IDと副IDとの対応関係が暴露されてしまうことを防止することできるという効果を奏する。 [Effects of Example 1]
As described above, according to the first embodiment, the main
また、実施例1よれば、主ID管理装置100にログインするユーザの主IDが、正当なユーザの主IDであることを主ID管理装置100によって認証された場合に、副ID管理装置200は、ユーザからの要求に応じて副IDを提供して主IDに割り当てるので、主IDおよび副IDの匿名性を保持するとともに、主IDが存在することを条件に副IDを発行することができるという効果を奏する。また、副IDを用いたサービスの提供に際して問題が発生した場合には、必要に応じて、主IDに対応するユーザへの責任追及ができるという効果を奏する。
Further, according to the first embodiment, when the main ID management device 100 authenticates that the main ID of the user who logs in to the main ID management device 100 is the main ID of a valid user, the secondary ID management device 200 Since the sub ID is provided and assigned to the main ID in response to a request from the user, the anonymity of the main ID and the sub ID can be maintained and the sub ID can be issued on condition that the main ID exists. There is an effect. In addition, when a problem occurs in providing a service using the sub-ID, there is an effect that the responsibility corresponding to the user corresponding to the main ID can be pursued as necessary.
本発明に係るID管理システムの副IDの発行手順は、上記の実施例1で説明した発行手順(図6参照)に限られるものではない。そこで、以下の実施例2では、副IDの発行手順の他の形態を説明する。
The issuing procedure of the sub ID of the ID management system according to the present invention is not limited to the issuing procedure (see FIG. 6) described in the first embodiment. Therefore, in the following second embodiment, another form of the sub ID issuing procedure will be described.
[ID管理システムの構成(実施例2)]
まず、図7を用いて、実施例2に係るID管理システムの構成を説明する。図7は、実施例2に係る副ID管理装置の構成を示すブロック図である。実施例2に係るID管理システムの構成は、実施例1に係るID管理システムと基本的には同様の構成であるが、以下に説明する点が異なる。 [Configuration of ID management system (second embodiment)]
First, the configuration of the ID management system according to the second embodiment will be described with reference to FIG. FIG. 7 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the second embodiment. The configuration of the ID management system according to the second embodiment is basically the same as that of the ID management system according to the first embodiment, but differs in the points described below.
まず、図7を用いて、実施例2に係るID管理システムの構成を説明する。図7は、実施例2に係る副ID管理装置の構成を示すブロック図である。実施例2に係るID管理システムの構成は、実施例1に係るID管理システムと基本的には同様の構成であるが、以下に説明する点が異なる。 [Configuration of ID management system (second embodiment)]
First, the configuration of the ID management system according to the second embodiment will be described with reference to FIG. FIG. 7 is a block diagram illustrating the configuration of the secondary ID management apparatus according to the second embodiment. The configuration of the ID management system according to the second embodiment is basically the same as that of the ID management system according to the first embodiment, but differs in the points described below.
すなわち、主ID管理装置100の所有者確認部122は、副ID管理装置200からログインを受け付けると、ログイン時に取得された暗号主IDを、暗号化に用いられた公開鍵に対応する秘密鍵で復号化して主IDを取得し、この主IDが主ID管理情報111内に登録済みのものであるかどうか確認する。
That is, when the owner confirmation unit 122 of the main ID management device 100 accepts login from the sub ID management device 200, the encryption main ID acquired at the time of login is a secret key corresponding to the public key used for encryption. The main ID is obtained by decryption, and it is confirmed whether or not this main ID is already registered in the main ID management information 111.
次に、主ID管理装置100の所有者確認部122は、主IDが登録済みのものである場合には、この主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードを取得し、ログイン時に暗号主IDとともに受け付けられた暗号主ID用パスワードを秘密鍵で復号化して取得した主ID用パスワードと比較し、主IDの正当な所有者であるか否かの認証を行う。
Next, when the main ID is already registered, the owner confirmation unit 122 of the main ID management device 100 stores the main ID password stored in the main ID management information 111 in association with the main ID. And authenticate whether or not it is a legitimate owner of the main ID by comparing the main ID password obtained by decrypting the encrypted main ID password received with the encryption main ID at the time of login with a secret key. Do.
そして、主ID管理装置100のデータ送受信部121は、所有者確認部122による主IDの認証結果を含む割当管理ID発行依頼を副ID管理装置200に送信する。また、主ID管理装置100のデータ送受信部121は、データ登録部123による登録が完了すると、主IDの割当処理完了通知を副ID管理装置200に送信する。
Then, the data transmission / reception unit 121 of the main ID management device 100 transmits an allocation management ID issuance request including the authentication result of the main ID by the owner confirmation unit 122 to the sub ID management device 200. In addition, when the registration by the data registration unit 123 is completed, the data transmission / reception unit 121 of the main ID management apparatus 100 transmits a main ID assignment process completion notification to the sub ID management apparatus 200.
また、図7に示すように、副ID管理装置200の主ID認証依頼部226は、データ送受信部221によって、主ID管理装置ID、暗号主IDおよび暗号主ID用パスワードとともに、副IDへの主IDの割当処理依頼がユーザ端末300から受信されると、暗号主IDおよび暗号主ID用パスワードにより、主ID管理装置100に対するログインを試みる。
Further, as shown in FIG. 7, the main ID authentication request unit 226 of the sub ID management device 200 uses the data transmission / reception unit 221 to transfer the sub ID to the sub ID together with the main ID management device ID, the encryption main ID, and the encryption main ID password. When the main ID assignment processing request is received from the user terminal 300, login to the main ID management device 100 is attempted using the encryption main ID and the encryption main ID password.
副ID管理装置200の割当管理ID生成部224は、主ID管理装置100から割当管理ID発行依頼を受信すると、割当管理ID発行依頼に含まれる認証結果が主IDの正当な所有者を証明するものである場合には、割当管理IDを生成する。
When the allocation management ID generation unit 224 of the secondary ID management device 200 receives the allocation management ID issuance request from the main ID management device 100, the authentication result included in the allocation management ID issuance request proves the right owner of the main ID. If it is, an allocation management ID is generated.
副ID管理装置200のデータ送受信部221は、主ID管理装置100から主IDの割当処理完了通知を受信すると、主IDの割当処理完了通知をユーザ端末300に転送する。
When the data transmission / reception unit 221 of the secondary ID management device 200 receives the main ID assignment processing completion notification from the main ID management device 100, it transfers the main ID assignment processing completion notification to the user terminal 300.
また、上記に説明した処理に以下に説明する処理を追加して、実施例2に係るID管理システムを構成することもできる。
Further, the process described below can be added to the process described above to configure the ID management system according to the second embodiment.
すなわち、主ID管理装置100の所有者確認部122は、主IDが登録済みのものである場合には、確認データ(チャレンジデータ)を生成して、副ID管理装置200に送信する。
That is, the owner confirmation unit 122 of the main ID management device 100 generates confirmation data (challenge data) and transmits it to the sub ID management device 200 when the main ID is already registered.
そして、主ID管理装置100の所有者確認部122は、副ID管理装置200から暗号確認データを受信すると、先に登録済みのものとして確認された主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードを取得し、この主ID用パスワードを用いて確認データを暗号化して作成した暗号確認データと、副ID管理装置200から受信した暗号確認データとを比較して、主IDの正当な所有者であるか否かの認証を行う。
When the owner confirmation unit 122 of the main ID management device 100 receives the encryption confirmation data from the sub ID management device 200, the owner confirmation unit 122 associates the main ID management information 111 with the main ID that has been confirmed as being registered first. Obtain the stored main ID password, compare the encryption confirmation data created by encrypting the confirmation data using the main ID password, and the encryption confirmation data received from the secondary ID management device 200, Authentication is performed as to whether or not the owner of the main ID is valid.
また、副ID管理装置200の主ID認証依頼部226は、データ送受信部221によって、主ID管理装置IDおよび暗号主IDとともに、副IDへの主IDの割当処理依頼がユーザ端末300から受信されると、暗号主IDにより、主ID管理装置100に対するログインを試みる。
Also, the main ID authentication request unit 226 of the secondary ID management device 200 receives a request for assigning a primary ID to the secondary ID from the user terminal 300 together with the primary ID management device ID and the encryption main ID by the data transmission / reception unit 221. Then, login to the main ID management device 100 is attempted using the encryption main ID.
副ID管理装置200のデータ送受信部221は、主ID管理装置100から確認データを受信すると、受信した確認データをユーザ端末300に転送し、ユーザ端末300から暗号確認データを受信すると、受信した暗号確認データを主ID管理装置100に転送する。
When the data transmission / reception unit 221 of the secondary ID management device 200 receives the confirmation data from the main ID management device 100, the data transmission / reception unit 221 transfers the received confirmation data to the user terminal 300 and receives the encryption confirmation data from the user terminal 300. The confirmation data is transferred to the main ID management device 100.
