WO2022249439A1

WO2022249439A1 - Information processing system, information processing device, information processing program, and information processing method

Info

Publication number: WO2022249439A1
Application number: PCT/JP2021/020363
Authority: WO
Inventors: 文彦小櫻
Original assignee: 富士通株式会社
Priority date: 2021-05-28
Filing date: 2021-05-28
Publication date: 2022-12-01
Also published as: JPWO2022249439A1

Abstract

In a data storage system 9, when a plurality of sets of transaction data are received, an aggregate program service 2 verifies signatures respectively assigned to the plurality of sets of transaction data, and uses a first program to generate sum data for a transaction quantity corresponding to the transaction data, from among the plurality of sets of transaction data, that has yielded a verification result meeting a condition, as well as signature information for the sum data. A node 10 of an electricity retailer 1 uses a second program to generate proof information for a zero-knowledge proof, which proves that the signature information corresponds to a signature of the sum data, without indicating the plurality of sets of transaction data which indicate a breakdown of the sum data, on the basis of the generated sum data and signature information. The data storage system 9 stores the sum data and the proof information in a blockchain where a transaction history of transaction data is stored. This configuration reduces the data volume being handled on the blockchain.

Description

Information processing system, information processing device, information processing program, and information processing method

The present invention relates to an information processing system and the like.

In recent years, blockchain-based ledger management has been proposed, which enables non-centralized ledger management without a trusted third party. Blockchain is one of the distributed ledger technologies in which multiple nodes that make up the network maintain the same database. In a blockchain, a group of transactions on the network are collectively processed as blocks, and each block is linked by a hash function. Block data recorded in a blockchain cannot be retroactively changed without changing all subsequent blocks, and blockchain-based ledger management platforms are highly secure against alteration.

Blockchain is used in various fields because its transaction history is open and it is difficult to tamper with it. As an example of blockchain-based technology, an electricity trading system has been proposed that promotes the introduction and spread of renewable energy by encouraging the consumption of environmentally friendly electricity in a manner that contributes to the environment (patent Reference 1).

Japanese Patent Application Laid-Open No. 2020-107202

Because the blockchain manages the ledger in a distributed manner, storage costs are higher than databases that are centrally managed by a server. This problem becomes conspicuous when the amount of data to be handled increases. For example, in the transaction of resources such as electricity, the actual data of resource production and consumption are generated sequentially. Increase storage costs.

In one aspect, the present invention aims to reduce the amount of data handled by the blockchain.

In one aspect, when receiving a plurality of transaction data, the information processing system verifies a signature attached to each of the plurality of transaction data, and obtains a verification result that satisfies a criterion among the plurality of transaction data. a first generation unit for generating transaction volume sum data corresponding to the transaction data and signature information of the sum data by a first program; the sum data generated by the first generation unit and the proof information of zero-knowledge proof for proving, based on the signature information, that the signature information corresponds to the signature of the sum data without showing a plurality of transaction data indicating the details of the sum data; has a second generation unit that is generated by a different second program, and a storage unit that stores the sum data and the proof information in a block chain in which the transaction history of the transaction data is stored.

According to one embodiment, the amount of data handled by the blockchain can be reduced.

FIG. 1 is a diagram showing a reference example of a data storage method. FIG. 2 is a diagram showing another reference example of the data storage method. FIG. 3 is a diagram illustrating an example of a data storage method according to the embodiment; FIG. 4 is a diagram for explaining four types of schemes for reducing the risk of private key leakage. FIG. 5 is a diagram illustrating an example of a configuration of a data storage system according to an embodiment; FIG. 6 is a block diagram showing an example of functions of each device. FIG. 7 is a diagram showing an example of token management information. FIG. 8 is a diagram showing an example of public key information. FIG. 9 is a diagram illustrating an example of aggregate result information. FIG. 10 is a diagram illustrating an example of the sequence of data storage processing according to the embodiment. FIG. 11 is a diagram of an example of a computer that executes a data storage program.

Hereinafter, embodiments of the information processing system, the information processing apparatus, the information processing program, and the information processing method disclosed in the present application will be described in detail based on the drawings. In addition, this invention is not limited by an Example.

First, in order to reduce the amount of data handled by the blockchain, we will explain a reference example of how to store data in the blockchain. A case where the ledger of electricity transactions is managed by blockchain will be explained.

[Reference example of data storage method]
FIG. 1 is a diagram showing a reference example of a data storage method. As shown in FIG. 1, the data storage system 9A has a block chain 500 and a certificate creation program 100. FIG. The data storage system 9A aggregates input performance data using zero-knowledge proof, and stores the aggregated results in a blockchain. That is, the data storage system 9A uses zero-knowledge proof to assure that the process of calculating the sum aggregated from each performance data is correct, although the performance data to be input is not known. As the zero-knowledge proof, for example, non-interactive zero-knowledge proof is used.

