JP7540638B2 - Private key operation simplification system - Google Patents

Description

The present invention relates to a system for simplifying private key management.
In this specification, the term "system" refers to a computer system that is configured by combining elements such as computers, other electronic devices, software, communication networks, and data, and that concretely realizes software-based information processing using hardware resources.
Additionally, in this specification, the term "communications terminal" refers to a device that includes a smartphone, a personal computer with web-based functions that connects to a shared network such as an Internet service, and that has a wallet function for managing address information (private key), and that includes all of the functions required to replace a smartphone.

At major commodity exchanges around the world, transactions are conducted with the economic value of commodities and other items expressed in the currencies issued by each country.

In recent years, digitalization technology has made it easier to trade digital assets such as tokens, which digitally represent the economic value of assets.
In particular, assets with standardized economic value, such as commodities (such as products traded on a commodity exchange), have strong characteristics that make them suitable for trading as digital assets.

However, traditional commodity exchanges do not have systems in place to process trading orders for digital assets such as tokens.
In the future, it is expected that services will be developed that automatically process digital data that is recognized as an asset or has some other value, and in such cases, there will be more opportunities for individuals to manage digital data and handle tasks such as moving it.
However, there are various issues with managing digital data, which is considered an asset, by individuals, such as safety (damage from cyber terrorism, etc.), complexity of management, and risk of destruction or loss.
In view of these problems, the present inventors have realized that it is necessary to safely automate the management of private keys, which are particularly important.

The inventors of the present invention have repeatedly considered and examined ways to solve the above-mentioned problems in order to build a system for processing trading orders using digital assets, and in the process have discovered a way to simplify the management and operation of private keys used to sign transactions, which are necessary when transferring or updating digital assets.

The present invention was made in consideration of the above problems, and aims to provide a private key management simplification system that eliminates the risk of digital asset theft resulting from the theft of private keys through cyber attacks, etc., and enables digital assets to be used even if an individual loses their private key, significantly reducing the burden of managing an individual's private key.

In order to achieve the above-mentioned objective, the private key operation simplification system according to the present invention is constructed with at least one distributed ledger in distributed technology such as blockchain for managing transactions between all forms of digital assets, such as tokens (a general term for values defined digitally in distributed technology such as blockchain), digital currency, tokens and digital currency, or between tokens or between digital currencies, and a smart contract or server application for performing a predetermined process using the digital assets managed in the distributed ledger, and is a system that simplifies the operation of a private key in a public key cryptography method that signs transactions that form processing data for digital assets, and is provided in an individual communication terminal, and has a function of creating at least three private keys, at least three public keys that are paired with the respective private keys, and an address from one of the public keys, and a function of creating a shared network. a first private key management and signature means having a function of creating a transaction in an environment separated from the shared network, signing a part of a character string to be signed to the transaction with a first private key of the at least three private keys, communicating with a server of a first other institution that holds the second private key via a dedicated API, and transmitting first individual identifying information having at least a telephone number of the personal communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and biometric authentication information acquired by a biometric authentication information acquisition means provided to the personal communication terminal; and a first private key management and signature means that is provided to the server of the first other institution that holds the second private key, communicating with the personal communication terminal via a dedicated API in an environment separated from the shared network, accepting a login via the first individual identifying information transmitted from the first private key management and signature means, and a second private key management and signing means having a function of receiving a transaction from a third party organization and signing the remaining part of a character string to be signed with the second private key; a third private key storage means provided in a server separated from the shared network of the second third party organization that holds the third private key and that stores the third private key; a personal identification information pre-registration accepting means provided in the server of the first third party organization that holds the second private key and the server of the second third party organization that holds the third private key, and that accepts pre-registration of server-registered personal identification information to the server, the personal identification information having at least a telephone number of an individual's communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and biometric authentication information of the individual acquired by a biometric authentication information acquiring means provided in the individual's communication terminal; The system is characterized by comprising at least an identity verification means having at least a function of comparing the server-registered personal identification information pre-registered via the personal identification information pre-registration acceptance means with the first personal identification information transmitted from the first private key management and signature means, and permitting login to the second private key management and signature means or the third private key storage means of the server if the two pieces of personal identification information match, and disallowing login to the second private key management and signature means or the third private key storage means of the server if they do not match, and a signed transaction approval smart contract having a function of permitting broadcasting to the blockchain of a transaction signed with any two of the three private keys, and disallowing broadcasting to the blockchain of a transaction signed with only one private key.