[ID管理システムの処理(実施例2)]
以下に、図8および図9を用いて、実施例2に係るID管理システムの処理を説明する。図8および図9は、実施例2に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (second embodiment)]
Hereinafter, processing of the ID management system according to the second embodiment will be described with reference to FIGS. 8 and 9. 8 and 9 are diagrams illustrating a process flow of the ID management system according to the second embodiment.
以下に、図8および図9を用いて、実施例2に係るID管理システムの処理を説明する。図8および図9は、実施例2に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (second embodiment)]
Hereinafter, processing of the ID management system according to the second embodiment will be described with reference to FIGS. 8 and 9. 8 and 9 are diagrams illustrating a process flow of the ID management system according to the second embodiment.
まず、図8を用いて、実施例2に係るID管理システムの処理を説明する。実施例1に係るID管理システムの処理とは、図8に示すステップS804~ステップS815、ステップS819およびステップS820が異なる。
First, the processing of the ID management system according to the second embodiment will be described with reference to FIG. Steps S804 to S815, steps S819, and S820 shown in FIG. 8 are different from the processing of the ID management system according to the first embodiment.
すなわち、ユーザ端末300は、ユーザから主ID、主ID用パスワードおよび主ID管理装置IDの入力を受け付けると(ステップS804)、主ID管理装置100の公開鍵を取得し(ステップS805)、この公開鍵を用いて主IDを暗号化し、暗号主IDを作成する(ステップS806)。
That is, when the user terminal 300 receives input of the main ID, the main ID password, and the main ID management device ID from the user (step S804), the user terminal 300 acquires the public key of the main ID management device 100 (step S805). The main ID is encrypted using the key to create an encrypted main ID (step S806).
同様に、ユーザ端末300は、主ID管理装置100の公開鍵を用いて主ID用パスワードを暗号化して暗号主IDパスワードを作成し(ステップS807)、主ID管理装置ID、暗号主IDおよび暗号主ID用パスワードとともに、副IDへの主IDの割当処理依頼を副ID管理装置200に送信する(ステップS808)。
Similarly, the user terminal 300 encrypts the main ID password using the public key of the main ID management device 100 to create an encrypted main ID password (step S807), and the main ID management device ID, encryption main ID, and encryption Along with the main ID password, a request for assigning the main ID to the sub ID is transmitted to the sub ID management apparatus 200 (step S808).
副ID管理装置200は、主ID管理装置ID、暗号主IDおよび暗号主ID用パスワードとともに、副IDへの主IDの割当処理依頼をユーザ端末300から受信すると、暗号主IDおよび暗号主ID用パスワードにより、主ID管理装置100に対するログインを試みる(ステップS809)。
When the secondary ID management device 200 receives a request for assigning the primary ID to the secondary ID together with the primary ID management device ID, the cryptographic primary ID, and the cryptographic primary ID password from the user terminal 300, the secondary ID management device 200 uses the cryptographic primary ID and the cryptographic primary ID. A login to the main ID management device 100 is attempted using the password (step S809).
主ID管理装置100は、副ID管理装置200からログインを受け付けると、ログイン時に取得された暗号主IDを、暗号化に用いられた公開鍵に対応する秘密鍵で復号化して主IDを取得し(ステップS810)、この主IDが主ID管理情報111内に登録済みのものであるかどうか確認する(ステップS811)。
When receiving the login from the secondary ID management device 200, the main ID management device 100 acquires the main ID by decrypting the encryption main ID acquired at the time of login with the private key corresponding to the public key used for encryption. (Step S810), it is confirmed whether or not the main ID is already registered in the main ID management information 111 (Step S811).
次に、主ID管理装置100は、主IDが登録済みのものである場合には、ログイン時に暗号主IDとともに受け付けられた暗号主ID用パスワードを秘密鍵で復号化して、主ID用パスワードを取得し(ステップS812)、登録済みのものとして確認された主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードと比較して、主IDの正当な所有者であるか否かの認証を行う(ステップS813)。
Next, when the main ID is already registered, the main ID management device 100 decrypts the encryption main ID password received together with the encryption main ID at the time of login with the secret key, and obtains the main ID password. Whether it is a legitimate owner of the main ID as compared with the main ID password stored in the main ID management information 111 in association with the main ID acquired (step S812) and confirmed as registered No authentication is performed (step S813).
そして、主ID管理装置100は、主IDの認証結果を含む割当管理ID発行依頼を副ID管理装置200に送信する(ステップS814)。
Then, the main ID management device 100 transmits an allocation management ID issue request including the authentication result of the main ID to the sub ID management device 200 (step S814).
副ID管理装置200は、主ID管理装置100から割当管理ID発行依頼を受信すると、割当管理ID発行依頼に含まれる認証結果が主IDの正当な所有者を証明するものである場合には、割当管理IDを生成する(ステップS815)。
When the secondary ID management device 200 receives the allocation management ID issuance request from the main ID management device 100, if the authentication result included in the allocation management ID issuance request proves the legitimate owner of the main ID, An allocation management ID is generated (step S815).
主ID管理装置100は、主IDや割当管理ID等の登録が完了すると、主IDの割当処理完了通知を副ID管理装置200に送信する(ステップS819)。
When the registration of the main ID, the allocation management ID, and the like is completed, the main ID management apparatus 100 transmits a main ID allocation process completion notification to the secondary ID management apparatus 200 (step S819).
副ID管理装置200は、主ID管理装置100から主IDの割当処理完了通知を受信すると、主IDの割当処理完了通知をユーザ端末300に転送する(ステップS820)。
Upon receiving the main ID assignment process completion notification from the main ID management apparatus 100, the secondary ID management apparatus 200 transfers the main ID assignment process completion notice to the user terminal 300 (step S820).
また、図9に示すID管理システムの処理は、図8を用いて上記に説明した処理とは以下に説明する点が異なる。
Further, the processing of the ID management system shown in FIG. 9 is different from the processing described above with reference to FIG. 8 in the points described below.
すなわち、ユーザ端末300は、主ID管理装置100の公開鍵を用いて主IDを暗号化して暗号主IDを作成し(ステップS906)、主ID管理装置IDおよび暗号主IDとともに、副IDへの主IDの割当処理依頼を副ID管理装置200に送信する(ステップS907)。
That is, the user terminal 300 encrypts the main ID using the public key of the main ID management device 100 to create an encrypted main ID (step S906), and sends the sub ID to the sub ID together with the main ID management device ID and the encryption main ID. The main ID assignment processing request is transmitted to the sub ID management device 200 (step S907).
副ID管理装置200は、主ID管理装置IDおよび暗号主IDとともに、副IDへの主IDの割当処理依頼をユーザ端末300から受信すると、暗号主IDにより、主ID管理装置100に対するログインを試みる(ステップS908)。
When the secondary ID management device 200 receives a request for assigning a primary ID to the secondary ID together with the primary ID management device ID and the encryption main ID from the user terminal 300, the secondary ID management device 200 attempts to log in to the primary ID management device 100 using the encryption main ID. (Step S908).
主ID管理装置100は、主IDが登録済みのものである場合には、確認データ(チャレンジデータ)を生成して、副ID管理装置200に送信する(ステップS912)。
When the main ID is already registered, the main ID management device 100 generates confirmation data (challenge data) and transmits it to the sub ID management device 200 (step S912).
副ID管理装置200は、主ID管理装置100から確認データを受信すると、受信した確認データをユーザ端末300に転送する(ステップS913)。
When the sub ID management device 200 receives the confirmation data from the main ID management device 100, the sub ID management device 200 transfers the received confirmation data to the user terminal 300 (step S913).
ユーザ端末300は、副ID管理装置200から確認データを受信すると、主ID用パスワードを用いて確認データを暗号化し、暗号確認データを作成する(ステップS914)。そして、ユーザ端末300は、暗号確認データを副ID管理装置200に送信する(ステップS915)。副ID管理装置200は、ユーザ端末300から暗号確認データを受信すると、受信した暗号確認データを主ID管理装置100に転送する(ステップS916)。
When the user terminal 300 receives the confirmation data from the secondary ID management apparatus 200, the user terminal 300 encrypts the confirmation data using the main ID password and creates encrypted confirmation data (step S914). Then, the user terminal 300 transmits the encryption confirmation data to the sub ID management device 200 (step S915). When receiving the encryption confirmation data from the user terminal 300, the secondary ID management device 200 transfers the received encryption confirmation data to the main ID management device 100 (step S916).
主ID管理装置100は、副ID管理装置200から暗号確認データを受信すると、先に登録済みのものとして確認された主IDに対応付けて主ID管理情報111に記憶されている主ID用パスワードを取得し、この主ID用パスワードを用いて確認データを暗号化して作成した暗号確認データと、副ID管理装置200から受信した暗号確認データとを比較して、主IDの正当な所有者であるか否かの認証を行う(ステップS917)。
When the primary ID management device 100 receives the encryption confirmation data from the secondary ID management device 200, the primary ID password stored in the primary ID management information 111 in association with the primary ID that has been previously confirmed as registered. And the encryption confirmation data created by encrypting the confirmation data using the main ID password is compared with the encryption confirmation data received from the sub-ID management device 200, and the authorized owner of the main ID Authentication of whether or not there is is performed (step S917).