The certificate creation program 100 is installed on a node outside the blockchain 500. The certificate creation program 100 inputs signed data as performance data. The certificate creation program 100 confirms the signature of the input signed data and performs preprocessing for certificate creation. Such preprocessing subdivides the signature verification logic in advance, verifies the signature, and generates information by extracting the elements necessary for creating the certificate. Then, using the generated information, the certificate creation program 100 executes a total data volume transaction including a total data volume commitment indicating the sum total of the data transacted and a zero-knowledge certificate certifying that the total data volume is correct. Generate a record. The certificate generation program 100 then transmits the generated total data volume transaction record to the blockchain 500 .

Blockchain 500 has smart contracts and stored data. Upon receiving the total data amount transaction record, the smart contract verifies whether or not the preset transaction constraints are satisfied based on, for example, the transaction details indicated in the transaction record. Then, the smart contract performs a process of storing the total data amount transaction record in the stored data when the constraint conditions of the transaction are satisfied.

As a result, although each performance data is not recorded in the blockchain 500, it is possible to prove that the total sum of the data obtained from the correct performance data is stored. As a result, in the data storage system 9A, the size-reduced total data amount transaction record is stored in the block chain 500, and the zero-knowledge proof technology can prove the validity of the transaction while keeping the actual data confidential. .

Here, in the data storage system 9A, when aggregating data using zero-knowledge proof, if the number of signature verifications is large, the pre-processing for creating a certificate will cost a lot of computer cost. Therefore, there is a problem that it is difficult to aggregate a large amount of data. Therefore, there is a need for a method that reduces the computer cost while maintaining reliability.

[Another example of data storage method]
FIG. 2 is a diagram showing another reference example of the data storage method. As shown in FIG. 2, the data storage system 9B has a block chain 500, an aggregate program 200, and a preprocessing 400. Aggregate program 200 is a trusted third party program. The preprocessing 400 generates a key pair by public key cryptography, stores the private key in the aggregate program 200 , and stores the public key in the block chain 500 . The aggregate program 200 verifies the signature of the input signed data and aggregates (sums) the data whose signature has been verified. Then, the aggregate program 200 attaches a signature to the aggregate result with its own private key and transmits it to the blockchain 500 .

The blockchain 500 can verify the correctness of the aggregate result using the public key. This makes it possible to prove that the total sum of data obtained from correct performance data is stored, although each performance data is not recorded in the block chain 500 . As a result, the data storage system 9B stores the size-reduced total data amount transaction record in the block chain 500, and uses public key encryption technology to lower the computer cost while keeping the performance data confidential and verifying the validity of the transaction. can be proved.

However, if the private key is leaked, the signature using public key cryptography can be forged, and the correctness of the data stored in the blockchain 500 cannot be guaranteed. Therefore, it is difficult to simply utilize public key cryptography. A countermeasure against leakage of a secret key requires complicated key management, and there is a problem of complicating the system. Therefore, there is a need for a method of reducing computer costs while eliminating the need for complicated key management.

[Example of data storage method]
FIG. 3 is a diagram illustrating an example of a data storage method according to the embodiment; As shown in FIG. 3, the data storage system 9 has a block chain 500, an aggregate program 200, a certificate generation program 100A, and a consortium server 300. Aggregate program 200 is a program issued by a trust point. The trust point here refers to the consortium server 300 .

In the data storage system 9, the certificate creation program 100 shown in FIG. 1 is divided into an aggregate program 200 issued by the trust point and a new certificate creation program 100A. The aggregate program 200 issued by the trust point receives signed data as performance data. Then, the aggregate program 200 confirms the signature of the input signed data, and aggregates (sums) the signature-verified data. Then, the aggregate program 200 creates a signature of the aggregate result.

The certificate creation program 100A receives the aggregate result and its signature, and creates a certificate for the aggregate result. For example, the certificate creation program 100A checks the signature of the input signed aggregate result and performs preprocessing for certificate creation. Such preprocessing subdivides the signature verification logic in advance, verifies the signature, and generates information by extracting the elements necessary for creating the certificate. Then, using the generated information, the certificate generation program 100A generates a total data amount transaction record including a total data amount commitment indicating the aggregate result and a zero-knowledge certificate proving that the sum of the data is correct. do. Then, the certificate generation program 100A transmits the generated total data amount transaction record to the blockchain 500. FIG.

The blockchain 500 is the same as the blockchain 500 shown in FIG. That is, blockchain 500 has smart contracts and stored data. Upon receiving the total data amount transaction record, the smart contract verifies whether or not the preset transaction constraints are satisfied based on, for example, the transaction details indicated in the transaction record. Then, the smart contract performs a process of storing the total data amount transaction record in the stored data when the constraint conditions of the transaction are satisfied.