In addition, in the private key operation simplification system of the present invention, the server of the first third party institution that holds the second private key and the server of the second third party institution that holds the third private key are provided with a communication area pre-registration acceptance means that accepts pre-registration of the individual's communication area to the server, and the identity verification means preferably further has a function of acquiring location information by using the GPS (Global Positioning System) of the individual's communication terminal or communication base information, and a function of comparing the acquired location information of the individual's communication terminal by GPS or the like with the individual's communication area pre-registered via the communication area pre-registration acceptance means, and disallowing login to the second private key management and signature means or the third private key storage means of the server if the location information of the individual's communication terminal by GPS or the like is outside the individual's communication area.

In addition, in the private key management simplification system of the present invention, it is preferable that the biometric authentication information acquired by the biometric authentication information acquisition means comprises at least one of face, fingerprint, iris, vein, or voiceprint.

Furthermore, in the private key management simplification system of the present invention, it is preferable that the first personal identification information further includes an authentication code of the individual, and the personal identification information pre-registration accepting means further accepts the pre-registration of the authentication code of the individual as part of the server-registered personal identification information.

In addition, in the private key management simplification system of the present invention, it is preferable that the personal authentication code is at least one of information known only to the person, such as a password or a security question.

Furthermore, in the private key management simplification system of the present invention, it is preferable that the server having the second private key management and signature means is separated from the shared network.

The present invention provides a private key management simplification system that eliminates the risk of digital asset theft resulting from the theft of private keys through cyber attacks, etc., and allows digital assets to be used even if an individual loses their private key, significantly reducing the management burden of individuals' private keys.

1 is an explanatory diagram illustrating an overall configuration of a private key management simplification system according to a first embodiment of the present invention; 2 is an explanatory diagram illustrating a schematic configuration of a first private key management and signature means in the private key management simplification system of FIG. 1; 2 is an explanatory diagram illustrating a schematic configuration of a second private key management and signature means in the private key management simplification system of FIG. 1. 1. FIG. 4 is an explanatory diagram illustrating a schematic configuration of a third private key storage means in the private key management simplification system of FIG. 2 is an explanatory diagram illustrating a schematic configuration of an individual identifying information advance registration acceptance means in the private key management simplification system of FIG. 1 . 2 is an explanatory diagram illustrating a schematic configuration of an identity verification means in the private key management simplification system of FIG. 1. FIG. 2 is an explanatory diagram illustrating in outline the function of a smart contract for approving a signed transaction in the private key management simplification system of FIG. 2 is an explanatory diagram illustrating a schematic configuration of a communication area advance registration acceptance means in the private key management simplification system of FIG. 1 .

Before describing the embodiments, we will explain how the invention was developed and its effects.

As mentioned above, traditional commodity exchanges do not have systems in place to process trading orders for digital assets such as tokens that are managed using distributed technologies such as blockchain.
In the future, it is expected that services will be developed that automatically process digital data that is recognized as an asset or has some other value, and in that case, there will be more opportunities for individuals to manage digital data and handle tasks such as moving it.
However, there are various issues with managing digital data, which is considered an asset, by individuals, such as safety (damage from cyber terrorism, etc.), complexity of management, and risk of destruction or loss.
In view of these problems, the present inventors have realized that it is necessary to safely automate the management of private keys, which are particularly important.

The inventor has conducted extensive consideration and investigation into building a system for processing trade orders using digital assets, the system comprising at least one type of distributed ledger in distributed technology such as blockchain for managing transactions between any form of digital assets, such as tokens (a general term for value defined digitally in distributed technology such as blockchain), digital currency, tokens and digital currency, or between tokens or between digital currencies, and a smart contract or server application for performing specified processing using the digital assets managed in the distributed ledger.
In the course of this study and investigation, we discovered the following method for simplifying the operation of private keys in public key cryptography, which are used to sign transactions that involve digital asset processing data.