上記の実施例では、副ID管理情報において単数の主ID管理装置の情報を管理する場合を説明したが、本発明はこれに限定されるものではなく、ユーザの個人情報の種類ごとに、別個の個人情報を保有する複数の主ID管理装置の情報をそれぞれ管理するようにしてもよい。そこで、以下の実施例3では、実施例3に係るID管理システムの特徴、構成および処理を順に説明する。
In the above-described embodiment, the case where information of a single primary ID management device is managed in the secondary ID management information has been described. However, the present invention is not limited to this and is separately provided for each type of personal information of the user. Information of a plurality of main ID management devices that hold the personal information may be managed respectively. Thus, in the following third embodiment, the features, configuration, and processing of the ID management system according to the third embodiment will be described in order.
[ID管理システムの特徴(実施例3)]
まず、図10を用いて、実施例3に係るID管理システムの特徴を説明する。図10は、実施例3に係るID管理システムの特徴を説明するための図である。 [Characteristics of ID management system (Example 3)]
First, the features of the ID management system according to the third embodiment will be described with reference to FIG. FIG. 10 is a diagram for explaining the features of the ID management system according to the third embodiment.
まず、図10を用いて、実施例3に係るID管理システムの特徴を説明する。図10は、実施例3に係るID管理システムの特徴を説明するための図である。 [Characteristics of ID management system (Example 3)]
First, the features of the ID management system according to the third embodiment will be described with reference to FIG. FIG. 10 is a diagram for explaining the features of the ID management system according to the third embodiment.
実施例3に係るID管理システムは、上記の実施例と同様に、ユーザからの要求に応じて発行した主IDおよび副IDを管理することを概要とするが、ユーザの個人情報の種類ごとに、別個の個人情報を保有する複数の主ID管理装置の情報をそれぞれ管理する点に主たる特徴がある。
The ID management system according to the third embodiment outlines the management of the main ID and the sub ID issued in response to a request from the user, as in the above-described embodiment, but for each type of personal information of the user. The main feature is that each piece of information of a plurality of main ID management devices having separate personal information is managed.
具体的には、図10に示すように、ユーザの個人情報の一つ(例えば、口座情報や損害保険情報などの決済処理などに用いられる金銭関係の情報)と、ユーザからの要求に応じて発行した主ID(例えば、「aaaaa」)とを対応付けて管理する主ID管理装置A(主ID管理装置ID:0020)、および主ID管理装置Aで管理されているものとは異なるユーザの個人情報(例えば、住所や戸籍情報などの物流を支援する情報)と、ユーザからの要求に応じて発行した主ID(例えば、「kx010」)とを対応付けて管理する主ID管理装置B(主ID管理装置ID:3350)の各々について、副ID管理装置Sは情報を管理する。
Specifically, as shown in FIG. 10, in response to one of the user's personal information (for example, money-related information used for settlement processing such as account information and non-life insurance information) and a request from the user The main ID management device A (main ID management device ID: 0020) that manages the issued main ID (for example, “aaaaaa”) in association with each other, and a user that is different from the one managed by the main ID management device A A main ID management apparatus B (for example, information that supports logistics such as address and family register information) and a main ID (for example, “kx010”) issued in response to a request from the user are associated with each other. For each of the primary ID management device ID: 3350), the secondary ID management device S manages information.
すなわち、副ID管理装置Sは、ユーザからの要求に応じて発行した副ID(例えば、「FJS」)が、主ID管理装置Aがユーザに発行する主ID(例えば、「aaaaa」)と、主ID管理装置Bがユーザに発行する主ID(例えば、「kx010」)とに割り当てられて発行されたものである場合には、主ID管理装置Aの主ID管理装置ID「0020」および割当管理ID「8h49i」、および主ID管理装置Bの主ID管理装置ID「3350」および割当管理ID「00230」をあわせて管理する。
That is, the secondary ID management device S has a secondary ID (for example, “FJS”) issued in response to a request from the user and a primary ID (for example, “aaaaaa”) issued by the primary ID management device A to the user. When the main ID management device B is issued by being assigned to a main ID (for example, “kx010”) issued to the user, the main ID management device ID “0020” and the assignment of the main ID management device A The management ID “8h49i”, the main ID management device ID “3350” and the allocation management ID “00230” of the main ID management device B are managed together.
このようにして、一つの副IDに対して複数の主IDを割り当てて管理することにより、ユーザから副IDによりログインを受けて実行される処理において、その処理に付随した個人情報を管理する主ID管理装置と個別にやり取りを行うことができる。
In this way, by managing by assigning a plurality of main IDs to one sub-ID, in the process executed by receiving login from the user by the sub-ID, the main information managing personal information associated with the process is managed. It is possible to exchange with the ID management device individually.
[ID管理システムの構成(実施例3)]
次に、図11および図12を用いて、実施例3に係るID管理システムの構成を説明する。図11は、実施例3に係るID管理システムのシステム構成を示す図である。図12は、実施例3に係る主ID管理情報および副ID管理情報の構成例を示す図である。実施例3に係るID管理システムは、上記の実施例と基本的には同様の構成であるが、以下に説明する点が異なる。 [Configuration of ID management system (Example 3)]
Next, the configuration of the ID management system according to the third embodiment will be described with reference to FIGS. 11 and 12. FIG. 11 is a diagram illustrating a system configuration of the ID management system according to the third embodiment. FIG. 12 is a diagram illustrating a configuration example of main ID management information and sub ID management information according to the third embodiment. The ID management system according to the third embodiment has basically the same configuration as the above-described embodiment, but differs in the points described below.
次に、図11および図12を用いて、実施例3に係るID管理システムの構成を説明する。図11は、実施例3に係るID管理システムのシステム構成を示す図である。図12は、実施例3に係る主ID管理情報および副ID管理情報の構成例を示す図である。実施例3に係るID管理システムは、上記の実施例と基本的には同様の構成であるが、以下に説明する点が異なる。 [Configuration of ID management system (Example 3)]
Next, the configuration of the ID management system according to the third embodiment will be described with reference to FIGS. 11 and 12. FIG. 11 is a diagram illustrating a system configuration of the ID management system according to the third embodiment. FIG. 12 is a diagram illustrating a configuration example of main ID management information and sub ID management information according to the third embodiment. The ID management system according to the third embodiment has basically the same configuration as the above-described embodiment, but differs in the points described below.
すなわち、図11に示すように、実施例3に係るID管理システムは、ユーザが利用するユーザ端末300と、ユーザを一意に特定するための主IDを発行する主IDを管理する複数の主ID管理装置100と、ネットワーク上でユーザにより用いられる仮想人物を一意に特定するための副IDを発行する副ID管理装置200と含んで構成される。また、ユーザ端末300と、各主ID管理装置100および副ID管理装置200とが相互にネットワークを介した通信が可能な状態に接続されるとともに、各主ID管理装置100と副ID管理装置200とが相互にネットワークを介した通信が可能な状態に接続される。
That is, as illustrated in FIG. 11, the ID management system according to the third embodiment includes a user terminal 300 used by a user and a plurality of main IDs that manage a main ID that issues a main ID for uniquely identifying the user. The management apparatus 100 includes a secondary ID management apparatus 200 that issues a secondary ID for uniquely identifying a virtual person used by a user on the network. In addition, the user terminal 300, each main ID management device 100, and the sub ID management device 200 are connected to each other so that they can communicate with each other via a network, and each main ID management device 100 and each sub ID management device 200 are connected. Are connected to each other so that they can communicate with each other via a network.
また、副ID管理情報211は、図12に示すように、ネットワーク上でユーザにより用いられる仮想人物を一意に特定するために発行される副IDと、副IDを用いてログインしてくるユーザ端末300のユーザを認証するための副ID用認証データ(例えば、パスワード)と、通信可能な状態で接続されている各主ID管理装置100を特定するための主ID管理装置IDと、副ID管理装置200によりユーザに発行される副IDと主IDとの対応関係(副IDと主IDとのリンク関係)を特定するための割当管理IDとを記憶して構成される。
In addition, as shown in FIG. 12, the sub ID management information 211 includes a sub ID issued to uniquely identify a virtual person used by the user on the network, and a user terminal that logs in using the sub ID. Sub ID authentication data (for example, a password) for authenticating 300 users, a main ID management device ID for identifying each main ID management device 100 connected in a communicable state, and sub ID management The apparatus 200 is configured to store an allocation management ID for specifying a correspondence relationship (link relationship between the sub ID and the main ID) between the sub ID issued to the user by the device 200 and the main ID.
[ID管理システムの処理(実施例3)]
続いて、図13~15を用いて、実施例3に係るID管理システムの処理を説明する。図13~15は、実施例3に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (Example 3)]
Subsequently, processing of the ID management system according to the third embodiment will be described with reference to FIGS. FIGS. 13 to 15 are flowcharts illustrating the processing flow of the ID management system according to the third embodiment.