As a result, in the data storage system 9, the number of signature verifications in the certificate generation program can be reduced, and preprocessing for certificate generation can be reduced. Moreover, although each performance data is not recorded in the block chain 500, it becomes possible to prove that the total sum of the data obtained from the correct performance data is stored. As a result, the data storage system 9 stores transaction records with a reduced total data amount in the block chain 500, making it possible to prove the legitimacy of the transaction while keeping the performance data secret by zero-knowledge proof technology. can be done.

Here, we will explain key management. The creation of the signature of the aggregate result in the aggregate program 200 and the verification of the signature of the aggregate result in the certificate creation program 100A use a key pair of public key cryptography. A key pair is created by the consortium server 300 . For example, the aggregate program 200 attaches a signature to the aggregate result with a private key created by the consortium server 300, and sends it to the certificate creation program 100A. The certificate creation program 100A confirms the correctness of the aggregate result using the public key created by the consortium server 300. FIG. Even if the secret key is leaked in the aggregate program 200, the block chain 500 that secures the stored data will not be directly affected. Also, the user of the key pair is the electricity retailer who purchased the performance data, so there is little risk of leakage. This eliminates the need for complicated key management.

However, since the risk of leakage of the private key is not completely eliminated, four types of methods for reducing the risk of leakage of the private key will be described in the embodiment with reference to FIG. FIG. 4 is a diagram for explaining four types of schemes for reducing the risk of private key leakage.

Method a shown in FIG. 4 is a method of preparing an aggregate program 200 having a different secret key for each aggregate (sum). The consortium server 300 generates a key pair for each aggregate (sum) and distributes the aggregate program 200 storing the private key (a1). The aggregate program 200 verifies the signature of the input signed data and aggregates (sums) the data whose signature has been verified. Then, the aggregate program 200 uses the held private key to create the signature x of the aggregate result. The aggregate program 200 then transmits the aggregate result h and its signature x to the certificate creation program 100A. The certificate creation program 100A confirms the input signature x of the signed aggregate result using the public key (a2). After confirming that the signature x of the aggregate result is correct, the certificate creation program 100A generates a zero-knowledge certificate proving that the sum of the data is correct, and combines the aggregate result h and the zero-knowledge certificate prf. Send to blockchain 500. As a result, the consortium server 300 distributes the aggregate program 200 having a different private key for each aggregate, thereby reducing the risk of leakage due to the reuse of private keys. Also, if the consortium server 300 sets a short expiration date for the private key, it is possible to reduce the risk of being abused when the private key is leaked.

Method b shown in FIG. 4 is a method for reducing the burden of distributing the aggregate program 200 having a different secret key for each aggregate (total sum). Instead of distributing the aggregate program 200 for each aggregate, is a method to issue The consortium server 300 issues a token for each aggregate instead of fixing the private key for a certain period according to the expiration date (b1). Then, the aggregate program 200 obtains not only the signature x for the aggregate result h, but also obtains a hash value using the token as a key and adds it to the signature x (b2). h and the signature x to which the hash value is added are sent to the certificate generation program 100A. The certificate creation program 100A confirms the input signature x of the signed aggregate result using the public key. Additionally, the certificate creation program 100A confirms the hash value added to the signature x using the token (b3). The certificate creation program 100A then creates a zero-knowledge certificate that proves that the sum of the data is correct. The certificate generation program 100A then transmits the aggregation result h and the zero-knowledge certificate prf to the blockchain 500. FIG. As a result, the consortium server 300 can reduce the risk of private key leakage at the same security level as distributing the aggregate program 200 having a different private key for each aggregate by issuing a token for each aggregate. .

Method c shown in FIG. 4 is a method for reducing the risk of allowing the aggregate program 200 issued by the trust point to hold the private key, and is a method in which the client confirms the aggregate result and signs it. be. The aggregate program 200 verifies the signature of the input signed data and aggregates (sums) the data whose signature has been verified. The client confirms the aggregate result and puts a signature on it to create a signature x of the aggregate result (c1). The aggregate program 200 then transmits the aggregate result h and its signature x to the certificate creation program 100A. In the certificate creation program 100A, the requester confirms the signature x of the entered signed aggregate result (c2). After confirming that the signature x is correct, the certificate creation program 100A generates a zero-knowledge certificate that proves that the sum of the data is correct, and sends the aggregate result h and the zero-knowledge certificate prf to the blockchain 500. Send. As a result, the certificate creation program 100A can verify the client's signature on the aggregate result, and by verifying the client's signature, the risk of private key leakage in the aggregate program 200 can be reduced.

Method d shown in FIG. 4 is a method in which each aggregate program 200 issued by a plurality of trust points is executed, a signature is attached by each aggregate program 200, and a plurality of signatures are collected to validate the aggregate result. . For example, a program that puts together a plurality of aggregate programs 200 confirms that the processing results of each aggregate program 200 are the same, and puts together a plurality of signatures (d1). The certificate creation program 100A confirms whether the combined multiple signatures x are correct (d2). After confirming that the multiple signatures x are correct, the certificate creation program 100A generates a zero-knowledge certificate that proves that the sum of the data is correct. The certificate generation program 100A then transmits the aggregation result h and the zero-knowledge certificate prf to the blockchain 500. FIG. As a result, even if some of the aggregate programs 200 are malicious, the certificate creation program 100A can verify the signatures of a plurality of aggregate programs 200, thereby eliminating malicious intent and reducing risks. .

In the following data storage system 9, a case will be described in which method a and method b are used in order to reduce the risk of private key leakage.

[Configuration of data storage system]
FIG. 5 is a diagram illustrating an example of a configuration of a data storage system according to an embodiment; As shown in FIG. 5 , the data storage system 9 has a node 10 of a retail electricity supplier 1 , an aggregate program service 2 , a consortium server 3 , a node 40 of a small power generator 4 and a blockchain system 5 . A node 10 of a retail electricity supplier 1 , an aggregate program service 2 , a consortium server 3 , a node 40 of a small power generator 4 and a blockchain system 5 are connected to a network 7 .

All of the multiple nodes 50 that make up the blockchain of the blockchain system 5 are connected to the network 7 . A plurality of nodes 50 are connected to each other for P2P communication. By operating a plurality of nodes 50 in cooperation, a ledger of electricity transactions is distributed and managed by a blockchain. Note that the blockchain system 5 corresponds to the blockchain 500 shown in FIG.

　Electricity trading is conducted, for example, between a retail electricity supplier 1 and a small-scale power generator 4. Strictly speaking, electric power trading is conducted not only between the retail electric power company 1 and the small power generator 4, but also between electric power consumers. shall be performed in

The small-scale power generator 4 is, for example, a general household power generator. The node 40 of the micro-generator 4 reads the measured power generated by renewable energy.

Aggregate program service 2 is a service that executes aggregation using an aggregate program. The aggregate program aggregates performance data of multiple amounts of electric power in response to a request from the electricity retailer 1 . Aggregate programs produce signed aggregate results. The signature uses public key cryptography. A private key used for signature is distributed by the consortium server 3, which will be described later. Note that the aggregate program corresponds to the aggregate program 200 shown in FIG.

The aggregate program service 2 here is, for example, a cloud service. By making the aggregate program service 2 a cloud service, it becomes difficult for the aggregate program executed by the aggregate program service 2 to be analyzed by reverse engineering or the like, and the secret key is not extracted, thereby reducing risks. can be done. Note that the aggregate program may be executed by the node 10 of the electricity retailer 1 instead of the aggregate program service 2 .

The electricity retailer 1 uses the node 10 to purchase, for example, power supply rights for electricity generated by renewable energy from the small-scale power generator 4 . If the amount of power generated under the small power generator 4 is dealt with individually, it becomes a large amount. Therefore, in the embodiment, the electricity retailer 1 uses the node 10 to calculate the amount of electricity generated in units of 30 minutes by the small-scale power generator 4 purchased by the virtual power plant. store the aggregate result aggregated in the block chain system 5. For example, electricity retailer 1 uses node 10 to verify the signed aggregate result with a public key. The electricity retailer 1 then uses the node 10 to generate a zero-knowledge certificate that proves that the aggregate result is correct. The electricity retailer 1 then uses the node 10 to store the zero-knowledge certificate and the aggregate result in the blockchain system 5 . The processing at the node 10 of the electricity retailer 1 corresponds to the certificate creation program 100A shown in FIG.

The consortium server 3 is a server operated by the consortium as a reliable third party. The consortium server 3 corresponds to the consortium server 300 shown in FIG. 3 and also to a trust point. The consortium server 3 generates a key pair of public key cryptography in response to a request from the electricity retailer 1 . The consortium server 3 then activates the aggregate program service 2 to operate the aggregate program holding the private key. Also, the consortium server 3 generates a token in response to a request from the aggregate program service 2 . When the aggregate program is executed by the node 10 of the electricity retailer 1 instead of the aggregate program service 2, the aggregate program holding the private key is distributed to the node 10 of the electricity retailer 1. do it.

[Functions of each device]
FIG. 6 is a block diagram showing an example of functions of each device. The consortium server 3 has a key generation unit 31 , a program activation unit 32 , a token generation unit 33 and token management information 34 . Note that the consortium server 3 is an example of a third party organization.

The key generation unit 31 generates a key pair of public key cryptography in response to an aggregate program service request from the electricity retailer 1 . A key pair is generated for each aggregate. The key generator 31 distributes the public key to the electricity retailer 1 that is the source of the request. Additionally, the key generator 31 stores the public key in the blockchain system 5 .