続いて、図13~15を用いて、実施例3に係るID管理システムの処理を説明する。図13~15は、実施例3に係るID管理システムの処理の流れを示す図である。 [Processing of ID management system (Example 3)]
Subsequently, processing of the ID management system according to the third embodiment will be described with reference to FIGS. FIGS. 13 to 15 are flowcharts illustrating the processing flow of the ID management system according to the third embodiment.
まず、図13を用いて、実施例3に係るID管理システムの処理の一実施形態について説明する。図13に示す処理は、上記の実施例において図6を用いて説明した処理と以下に説明する点が異なる。
First, an embodiment of processing of the ID management system according to the third embodiment will be described with reference to FIG. The process shown in FIG. 13 differs from the process described with reference to FIG. 6 in the above embodiment in the following points.
すなわち、ユーザ端末300は、主ID管理装置100から割当処理完了通知を受信すると(図13のA参照)、副IDへの割当対象となる全ての主IDの取得が完了したか否かを確認する(ステップS1304)。
That is, when the user terminal 300 receives the assignment processing completion notification from the main ID management device 100 (see A in FIG. 13), it confirms whether or not acquisition of all the main IDs to be assigned to the sub-IDs has been completed. (Step S1304).
確認の結果、全ての主IDの取得が完了している場合には(ステップS1305肯定、図13のB参照)、ユーザ端末300は、副ID管理装置200に副IDの送信依頼を送信して(ステップS1321)、上記の実施例で説明した処理(図6参照)と同様に処理が流れる。
If all the main IDs have been acquired as a result of the confirmation (Yes in step S1305, see B in FIG. 13), the user terminal 300 transmits a sub ID transmission request to the sub ID management device 200. (Step S1321), the process flows in the same manner as the process described in the above embodiment (see FIG. 6).
一方、確認の結果、全ての主IDの取得が完了していない場合には(ステップS1305否定)、次の主ID管理装置100の主ID、主ID用パスワードおよび主ID管理装置IDの入力をユーザから受け付けて取得した後(ステップS1306)、本人確認データ発行依頼を副ID管理装置200に送信して(ステップS1307)、上記の実施例で説明した処理(図6参照)と同様に処理が流れる。
On the other hand, if all the main IDs have not been acquired as a result of the confirmation (No at step S1305), the main ID, the main ID password and the main ID management device ID of the next main ID management device 100 are input. After being received and acquired from the user (step S1306), an identity verification data issuance request is transmitted to the secondary ID management device 200 (step S1307), and the process is the same as the process described in the above embodiment (see FIG. 6). Flowing.
次に、図14を用いて、実施例3に係るID管理システムの処理の一実施形態について説明する。図14に示す処理は、上記の実施例において図8を用いて説明した処理と以下に説明する点が異なる。
Next, an embodiment of processing of the ID management system according to the third embodiment will be described with reference to FIG. The process shown in FIG. 14 differs from the process described with reference to FIG. 8 in the above embodiment in the following points.
すなわち、ユーザ端末300は、副ID管理装置200から割当処理完了通知を受信すると(図14のA参照)、副IDへの割当対象となる全ての主IDの取得が完了したか否かを確認する(ステップS1404)。
That is, when the user terminal 300 receives the allocation process completion notification from the secondary ID management device 200 (see A in FIG. 14), it confirms whether or not acquisition of all the primary IDs to be allocated to the secondary ID has been completed. (Step S1404).
確認の結果、全ての主IDの取得が完了している場合には(ステップS1405肯定、図13のB参照)、ユーザ端末300は、副ID管理装置200に副IDの送信依頼を送信して(ステップS1423)、上記の実施例で説明した処理(図8参照)と同様に処理が流れる。
If all the main IDs have been acquired as a result of the confirmation (Yes in step S1405, see B in FIG. 13), the user terminal 300 transmits a sub ID transmission request to the sub ID management device 200. (Step S1423), the process flows in the same manner as the process described in the above embodiment (see FIG. 8).
一方、確認の結果、全ての主IDの取得が完了していない場合には(ステップS1404否定)、次の主ID管理装置100の主ID、主ID用パスワードおよび主ID管理装置IDの入力をユーザから受け付けて取得した後(ステップS1406)、主ID管理装置100の公開鍵を取得し(ステップS1407)、この公開鍵を用いて主IDを暗号化して暗号主IDを作成し(ステップS1408)、上記の実施例で説明した処理(図8参照)と同様に処理が流れる。
On the other hand, if all the main IDs have not been acquired as a result of the confirmation (No at step S1404), the next main ID, main ID password, and main ID management device ID are input. After receiving and acquiring from the user (step S1406), the public key of the main ID management apparatus 100 is acquired (step S1407), and the main ID is encrypted using this public key to create an encrypted main ID (step S1408). The process flows in the same manner as the process described in the above embodiment (see FIG. 8).
続いて、図15を用いて、実施例3に係るID管理システムの処理の一実施形態について説明する。図15に示す処理は、上記の実施例において図9を用いて説明した処理と以下に説明する点が異なる。
Subsequently, an embodiment of processing of the ID management system according to the third embodiment will be described with reference to FIG. The process shown in FIG. 15 differs from the process described with reference to FIG. 9 in the above embodiment in the following points.
すなわち、ユーザ端末300は、副ID管理装置200から割当処理完了通知を受信すると(図15のA参照)、副IDへの割当対象となる全ての主IDの取得が完了したか否かを確認する(ステップS1504)。
That is, when the user terminal 300 receives the allocation process completion notification from the secondary ID management device 200 (see A in FIG. 15), it confirms whether or not acquisition of all the primary IDs to be allocated to the secondary ID has been completed. (Step S1504).
確認の結果、全ての主IDの取得が完了している場合には(ステップS1505肯定、図15のB参照)、ユーザ端末300は、副ID管理装置200に副IDの送信依頼を送信して(ステップS1527)、上記の実施例で説明した処理(図9参照)と同様に処理が流れる。
If all the main IDs have been acquired as a result of the confirmation (Yes at step S1505, see FIG. 15B), the user terminal 300 sends a sub ID transmission request to the sub ID management device 200. (Step S1527), the process flows in the same manner as the process described in the above embodiment (see FIG. 9).
一方、確認の結果、全ての主IDの取得が完了していない場合には(ステップS1505否定)、次の主ID管理装置100の主ID、主ID用パスワードおよび主ID管理装置IDの入力をユーザから受け付けて取得した後(ステップS1506)、主ID管理装置100の公開鍵を取得し(ステップS1507)、この公開鍵を用いて主IDを暗号化して暗号主IDを作成し(ステップS1508)、上記の実施例で説明した処理(図9参照)と同様に処理が流れる。
On the other hand, if acquisition of all the main IDs is not completed as a result of the confirmation (No at step S1505), input of the main ID, main ID password, and main ID management device ID of the next main ID management device 100 is performed. After receiving and acquiring from the user (step S1506), the public key of the main ID management apparatus 100 is acquired (step S1507), and the main ID is encrypted using this public key to create an encrypted main ID (step S1508). The process flows in the same manner as the process described in the above embodiment (see FIG. 9).
以下の実施例4では、図16を用いて、上記の実施例で説明してきたように、主IDおよび副IDが各装置で管理された後、ユーザが実際にサービスを利用する場合のID管理システムの処理の概要について説明する。図16は、実施例4に係るID管理システムの概要を示す図である。
In the following embodiment 4, as described in the above embodiment with reference to FIG. 16, after the main ID and the sub ID are managed in each device, the ID management when the user actually uses the service is performed. An overview of system processing will be described. FIG. 16 is a diagram illustrating an overview of an ID management system according to the fourth embodiment.
同図に示すように、実施例4に係るID管理システムは、ユーザ端末X、ユーザ端末Y、実人物管理装置A(上記の実施例で説明した主ID管理装置に相当する)、仮想人物管理装置(上記の実施例で説明した副ID管理装置に相当する)、実人物管理装置B(上記の実施例で説明した主ID管理装置に相当する)および複数のサービス提供装置(職探しサイト、SNS(Social Networking Service)、ショッピングサイト)を備えて構成される。
As shown in the figure, the ID management system according to the fourth embodiment includes a user terminal X, a user terminal Y, a real person management apparatus A (corresponding to the main ID management apparatus described in the above embodiment), virtual person management. A device (corresponding to the sub ID management device described in the above embodiment), a real person management device B (corresponding to the main ID management device described in the above embodiment), and a plurality of service providing devices (job search site, SNS (Social Networking Service), shopping site).
ユーザ端末Xは、実人物管理装置A、仮想人物管理装置および各サービス提供装置と通信可能な状態で接続され、ユーザ端末Yは、実人物管理装置B、仮想人物管理装置および各サービス提供装置と通信可能な状態で接続される。
The user terminal X is connected in a communicable state with the real person management apparatus A, the virtual person management apparatus, and each service providing apparatus, and the user terminal Y is connected to the real person management apparatus B, the virtual person management apparatus, and each service providing apparatus. Connected in a communicable state.