The program activation unit 32 activates the aggregate program service 2. For example, the program activation unit 32 activates the aggregate program service 2 in order to operate the aggregate program holding the private key generated by the key generation unit 31 .

The token generation unit 33 generates a token in response to a request for a token from the aggregate program service 2. The token generation unit 33 then issues the generated token to the aggregate program service 2 that is the source of the request. The token generation unit 33 then stores the token in the token management information 34. FIG. Then, when the electricity retailer identifier and the request identifier corresponding to the token issued by itself are stored in the blockchain system 5 , the token generation unit 33 stores the token in the blockchain system 5 .

The token management information 34 manages tokens generated for each aggregate. An example of the token management information 34 will now be described with reference to FIG. FIG. 7 is a diagram showing an example of token management information. As shown in FIG. 7, the token management information 34 is information in which retail electricity supplier identifiers, request identifiers, and tokens are associated with each other. The retail electricity supplier identifier is an identifier that uniquely identifies the retail electricity supplier 1 . A request identifier is an identifier that uniquely identifies a request for a token. A token is a token generated by the token generator 33 .

Returning to FIG. 6, the aggregate program service 2 has a data verification unit 21, a sum signature unit 22, and a sum signature issuing unit 23. Note that the aggregate program service 2 is an example of a first generator.

The data confirmation unit 21 confirms the performance data. For example, the data confirmation unit 21 inputs signed data as performance data in response to an aggregate request from the electricity retailer 1 . The data confirmation unit 21 confirms the signature of the input signed data.

The sum signature unit 22 generates a signature of the sum of the actual data values. For example, the sum signature unit 22 aggregates (sums) the actual values of the data confirmed by the data confirmation unit 21 . The sum signature unit 22 signs the aggregate result using a private key held in the aggregate program. In addition, the sum signature unit 22 requests a token from the consortium server 3 for this signature, and calculates a hash value using the issued token as a key. Then, the sum signature unit 22 adds a hash value to the signature.

The sum signature issuing unit 23 issues a sum signature. For example, the sum signature issuing unit 23 issues an aggregate result to which the signature of the sum and the hash value are added to the electricity retailer 1 that made the aggregation request.

The node 10 of the electricity retailer 1 has an initial processing unit 11, a sum signature verification unit 12, a certificate generation unit 13, and a certificate transmission unit 14. Note that the certificate generation unit 13 is an example of a second generation unit. Certificate transmission unit 14 is an example of a storage unit.

The initial processing unit 11 performs initial processing in data storage processing. For example, the initial processing unit 11 transmits an aggregate program service request including an electricity retailer identifier to the consortium server 3 . The initial processing unit 11 also transmits an aggregate request including the retail electricity event person identifier and the request identifier to the aggregate program service 2 . The aggregation request may include, for example, performance data for a predetermined period to be aggregated.

The sum signature verification unit 12 verifies the signature of the sum. For example, the sum signature verification unit 12 receives the aggregate result issued by the aggregate program service 2 and verifies the signature of the sum added to the aggregate result using the public key.

The certificate generation unit 13 generates a certificate that proves that the sum signature is correct. For example, the certificate generation unit 13 uses zero-knowledge proof to generate a certificate that certifies that the signature of the aggregate result verified by the sum signature verification unit 12 is correct.

The certificate transmission unit 14 transmits the certificate. For example, the certificate transmission unit 14 generates a total data volume transaction record including the certificate generated by the certificate generation unit 13, the aggregate result, and the hash value attached to the aggregate result. The certificate transmission unit 14 then transmits the generated total data volume transaction record to the blockchain system 5 in association with the retail electricity supplier identifier and the request identifier.

A node 50 that configures the blockchain system 5 has a smart contract 51 and a blockchain platform 52 .

The smart contract 51 automatically executes transaction contracts using blockchain. For example, when the smart contract 51 receives a total data volume transaction record that associates the electricity retailer identifier and the request identifier, the smart contract 51 performs the following processing. The smart contract 51 acquires tokens corresponding to the electricity retailer identifier and the request identifier stored in the aggregate result information 522 . The smart contract 51 then calculates a keyed hash value of the signature of the aggregate result using the acquired token as a key. Smart contract 51 then compares the hash value attached to the aggregate result indicated in the transaction record with the calculated hash value. Then, the smart contract 51 stores the total data amount transaction record in the blockchain platform 52 if the result of the comparison is the same. That is, the smart contract 51 validates the aggregate result of the total data volume transaction record.

The blockchain platform 52 cooperates with other nodes 50 in the blockchain system 5 and uses the blockchain mechanism to manage the ledger of electricity transactions. For example, the blockchain platform 52 adds the block containing the total data volume transaction record received from the smart contract 51 as a new block of the blockchain. When a block is added to the block chain, the block chain platform 52 transmits the block chain to other nodes 50 constituting the block chain system 5 and manages the block chain in a distributed manner.

The blockchain storage unit 520 stores a blockchain indicating power transactions. Also, the blockchain storage unit 520 has public key information 521 and aggregate result information 522 .

The public key information 521 manages public keys generated by the consortium server 3. Here, an example of public key information 521 will be described with reference to FIG. FIG. 8 is a diagram showing an example of public key information. As shown in FIG. 8, the public key information 521 is information that associates an electricity retailer identifier, a public key, and a public key validity period. The retail electricity supplier identifier is an identifier that uniquely identifies the retail electricity supplier 1 . The public key is a public key of public key cryptography generated for each aggregate by the consortium server 3 . The public key validity period is the validity period of the public key. If the consortium server 300 sets the validity period of the private key to be short, it is possible to reduce the risk of being abused when the private key, which is a pair of public keys, is leaked.

Returning to FIG. 6, the aggregate result information 522 manages aggregate results. An example of the aggregate result information 522 will now be described with reference to FIG. FIG. 9 is a diagram illustrating an example of aggregate result information. As shown in FIG. 9, the aggregate result information 522 is information in which retail electricity supplier identifiers, request identifiers, tokens, aggregate results, and valid identifiers are associated with each other. The retail electricity supplier identifier is an identifier that uniquely identifies the retail electricity supplier 1 . A request identifier is an identifier that uniquely identifies a request for a token. A token is a token generated by the token generator 33 . The aggregate result is the result of aggregating the sum of the data. The aggregate result is a value indicating the total sum of actual values (power consumption) for a predetermined period. A valid identifier is an identifier that identifies whether the aggregate result is valid. If it is valid, "○" is set as an example.

[Sequence of data storage processing]
FIG. 10 is a diagram illustrating an example of the sequence of data storage processing according to the embodiment. It should be noted that FIG. 10 is described assuming that the predetermined period of performance data to be aggregated is 30 minutes. As shown in FIG. 10, the node 10 of the electricity retailer 1 requests the aggregate program service from the consortium server 3 (step S11).

Upon receiving the request from the node 10 of the electricity retailer 1, the consortium server 3 generates a key pair of public key cryptography (step S12). The consortium server 3 then distributes the generated public key to the node 10 of the electricity retailer 1 and stores it in the blockchain system 5 (BC) (step S13). Since there is no problem even if the public key is made public, the consortium server 3 also distributes the public key to the electricity retailer 1 that is the source of the request. The consortium server 3 then activates the aggregate program service 2 holding the private key (step S15).

The node 10 of the electricity retailer 1 acquires the actual value purchased from the small-scale power generator 4 (step S14). Then, when the aggregate program service 2 is activated, the node 10 generates performance data to be aggregated in units of 30 minutes (step S16). Then, the node 10 makes an aggregate request to use the aggregate program service 2 (steps S17 and S18). At the time of an aggregate request, the node 10 passes the retail electricity event person identifier and the request identifier to the aggregate program service 2 together with the performance value as the performance data.

The aggregate program service 2 requests a token from the consortium server 3 (step S19). At this time, the Aggregate Program Service 2 also passes the Retail Electricity Party Identifier and Order Identifier to the Consortium Server 3 .

The consortium server 3 that has received the token request generates a token that associates the retail electricity event person identifier and the request identifier (step S20). The consortium server 3 manages the token associated with the retail electricity event person identifier and the request identifier in the token management information 34 . The consortium server 3 then issues the generated token to the requesting aggregate program service 2 (step S21).

The aggregate program service 2 aggregates the performance values for a predetermined period and signs the aggregate result using the private key it possesses (step S22). In addition, the aggregate program service 2 calculates a hash value using the issued token as a key and adds the hash value to the signature. Then, the aggregate program service 2 issues the signed aggregate result to which the hash value is added to the node 10 of the electricity retailer 1 (step S23).

The node 10 of the electricity retailer 1 that has received the signed aggregate result verifies the signature of the aggregate result using the public key (step S24). Then, the node 10 generates a certificate proving that the signature of the verified aggregate result is correct using zero-knowledge signature proof (step S25). Then, the node 10 stores the certificate, the aggregate result, and the hash value associated with the aggregate result in the blockchain system 5 (step S26).

The blockchain system 5 verifies the aggregate result (step S27). Then, if the verification is valid, the blockchain system 5 validates the aggregate result (step S28). For example, the blockchain system 5 calculates a keyed hash value of the signature of the aggregate result using the token as a key. The blockchain system 5 compares the hash value attached to the aggregate result and the calculated hash value. Then, the smart contract 51 validates the aggregate result if the result of the comparison is the same.