ユーザ端末XのユーザXは、実人物管理装置Aから実人物ID(主IDに相当)「XX」を取得するとともに、仮想人物管理装置からサービス利用時の仮想人格である仮想人物ID(副IDに相当)「x11」を取得する。ユーザ端末YのユーザYは、実人物管理装置Bから実人物ID「YY」を取得するとともに、仮想人物管理装置から仮想人物ID「y22」を取得する。
The user X of the user terminal X obtains the real person ID (corresponding to the main ID) “XX” from the real person management apparatus A, and the virtual person ID (sub ID) that is a virtual personality when using the service from the virtual person management apparatus. Equivalent to) “x11” is acquired. The user Y of the user terminal Y acquires the real person ID “YY” from the real person management apparatus B and also acquires the virtual person ID “y22” from the virtual person management apparatus.
実人物管理装置Aは、ユーザXの個人情報、ユーザXに発行した実人物ID「XX」、および、この実人物ID「XX」と仮想人物管理装置で管理される仮想人物IDとを紐付けるための割当管理ID「10kx」を対応付けて管理する。実人物管理装置Bは、ユーザYの個人情報、ユーザYに発行した実人物ID「YY」、およびこの実人物ID「YY」と仮想人物管理装置で管理される仮想人物IDとを紐付けるための割当管理ID「yh2k」とを対応付けて管理する。
The real person management apparatus A associates the personal information of the user X, the real person ID “XX” issued to the user X, and the real person ID “XX” and the virtual person ID managed by the virtual person management apparatus. The allocation management ID “10kx” is managed in association with each other. The real person management apparatus B associates the personal information of the user Y, the real person ID “YY” issued to the user Y, and the real person ID “YY” with the virtual person ID managed by the virtual person management apparatus. Are associated with the management ID “yh2k”.
仮想人物管理装置は、ユーザXに発行した仮想人物ID「x11」、この仮想人物ID「x11」と実人物管理装置Aで管理される実人物IDとを紐付けるための割当管理ID「10kx」、および仮想人物ID「x11」に紐づく実人物IDを管理する実人物管理装置Aを特定するための実人物管理装置IDを対応付けて管理するとともに、ユーザYに発行した仮想人物ID「y22」、この仮想人物ID「y22」と実人物管理装置Bで管理される実人物IDとを紐付けるための割当管理ID「yh2k」、および仮想人物ID「y22」に紐づく実人物IDを管理する実人物管理装置Bを特定するための実人物管理装置IDを対応付けて管理する。
The virtual person management apparatus issues a virtual person ID “x11” issued to the user X, and an assignment management ID “10 kx” for associating the virtual person ID “x11” with the real person ID managed by the real person management apparatus A. , And the real person management apparatus ID for specifying the real person management apparatus A that manages the real person ID associated with the virtual person ID “x11” is managed in association with the virtual person ID “y22” issued to the user Y. ”, The allocation management ID“ yh2k ”for associating the virtual person ID“ y22 ”with the real person ID managed by the real person management apparatus B, and the real person ID associated with the virtual person ID“ y22 ”. The real person management apparatus ID for identifying the real person management apparatus B to be managed is associated and managed.
そして、ユーザXおよびユーザYは、仮想人物管理装置から取得した仮想人物ID「x11」および仮想人物ID「y22」を利用して、各サービス提供装置にアクセスして活動する。また、ユーザXおよびユーザYは、仮想人物IDを利用することで、個人情報を開示することなくサービス提供装置で活動することができる。
Then, the user X and the user Y use the virtual person ID “x11” and the virtual person ID “y22” acquired from the virtual person management apparatus to access and operate each service providing apparatus. In addition, the user X and the user Y can use the virtual person ID to act on the service providing apparatus without disclosing personal information.
以下に、サービス提供装置によるサービス利用時の処理の一例として、ユーザXおよびユーザYの各々が、仮想人物IDを利用してサービス提供装置(SNS)にアクセスし、仮想人物ID「x11」および仮想人物ID「y22」として出会い、ユーザYである仮想人物ID「y22」が、ユーザXである仮想人物ID「x11」に対してメールを送信する場合の処理の概要を説明する。
In the following, as an example of processing at the time of service use by the service providing apparatus, each of the user X and the user Y accesses the service providing apparatus (SNS) using the virtual person ID, and the virtual person ID “x11” and the virtual person An outline of processing when the virtual person ID “y22” who is the user Y meets the person ID “y22” and transmits the mail to the virtual person ID “x11” which is the user X will be described.
ユーザYは、仮想人物ID「y22」を発信者とし、仮想人物ID「x11」を宛先とするメールの送信を依頼するため、このメールおよびメール送信依頼を仮想人物管理装置に送信する。
User Y transmits the mail and the mail transmission request to the virtual person management apparatus in order to request the transmission of the mail having the virtual person ID “y22” as the sender and the virtual person ID “x11” as the destination.
仮想人物管理装置は、ユーザ端末Yからメール送信依頼を受信すると、管理している情報の中から、メールの宛先である仮想人物ID「x11」に紐づく実人物IDを管理する実人物管理装置Aを特定するための実人物管理装置IDと、仮想人物ID「x11」と実人物管理装置Aで管理される実人物IDとを紐付けるための割当管理ID「10kx」とを取得して、この実人物管理装置IDに対応する実人物管理装置Aに対して、割当管理ID「10kx」に対応するユーザにユーザYから受信したメールを送信するように依頼する。
When receiving the mail transmission request from the user terminal Y, the virtual person management apparatus manages the real person ID associated with the virtual person ID “x11” that is the destination of the mail from the managed information. A real person management device ID for identifying A, a virtual person ID “x11”, and an assignment management ID “10 kx” for associating the real person ID managed by the real person management device A are acquired, The real person management apparatus A corresponding to the real person management apparatus ID is requested to send the mail received from the user Y to the user corresponding to the assignment management ID “10 kx”.
実人物管理装置Aは、仮想人物管理装置からメール送信依頼を受信すると、管理している情報の中から、メールの宛先である割当管理ID「10kx」に対応したユーザXのメールアドレスを取得し、このメールアドレス宛にメールを転送する。このようにして、サービス提供装置(SNS)上で出会った仮想人物ID「x11」と仮想人物ID「y22」との間で、個人情報を秘匿しつつメールのやり取りができる。
When the real person management apparatus A receives the mail transmission request from the virtual person management apparatus, the real person management apparatus A acquires the mail address of the user X corresponding to the assignment management ID “10 kx” that is the destination of the mail from the managed information. , Forward the mail to this mail address. In this way, mail can be exchanged between the virtual person ID “x11” and the virtual person ID “y22” that are met on the service providing device (SNS) while keeping private information confidential.
また、サービス提供装置によるサービス利用時の処理の別の一例として、サービス提供装置(ショッピングサイト)において、仮想人物ID「x11」と仮想人物「y22」との間で物品の売買取引を行い、「y22」から「x11」に対して代金を送付する場合の処理の概要について説明する。
Further, as another example of processing at the time of service use by the service providing apparatus, the service providing apparatus (shopping site) performs an article sales transaction between the virtual person ID “x11” and the virtual person “y22”. An outline of the processing when sending the price from “y22” to “x11” will be described.
この場合、ユーザYは、「y22」を送金元として、「x11」を送金先とする代金の送金を依頼するため、代金および送金依頼を仮想人物管理装置に送信する。
In this case, the user Y transmits the price and the remittance request to the virtual person management apparatus in order to request the remittance of the price with “y22” as the remittance source and “x11” as the remittance destination.
仮想人物管理装置は、上記したメール転送例と同様に、管理している情報の中から、送金先「x11」に対応する実人物管理装置Aの実人物管理装置IDおよび割当管理ID「10kx」を取得し、実人物管理装置Aに対して、割当管理ID「10kx」に対応するユーザにユーザYからの代金を送金するように依頼する。
The virtual person management apparatus, like the above-described mail transfer example, from the managed information, the real person management apparatus A and the allocation management ID “10 kx” of the real person management apparatus A corresponding to the remittance destination “x11”. And requests the real person management apparatus A to remit money from the user Y to the user corresponding to the allocation management ID “10 kx”.
実人物管理装置Aは、上記したメール転送例と同様に、管理している情報の中から、送金先である割当管理ID「10kx」に対応したユーザXの口座番号を取得し、この口座番号宛に代金を送金する。
The real person management apparatus A acquires the account number of the user X corresponding to the allocation management ID “10 kx” as the remittance destination from the information managed as in the mail transfer example described above, and this account number Send money to.