[Effect of Example]
According to the above-described embodiment, when receiving a plurality of transaction data, the aggregate program service 2 verifies the signature attached to each of the plurality of transaction data, and if the verification result satisfying the criteria among the plurality of transaction data is An aggregation program generates sum data of transaction volumes corresponding to the obtained transaction data and signature information of the sum data. The node 10 of the electricity retailer 1 certifies that the signature information corresponds to the signature of the total data based on the generated total data and signature information without showing multiple transaction data showing the breakdown of the total data. Proof information for zero-knowledge proof is generated by a certificate creation program different from the aggregate program. Then, the node 10 stores the total sum data and proof information in the blockchain system 5 in which the transaction history of the transaction data is stored. According to such a configuration, the data storage system 9 can reduce the calculation cost for generating the certificate of zero-knowledge proof by using the signature and the zero-knowledge proof.

Also, according to the above embodiment, the data storage system 9 has the consortium server 3 . Aggregate program service 2 generates signature information for total data using an aggregate program distributed from consortium server 3 and containing a different secret key for each total data using a secret key. The node 10 of the electricity retailer 1 verifies the validity of the signature information of the sum data using the public key, which is a pair of private keys, and proves that the signature information corresponds to the signature of the sum data. Generating certificate credentials with a certificate creation program. According to such a configuration, the data storage system 9 can reduce the risk of leakage due to reuse of the secret key by means of the aggregate program holding a different secret key for each aggregate.

Further, according to the above embodiment, the aggregate program service 2 further generates the signature information of the sum data using the private key, and furthermore, the token distributed by the consortium server 3 is different for each sum data. is used as a key, and the hash value is added to the signature information of the total data. According to such a configuration, the data storage system 9 can further reduce the risk of private key leakage by using a token for each aggregate.

Further, according to the above embodiment, the aggregate program service 2 further confirms the total data by the requester who executes the aggregate program, and adds signature information indicating confirmation to the signature information of the total data. The node 10 of the electricity retailer 1 further confirms the signature information added by the client executing the certificate creation program. According to such a configuration, the data storage system 9 can reduce the risk of leakage of the private key in the aggregate program by confirming the signature of the client.

In addition, according to the above embodiment, the aggregate program service 2 generates signature information of total sum data by using a plurality of aggregate programs distributed from a plurality of consortium servers 3, respectively. The node 10 of the electricity retailer 1 verifies the validity of the signature information of each total sum data, and generates proof information when all the verifications are valid. According to such a configuration, the data storage system 9 can eliminate malicious intent even if part of the aggregate program is malicious by verifying the signatures of a plurality of aggregate programs, thereby reducing risks. .

[others]
Note that the node 10 of the electricity retailer 1 according to the above-described embodiment includes the above-described initial processing unit 11, sum signature verification unit 12, certificate generation unit 13 and It can be realized by installing each function such as the certificate transmission unit 14 .

Also, in the above embodiment, each component of the illustrated node 10 of the electricity retailer 1 does not necessarily need to be physically configured as illustrated. In other words, the specific aspects of the distribution and integration of the nodes 10 are not limited to those illustrated, and all or part of them may be functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions. Can be integrated and configured. For example, the initial processing unit 11 may be divided into a transmitting unit that transmits an aggregate program service request and a transmitting unit that transmits an aggregate request. Also, the certificate generation unit 13 and the certificate transmission unit 14 may be integrated as one unit.

Also, the various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, an example of a computer that executes a data storage program that implements the same functions as the node 10 of the electricity retailer 1 shown in FIG. 6 will be described below. FIG. 11 is a diagram of an example of a computer that executes a data storage program. Note that the node 10 of the electricity retailer 1 may include the aggregate program service 2 . In such a case, the data storage program includes the certificate creation program as well as the aggregate program.

As shown in FIG. 11, the computer 700 has a CPU 703 that executes various arithmetic processes, an input device 715 that receives data input from the user, and a display device 709 . The computer 700 also has a drive device 713 that reads programs and the like from a storage medium, and a communication I/F (Interface) 717 that exchanges data with other computers via a network. The computer 700 also has a memory 701 that temporarily stores various information and a HDD (Hard Disk Drive) 705 . The memory 701 , CPU 703 , HDD 705 , display device 709 , drive device 713 , input device 715 and communication I/F 717 are connected via a bus 719 .

The drive device 713 is a device for the removable disk 711, for example. The HDD 705 stores a data storage program 705a and data storage related information 705b. A communication I/F 717 serves as an interface between the network and the inside of the apparatus, and controls input/output of data from other computers. For the communication I/F 717, for example, a modem, a LAN adapter, or the like can be adopted.

The display device 709 is a display device that displays data such as cursors, icons, tool boxes, documents, images, and functional information. The display device 709 can employ, for example, a liquid crystal display or an organic EL (Electroluminescence) display.