上述してきたように、実人物IDと仮想人物IDとを割当管理IDで紐付けて、実人物IDおよび個人情報と、仮想人物IDとを分散して管理し、サービス利用時に必要な情報のやり取りを行う機能を維持しつつ、実人物管理装置および仮想人物管理装置で管理される情報の一方が漏洩しても、仮想人物と実人物の対応関係が外部に暴露されることを防止することができるので、仮想人物IDを用いてサービスを利用するユーザの個人情報が特定されて外部に漏洩されることを防止することが可能である。
As described above, the real person ID and the virtual person ID are linked by the allocation management ID, and the real person ID, the personal information, and the virtual person ID are managed in a distributed manner, and exchange of information necessary when using the service While maintaining the function to perform the management, even if one of the information managed by the real person management apparatus and the virtual person management apparatus leaks, the correspondence relationship between the virtual person and the real person can be prevented from being exposed to the outside. Therefore, it is possible to prevent the personal information of the user who uses the service from being identified using the virtual person ID and leaked to the outside.
さて、これまで本発明を実施するための一実施形態として種々の実施例を説明してきたが、本発明は上述した実施例以外にも、種々の異なる形態にて実施されてよいものである。そこで、以下では、本発明を実施するための実施形態として他の実施例を説明する。
Now, various examples have been described as one embodiment for carrying out the present invention, but the present invention may be implemented in various different forms other than the above-described examples. Therefore, in the following, another example will be described as an embodiment for carrying out the present invention.
(1)装置構成等
例えば、図3に示した主ID管理装置100、および図5に示した副ID管理装置の各構成要素は機能概念的なものであり、必ずしも物理的に図示の如く構成されていることを要しない。すなわち、主ID管理装置100および副ID管理置200の分散・統合の具体的形態は図示のものに限られず、図3に示す主ID管理装置100のデータ送受信部121と、所有者確認部122と、データ登録部123とを統合し、図5に示す副ID管理装置200のデータ送受信部221と、副ID生成部222と、本人確認データ生成部223と、割当管理ID生成部224とを統合するなど、その全部または一部を、各種の負荷や使用状況などに応じて、任意の単位で機能的または物理的に分散・統合して構成することができる。 (1) Device Configuration etc. For example, each component of the mainID management device 100 shown in FIG. 3 and the sub ID management device shown in FIG. 5 is functionally conceptual, and is not necessarily physically configured as shown. You don't need to be. That is, the specific form of distribution / integration of the main ID management device 100 and the sub ID management device 200 is not limited to the illustrated one, and the data transmission / reception unit 121 and the owner confirmation unit 122 of the main ID management device 100 shown in FIG. And the data registration unit 123, and the data transmission / reception unit 221, the sub ID generation unit 222, the personal identification data generation unit 223, and the allocation management ID generation unit 224 of the sub ID management device 200 shown in FIG. For example, all or a part of them may be integrated and functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions.
例えば、図3に示した主ID管理装置100、および図5に示した副ID管理装置の各構成要素は機能概念的なものであり、必ずしも物理的に図示の如く構成されていることを要しない。すなわち、主ID管理装置100および副ID管理置200の分散・統合の具体的形態は図示のものに限られず、図3に示す主ID管理装置100のデータ送受信部121と、所有者確認部122と、データ登録部123とを統合し、図5に示す副ID管理装置200のデータ送受信部221と、副ID生成部222と、本人確認データ生成部223と、割当管理ID生成部224とを統合するなど、その全部または一部を、各種の負荷や使用状況などに応じて、任意の単位で機能的または物理的に分散・統合して構成することができる。 (1) Device Configuration etc. For example, each component of the main
さらに、主ID管理装置100および副ID管理装置200にて行なわれる各処理機能(図6、図8および図9、図13~図15)は、その全部または任意の一部が、CPUおよび当該CPUにて解析実行されるプログラムにて実現され得る。
Furthermore, each processing function (FIGS. 6, 8, and 13, 13 to 15) performed in the main ID management device 100 and the sub ID management device 200 is entirely or arbitrarily part of the CPU and the It can be realized by a program that is analyzed and executed by the CPU.
なお、主ID管理装置100および副ID管理装置200として機能するコンピュータは、所定の記録媒体に記録されたプログラムを読み出して実行することで上記した実施例と同様の各処理機能(図6、図8および図9、図13~図15)を実現する。ここで、所定の記録媒体とは、フレキシブルディスク(FD)、CD-ROM、MOディスク、DVDディスク、光磁気ディスク、ICカードなどの「可搬用の物理媒体」の他に、主ID管理装置100および副ID管理装置200として機能するコンピュータの内外に備えられるハードディスクドライブ(HDD)や、RAM、ROMなどの「固定用の物理媒体」、さらに、モデムを介して接続される公衆回線や、他のコンピュータシステム並びにサーバが接続されるLAN/WANなどのように、プログラムの送信に際して短期にプログラムを保持する「通信媒体」など、主ID管理装置100および副ID管理装置200として機能するコンピュータによって読み取り可能なプログラムを記録する、あらゆる記録媒体を含むものである。
The computer functioning as the primary ID management device 100 and the secondary ID management device 200 reads out and executes a program recorded in a predetermined recording medium, thereby executing each processing function similar to the above-described embodiment (FIGS. 6 and 6). 8 and FIG. 9 and FIGS. 13 to 15). Here, the predetermined recording medium includes the main ID management apparatus 100 in addition to “portable physical medium” such as a flexible disk (FD), a CD-ROM, an MO disk, a DVD disk, a magneto-optical disk, and an IC card. And a hard disk drive (HDD) provided inside and outside the computer functioning as the sub-ID management device 200, a “fixed physical medium” such as RAM and ROM, a public line connected via a modem, and the like It can be read by a computer functioning as the primary ID management device 100 and the secondary ID management device 200 such as a “communication medium” that holds the program in a short time when transmitting the program, such as a LAN / WAN to which a computer system and server are connected. Including all types of recording media for recording various programs
すなわち、この他の実施例でいうプログラムは、上記した「可搬用の物理媒体」、「固定用の物理媒体」、「通信媒体」などの記録媒体に、コンピュータ読み取り可能に記録されるものであり、主ID管理装置100および副ID管理装置200として機能するコンピュータは、このような記録媒体からプログラムを読み出して実行することで上記した実施例と同様の各処理機能(図6、図8および図9、図13~図15)を実現する。なお、この他の実施例でいうプログラムは、主ID管理装置100および副ID管理装置200として機能するコンピュータによって実行されることに限定されるものではなく、他のコンピュータシステムまたはサーバがプログラムを実行する場合や、これらが協働してプログラムを実行するような場合にも、本発明を同様に適用することができる。
That is, the program referred to in the other embodiments is recorded on a recording medium such as the above-mentioned “portable physical medium”, “fixed physical medium”, and “communication medium” in a computer-readable manner. The computer functioning as the primary ID management device 100 and the secondary ID management device 200 reads out the program from such a recording medium and executes it to execute each processing function similar to the above-described embodiment (FIGS. 6, 8, and FIG. 9 and FIGS. 13 to 15). Note that the program in this other embodiment is not limited to being executed by a computer functioning as the primary ID management device 100 and the secondary ID management device 200, but is executed by another computer system or server. The present invention can be similarly applied to the case where the programs are executed in cooperation with each other.
(2)ID管理方法
また、上記の実施例において説明したID管理システムにより、以下のようなID管理方法が実現される。 (2) ID management method Moreover, the following ID management method is implement | achieved by the ID management system demonstrated in said Example.
また、上記の実施例において説明したID管理システムにより、以下のようなID管理方法が実現される。 (2) ID management method Moreover, the following ID management method is implement | achieved by the ID management system demonstrated in said Example.
例えば、副ID管理装置200は、ユーザが利用するユーザ端末からの副ID発行依頼を受信した場合に、副IDを生成する副ID生成ステップと、主IDによるログインを要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であるか否かについて、前記副ID生成ステップにより生成された副IDに対応付ける対象の主IDを管理する主ID管理装置と連携して確認する同一人物確認ステップと、前記ログイン要求を要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であることが前記同一人物確認ステップにより確認された場合には、前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDとの対応関係を示す割当管理IDを生成する割当管理ID生成ステップと、前記割当管理ID生成ステップにより生成された割当管理IDを、前記副IDに対応付ける対象の主IDを管理する主ID管理装置に送信する割当管理ID送信ステップと、前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、前記割当管理ID生成ステップにより生成された割当管理IDとを対応付けて記録する副ID割当管理情報記録ステップと、前記副ID割当管理情報記録ステップによる記録が完了した場合には、前記副ID発行依頼の送信元であるユーザ端末に対して、前記副ID生成ステップにより生成された副IDを送信する副ID送信ステップと、をさらに含み、前記主ID管理装置は、前記副ID管理装置から割当管理IDを受信する割当管理ID受信ステップと、前記割当管理ID受信ステップにより受信された割当管理IDと、当該割当管理IDの送信元である副ID管理装置を特定するための副ID管理装置IDと、ログインを要求した主IDとを対応付けて記録するする主ID割当管理情報記録ステップと、を含んだID管理方法を実現する。
For example, the secondary ID management device 200 receives a secondary ID issue request from a user terminal used by the user, a secondary ID generation step for generating a secondary ID, and a user of the user terminal that requests login by the primary ID, The main ID management device that manages the main ID to be associated with the sub ID generated by the sub ID generation step as to whether or not the user of the user terminal that is the transmission source of the sub ID issuance request is the same person The same person confirmation step that confirms in cooperation with the user, the user of the user terminal that requests the login request, and the user of the user terminal that is the transmission source of the sub ID issue request are the same person When confirmed by the step, the pair of the sub ID generated by the sub ID generation step and the main ID to be associated with the sub ID An allocation management ID generation step for generating an allocation management ID indicating a relationship, and the allocation management ID generated by the allocation management ID generation step are transmitted to a main ID management device that manages a main ID to be associated with the sub ID. An assignment management ID transmission step; a sub ID generated by the sub ID generation step; a main ID management device ID for specifying a main ID management device that manages a main ID to be associated with the sub ID; When the sub ID allocation management information recording step for recording the allocation management ID generated in association with the management ID generation step in association with the sub ID allocation management information recording step is completed, A sub ID transmission step of transmitting the sub ID generated by the sub ID generation step to the user terminal as the transmission source; The main ID management device further includes an allocation management ID receiving step for receiving an allocation management ID from the sub ID management device, an allocation management ID received by the allocation management ID receiving step, and transmission of the allocation management ID An ID management method including a main ID assignment management information recording step of recording a sub ID management device ID for specifying the original sub ID management device in association with a main ID that has requested login is realized. To do.
なお、上記の実施例において、主ID管理装置100の管理者と副ID管理装置200の管理者との間で、ユーザからの要求に応じた割当管理IDのやり取りを郵送等で行い、主ID管理装置100に主IDや割当管理IDと、個人情報等を対応付けてあらかじめ登録し、副ID管理装置200に副IDおよび割当管理IDを対応付けてあらかじめ登録管理し、静的な情報として保有した後、サービス提供装置に対するサービス要求に伴った処理を主ID管理装置100および副ID管理装置200に実行させるようにしてもよい。
In the above embodiment, the manager of the main ID management device 100 and the manager of the sub-ID management device 200 exchange allocation management IDs according to a request from the user by mail or the like. The management apparatus 100 pre-registers the main ID, the allocation management ID, and personal information in association with each other, the sub-ID management apparatus 200 associates the sub-ID and the allocation management ID in advance with registration management, and has static information. After that, the primary ID management device 100 and the secondary ID management device 200 may be caused to execute processing accompanying a service request to the service providing device.
以上のように、本発明に係るID管理システムおよびID管理方法は、ユーザからの要求に応じて発行した主IDおよび副IDを管理することに有用であり、特に、用途が異なる異種ID間の対応関係が暴露されてしまうことを防止することに適する。
As described above, the ID management system and the ID management method according to the present invention are useful for managing the primary ID and the secondary ID issued in response to a request from the user, and in particular, between different types of IDs having different uses. It is suitable for preventing the correspondence relationship from being exposed.
Claims (6)
- ユーザが利用するユーザ端末と、第1の用途のためにユーザを識別するための主IDを管理する主ID管理装置と、第2の用途のためにユーザを識別するための副IDを管理する副ID管理装置とを含んで構成されるID管理システムであって、
前記主ID管理装置は、主IDと、前記副ID管理装置を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDとを対応付けて管理する主ID管理手段を備え、
前記副ID管理装置は、副IDと、前記主ID管理装置を特定するための主ID管理装置IDと、割当管理IDとを対応付けて管理する副ID管理手段を備えたことを特徴とするID管理システム。 A user terminal used by a user, a main ID management device that manages a main ID for identifying the user for the first use, and a sub ID for identifying the user for the second use An ID management system including a sub-ID management device,
The main ID management device associates a main ID, a sub ID management device ID for specifying the sub ID management device, and an allocation management ID for specifying a correspondence relationship between the sub ID and the main ID. A main ID management means for managing,
The secondary ID management device includes secondary ID management means for managing a secondary ID, a primary ID management device ID for specifying the primary ID management device, and an allocation management ID in association with each other. ID management system. - 前記副ID管理手段は、副IDに対応付けて、前記主ID管理装置ごとに異なる主ID管理装置IDおよび割当管理IDをそれぞれ管理することを特徴とする請求項1に記載のID管理システム。 The ID management system according to claim 1, wherein the secondary ID management means manages a primary ID management device ID and an allocation management ID that are different for each primary ID management device in association with the secondary ID.
- 前記副ID管理装置は、
前記ユーザ端末からの副ID発行依頼を受信した場合に、副IDを生成する副ID生成手段と、
主IDによるログインを要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であるか否かについて、前記副ID生成手段により生成された副IDに対応付ける対象の主IDを管理する主ID管理装置と連携して確認する同一人物確認手段と、
前記ログイン要求を要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であることが前記同一人物確認手段により確認された場合には、前記副ID生成手段により生成された副IDと、当該副IDに対応付ける対象の主IDとの対応関係を示す割当管理IDを生成する割当管理ID生成手段と、
前記割当管理ID生成手段により生成された割当管理IDを、前記副IDに対応付ける対象の主IDを管理する主ID管理装置に送信する割当管理ID送信手段と、
前記副ID生成手段により生成された副IDと、当該副IDに対応付ける対象の主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、前記割当管理ID生成手段により生成された割当管理IDとを対応付けて記録する副ID割当管理情報記録手段と、
前記副ID割当管理情報記録手段による記録が完了した場合には、前記副ID発行依頼の送信元であるユーザ端末に対して、前記副ID生成手段により生成された副IDを送信する副ID送信手段と、
をさらに備え、
前記主ID管理装置は、
前記副ID管理装置から割当管理IDを受信する割当管理ID受信手段と、
前記割当管理ID受信手段により受信された割当管理IDと、当該割当管理IDの送信元である副ID管理装置を特定するための副ID管理装置IDと、ログインを要求した主IDとを対応付けて記録するする主ID割当管理情報記録手段をさらに備えたことを特徴とする請求項1に記載のID管理システム。 The secondary ID management device
A sub ID generating means for generating a sub ID when a sub ID issuance request is received from the user terminal;
The sub-ID generated by the sub-ID generation means determines whether or not the user of the user terminal that requests login by the main ID and the user of the user terminal that is the transmission source of the sub-ID issue request are the same person. The same person confirmation means for confirming in cooperation with a main ID management device that manages a main ID to be associated;
When the same person confirmation means confirms that the user of the user terminal requesting the login request and the user of the user terminal that is the transmission source of the sub ID issue request are the sub ID, An allocation management ID generating unit that generates an allocation management ID indicating a correspondence relationship between the sub ID generated by the generating unit and the main ID to be associated with the sub ID;
An allocation management ID transmission unit that transmits the allocation management ID generated by the allocation management ID generation unit to a main ID management device that manages a main ID to be associated with the sub-ID;
The sub ID generated by the sub ID generation means, the main ID management apparatus ID for specifying the main ID management apparatus that manages the main ID to be associated with the sub ID, and the allocation management ID generation means Sub ID allocation management information recording means for recording the allocation management ID in association with each other;
Sub-ID transmission for transmitting the sub-ID generated by the sub-ID generation unit to the user terminal that is the transmission source of the sub-ID issue request when the recording by the sub-ID allocation management information recording unit is completed Means,
Further comprising
The main ID management device
An allocation management ID receiving means for receiving an allocation management ID from the secondary ID management device;
The allocation management ID received by the allocation management ID receiving means, the secondary ID management device ID for identifying the secondary ID management device that is the transmission source of the allocation management ID, and the main ID that requested the login are associated with each other 2. The ID management system according to claim 1, further comprising main ID allocation management information recording means for recording. - 第1の用途のためにユーザを識別するための主IDを発行して管理するとともに、第2の用途のためにユーザを識別するための副IDを発行して管理するID管理方法であって、
主IDを管理する主ID管理装置は、主IDと、副IDを管理する副ID管理装置を特定するための副ID管理装置IDと、副IDと主IDとの対応関係を特定するための割当管理IDとを対応付けて主ID管理装置に管理させる主ID管理ステップを含み、
副IDを管理する副ID管理装置は、副IDと、主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、割当管理IDとを対応付けて副ID管理装置に管理させる副ID管理ステップを含んだことを特徴とするID管理方法。 An ID management method for issuing and managing a primary ID for identifying a user for a first use, and issuing and managing a sub ID for identifying a user for a second use ,
The main ID management device that manages the main ID is for specifying the correspondence between the main ID, the sub ID management device ID for specifying the sub ID management device that manages the sub ID, and the sub ID and the main ID. Including a main ID management step for causing the main ID management device to manage the association with the allocation management ID,
The secondary ID management device that manages the secondary ID manages the secondary ID, the primary ID management device ID for specifying the primary ID management device that manages the primary ID, and the allocation management ID in association with each other and manages the secondary ID management device. An ID management method characterized by including a sub-ID management step. - 前記副ID管理ステップは、副IDに対応付けて、前記主ID管理装置ごとに異なる主ID管理装置IDおよび割当管理IDをそれぞれ管理することを特徴とする請求項4に記載のID管理方法。 5. The ID management method according to claim 4, wherein the sub ID management step manages a main ID management device ID and an allocation management ID that are different for each main ID management device in association with the sub ID.