The CPU 703 reads the data storage program 205a, develops it in the memory 701, and executes it as a process. Such a process corresponds to each functional part of node 10 . The data storage related information 705b corresponds to information used for executing the data storage program 705a. A removable disk 711, for example, stores information such as a data storage program 705a.

Note that the data storage program 705a does not necessarily have to be stored in the HDD 705 from the beginning. For example, the program is stored in a “portable physical medium” such as a flexible disk (FD), CD-ROM, DVD disk, magneto-optical disk, IC card, etc. inserted into the computer 700 . Then, the computer 700 may read and execute the data storage program 705a from these.

1 Electric retailer 2 Aggregate program service 3 Consortium server 4 Small power generator 5 Block chain system 7

Network

10, 40, 50 Node 11 Initial processing unit 12 Sum signature verification unit 13 Certificate generation unit 14 Certificate transmission unit 21 Data verification unit 22 Sum signature unit 23 Sum signature issuing unit 31 Key generation unit 32 Program activation unit 33 Token generation unit 34 Token management information 51 Smart contract 52 Blockchain platform 520 Blockchain storage unit 521 Public key information 522 Aggregate result information

Claims

When a plurality of transaction data are received, the signature attached to each of the plurality of transaction data is verified, and the total sum of the transaction volumes corresponding to the transaction data for which verification results satisfying the criteria are obtained among the plurality of transaction data. a first generation unit that generates data and signature information of the sum data using a first program;
Based on the sum data and the signature information generated by the first generating unit, the signature information corresponds to the signature of the sum data without indicating a plurality of transaction data indicating the breakdown of the sum data. a second generation unit that generates proof information of a zero-knowledge proof to be proved by a second program different from the first program;
a storage unit that stores the sum data and the proof information in a block chain that stores the transaction history of the transaction data;
An information processing system comprising:
In addition, we have a third party organization,
The first generation unit generates signature information of the sum data using the secret key by the first program distributed from the third party and containing a secret key different for each sum data. death,
The second generator verifies the validity of the signature information of the sum data using the public key that is the pair of the private keys, and proves that the signature information corresponds to the signature of the sum data. 2. The information processing system according to claim 1, wherein proof information for zero-knowledge proof is generated by said second program.
The first generator,
Further, in addition to generating signature information of the sum data using the private key, generating a hash value using a different token for each sum data distributed from the third party as a key, adding the hash value to the signature information of the sum data;
3. The information processing system according to claim 2, characterized by:
The first generating unit further confirms the sum data by a requester who executes the first program, and adds signature information indicating that the sum data has been confirmed to the signature information of the sum data,
4. The information processing system according to claim 2, wherein said second generation unit further confirms signature information added by a client who executes said second program.
The first generation unit generates signature information of the sum data by a plurality of the first programs distributed by a plurality of third parties,
3. The information according to claim 2, wherein the second generation unit verifies the validity of the signature information of each of the total sum data, and generates the proof information when all of the verifications are valid. processing system.
When a plurality of transaction data are received, the signature attached to each of the plurality of transaction data is verified, and the total sum of the transaction volumes corresponding to the transaction data for which verification results satisfying the criteria are obtained among the plurality of transaction data. a first generation unit that generates data and signature information of the sum data using a first program;
Based on the sum data and the signature information generated by the first generating unit, the signature information corresponds to the signature of the sum data without indicating a plurality of transaction data indicating the breakdown of the sum data. a second generation unit that generates proof information of a zero-knowledge proof to be proved by a second program different from the first program;
a storage unit that stores the sum data and the proof information in a block chain that stores the transaction history of the transaction data;
An information processing device comprising:
When a plurality of transaction data are received, the signature attached to each of the plurality of transaction data is verified, and the total sum of the transaction volumes corresponding to the transaction data for which verification results satisfying the criteria are obtained among the plurality of transaction data. generating data and signature information of the sum data by a first program;
Proof of zero-knowledge proof for proving that the signature information corresponds to the signature of the sum data based on the generated sum data and the signature information without showing a plurality of transaction data showing the breakdown of the sum data. a second generation unit that generates information by a second program different from the first program;
An information processing program that causes a computer to execute a process of storing the sum total data and the proof information in a block chain that stores the transaction history of the transaction data.
When a plurality of transaction data are received, the signature attached to each of the plurality of transaction data is verified, and the total sum of the transaction volumes corresponding to the transaction data for which verification results satisfying the criteria are obtained among the plurality of transaction data. generating data and signature information of the sum data by a first program;
Proof of zero-knowledge proof for proving that the signature information corresponds to the signature of the sum data based on the generated sum data and the signature information without showing a plurality of transaction data showing the breakdown of the sum data. generating information by a second program different from the first program;
An information processing method, wherein a computer executes a process of storing the sum total data and the proof information in a block chain storing a transaction history of the transaction data.