- 前記副ID管理装置は、
ユーザが利用するユーザ端末からの副ID発行依頼を受信した場合に、副IDを生成する副ID生成ステップと、
主IDによるログインを要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であるか否かについて、前記副ID生成ステップにより生成された副IDに対応付ける対象の主IDを管理する主ID管理装置と連携して確認する同一人物確認ステップと、
前記ログイン要求を要求するユーザ端末のユーザと、前記副ID発行依頼を送信元であるユーザ端末のユーザとが同一人物であることが前記同一人物確認ステップにより確認された場合には、前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDとの対応関係を示す割当管理IDを生成する割当管理ID生成ステップと、
前記割当管理ID生成ステップにより生成された割当管理IDを、前記副IDに対応付ける対象の主IDを管理する主ID管理装置に送信する割当管理ID送信ステップと、
前記副ID生成ステップにより生成された副IDと、当該副IDに対応付ける対象の主IDを管理する主ID管理装置を特定するための主ID管理装置IDと、前記割当管理ID生成ステップにより生成された割当管理IDとを対応付けて記録する副ID割当管理情報記録ステップと、
前記副ID割当管理情報記録ステップによる記録が完了した場合には、前記副ID発行依頼の送信元であるユーザ端末に対して、前記副ID生成ステップにより生成された副IDを送信する副ID送信ステップと、
をさらに含み、
前記主ID管理装置は、
前記副ID管理装置から割当管理IDを受信する割当管理ID受信ステップと、
前記割当管理ID受信ステップにより受信された割当管理IDと、当該割当管理IDの送信元である副ID管理装置を特定するための副ID管理装置IDと、ログインを要求した主IDとを対応付けて記録するする主ID割当管理情報記録ステップと、
をさらに含んだことを特徴とする請求項4に記載のID管理方法。 The secondary ID management device
A sub ID generation step for generating a sub ID when a sub ID issuance request is received from a user terminal used by the user;
Whether the user of the user terminal that requests login by the main ID and the user of the user terminal that is the transmission source of the sub ID issue request are the same person, the sub ID generated by the sub ID generation step The same person confirmation step of confirming in cooperation with a main ID management device that manages a main ID to be associated;
When it is confirmed by the same person confirmation step that the user of the user terminal that requests the login request and the user of the user terminal that is the transmission source of the sub ID issue request are the same person ID, An allocation management ID generation step for generating an allocation management ID indicating a correspondence relationship between the sub-ID generated by the generation step and the main ID to be associated with the sub-ID;
An allocation management ID transmission step of transmitting the allocation management ID generated by the allocation management ID generation step to a main ID management device that manages a main ID to be associated with the sub-ID;
The sub ID generated by the sub ID generation step, the main ID management device ID for specifying the main ID management device that manages the main ID to be associated with the sub ID, and the allocation management ID generation step A sub ID assignment management information recording step for recording the assigned management ID in association with each other;
Sub-ID transmission for transmitting the sub-ID generated by the sub-ID generation step to the user terminal that is the transmission source of the sub-ID issue request when the recording by the sub-ID allocation management information recording step is completed Steps,
Further including
The main ID management device
An allocation management ID receiving step of receiving an allocation management ID from the secondary ID management device;
The allocation management ID received in the allocation management ID receiving step is associated with the secondary ID management device ID for specifying the secondary ID management device that is the transmission source of the allocation management ID, and the main ID that requested the login. Main ID assignment management information recording step for recording,
The ID management method according to claim 4, further comprising:
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2008/054321 WO2009113154A1 (en) | 2008-03-10 | 2008-03-10 | Id managing system and id managing method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2008/054321 WO2009113154A1 (en) | 2008-03-10 | 2008-03-10 | Id managing system and id managing method |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2009113154A1 true WO2009113154A1 (en) | 2009-09-17 |
Family
ID=41064835
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2008/054321 WO2009113154A1 (en) | 2008-03-10 | 2008-03-10 | Id managing system and id managing method |
Country Status (1)
Country | Link |
---|---|
WO (1) | WO2009113154A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2011070726A1 (en) * | 2009-12-07 | 2011-06-16 | 日本電気株式会社 | Attribute information cooperative providing system, access information management device, access information substitutional management device, method, and program |
JP2015510163A (en) * | 2012-01-08 | 2015-04-02 | インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Machines Corporation | Method, system and computer program for accessing confidential information via social networking web services |
WO2015186659A1 (en) * | 2014-06-03 | 2015-12-10 | フィールズ株式会社 | Sns provision program, sns provision server, and sns provision system |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2000324094A (en) * | 1999-02-02 | 2000-11-24 | Smithkline Beecham Corp | Device and method for making information unindividualized |
JP2005050330A (en) * | 2003-07-16 | 2005-02-24 | Nippon Telegr & Teleph Corp <Ntt> | Method and system for providing service |
JP2007148903A (en) * | 2005-11-29 | 2007-06-14 | Toshiba Corp | Attribute certificate processing system, attribute certification request device, attribute certificate issuing device, attribute verification device, attribute certification request method, attribute certificate issuing method, attribute verification method and program |
-
2008
- 2008-03-10 WO PCT/JP2008/054321 patent/WO2009113154A1/en active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2000324094A (en) * | 1999-02-02 | 2000-11-24 | Smithkline Beecham Corp | Device and method for making information unindividualized |
JP2005050330A (en) * | 2003-07-16 | 2005-02-24 | Nippon Telegr & Teleph Corp <Ntt> | Method and system for providing service |
JP2007148903A (en) * | 2005-11-29 | 2007-06-14 | Toshiba Corp | Attribute certificate processing system, attribute certification request device, attribute certificate issuing device, attribute verification device, attribute certification request method, attribute certificate issuing method, attribute verification method and program |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2011070726A1 (en) * | 2009-12-07 | 2011-06-16 | 日本電気株式会社 | Attribute information cooperative providing system, access information management device, access information substitutional management device, method, and program |
JP5678893B2 (en) * | 2009-12-07 | 2015-03-04 | 日本電気株式会社 | Attribute information linkage providing system, access information management device, access information proxy management device, method, and program |
JP2015510163A (en) * | 2012-01-08 | 2015-04-02 | インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Machines Corporation | Method, system and computer program for accessing confidential information via social networking web services |
US9419967B2 (en) | 2012-01-08 | 2016-08-16 | International Business Machines Corporation | Confidential information access via social networking web site |
WO2015186659A1 (en) * | 2014-06-03 | 2015-12-10 | フィールズ株式会社 | Sns provision program, sns provision server, and sns provision system |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11374754B2 (en) | System and method for generating trust tokens | |
CN101490689B (en) | Content control system and method using certificate chains | |
US8996423B2 (en) | Authentication for a commercial transaction using a mobile module | |
US7539861B2 (en) | Creating and storing one or more digital certificates assigned to subscriber for efficient access using a chip card | |
RU2501081C2 (en) | Multi-factor content protection | |
CN113632125A (en) | Securely sharing personal data stored in a blockchain using a contactless card | |
US20090031426A1 (en) | Method and System for Protected Distribution of Digitalized Sensitive Information | |
US20060080526A1 (en) | Login system and method | |
JP4326443B2 (en) | Information processing apparatus, information processing method, and program | |
TW486902B (en) | Method capable of preventing electronic documents from being illegally copied and its system | |
KR100411448B1 (en) | public-key infrastructure based digital certificate methods of issuing and system thereof | |
KR20050008626A (en) | Information processing device and method, information processing system, recording medium, and program | |
EP1872188A2 (en) | Network commercial transactions | |
JP2006523995A (en) | Privacy of user identity in authorization certificate | |
CN101390134A (en) | Method for redistributing DRM protected content | |
JP2018534818A (en) | System and method for secure digital sharing based on exchange between systems of two-layer double encrypted digital information keys | |
KR102131206B1 (en) | Method, service server and authentication server for providing corporate-related services, supporting the same | |
EP3185465A1 (en) | A method for encrypting data and a method for decrypting data | |
JP2005149341A (en) | Authentication method and apparatus, service providing method and apparatus, information input apparatus, management apparatus, authentication guarantee apparatus, and program | |
WO2009113154A1 (en) | Id managing system and id managing method | |
JP2010128554A (en) | Account issuing system, allocation device, registration device, account issuing method and program | |
WO2011058629A1 (en) | Information management system | |
JP7156888B2 (en) | Payment processing method | |
JP6874700B2 (en) | E-commerce systems, communication terminals, third-party servers, e-commerce methods, and programs | |
TW202129519A (en) | Personal data protection application system and personal data protection application method capable of avoiding malicious disclosure of private information by the administrator |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 08721737 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 08721737 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: JP |