Public key cryptography In public key cryptography, a private key and a public key are created in pairs. Separate private and public keys are used for encrypting and decrypting data (transactions), respectively.
In detail, the sender of data receives the public key of the receiver of the published data, encrypts the data with the received public key, and transmits (broadcasts) the encrypted data to the receiver. The receiver decrypts the encrypted data sent from the sender with the private key that it possesses.
In addition to the data encryption described above, the public key cryptosystem also provides a mechanism for signing data as a method of identity verification.
In more detail, the sender of data signs the data using a private key (encrypts a string to verify the sender's identity) and sends the signed data to the receiver. The receiver uses the sender's public key to decrypt the encrypted string in the sent data. The receiver then compares the decrypted string with the sender's string, and if they match, it is confirmed that the sender is the sender.
The present inventors have considered and examined the problems with existing operational methods when using a private key to sign data (transactions, which are indivisible processing data that depends on business, such as the transfer of digital assets).

1. Existing operation methods
(1-1) Issues with managing private keys by individuals When transferring digital assets via communication between two parties using public key cryptography, it is common to sign a transaction with a private key when broadcasting (sending) the transaction to the blockchain.
However, if the private key is managed by a hot type management means (connected to a shared network such as the Internet), there is a high risk that the private key will be stolen by a cyber attack or the like.
Furthermore, if the private key is stolen, there is a high risk that the digital assets managed on the blockchain will be stolen.

To avoid such risks, it is advisable to manage private keys in a manner that is separate from shared networks (such as the Internet).
However, in order to manage private keys separately from the shared network, a device with the ability to manage dedicated private keys, such as a hardware wallet, is required, which makes the process of individuals signing transactions using their private keys extremely complicated.
On the other hand, in small transactions and payments, it is particularly desirable to simplify the operation of using private keys to sign transactions.

(1-2) Issues when entrusting the management of a private key to a third party One possible solution to the above issues is for the owner of the private key to entrust the management of the private key to a third party that provides a service of holding private keys.
In this type of service, a third party who holds the owner's private key generates transactions and signs them with the private key held by the owner.
However, when a third party who holds the owner's private key signs a transaction, an authorization process is required to prove the ownership of the private key.
In addition, with this type of service, if a third party who holds the private key is subjected to a cyber attack and the stolen digital assets are stolen, the stolen digital assets are generally not guaranteed.
For this reason, although this type of service offers operational convenience to private key holders, it is considered difficult to use when trading or settling high-value digital assets, as the risks of depositing private keys are high.

2. Consideration of measures to improve the above problems The inventors of the present invention came up with the idea of avoiding cyber attacks by implementing an approval function using biometric authentication or communication via a dedicated API (Application Programming Interface) before broadcasting a transaction signed with a private key to the blockchain, and have repeatedly considered and examined this idea.

(2-1) When a private key is managed by an individual's communication terminal such as a smartphone, the inventors of the present invention considered the possibility of managing a private key by an individual's communication terminal such as a smartphone, and considered and examined the issues that would arise in this case.
Communication devices such as smartphones are provided with an application (essentially a wallet) that allows users to create transactions and sign them with a private key in an environment that is separate from the shared network.
The wallet communicates with a server that executes specified processing using a dedicated API (communication is encrypted).
Here, the inventors of the present invention have devised a system in which, during communication, the wallet transmits the telephone number of the individual's communication terminal such as a smartphone and biometric authentication information (face, iris, fingerprint data, etc.) acquired by a biometric authentication information acquisition means (built-in camera, sensor, etc.) equipped on the individual's communication terminal such as a smartphone as personal identification information, and the server compares the personal identification information using the telephone number of the individual's communication terminal such as a smartphone and the biometric authentication information (face, iris, fingerprint data, etc.) that have been registered in advance, and when the personal identification information matches and it is confirmed that the individual is the person in question, the individual can be made to log in to a function that executes processing on the server.

However, considering the risk of digital assets being thefted due to the theft of private keys through cyber attacks, small amounts of digital assets (for example, around 100,000 yen) can be managed in an address created with a private key managed on a communication device such as a smartphone, but high-value digital assets exceeding 100,000 yen should desirably be detached from communication devices such as smartphones and managed in an address created with a private key managed on dedicated hardware.
In this case, the balance of digital assets managed at an address created with a private key managed on a communication terminal such as a smartphone must be reconciled with the balance of digital assets managed at an address created with a private key managed on the dedicated hardware via a dedicated application.
In other words, there will be two addresses created corresponding to an individual's private key: an address for small digital assets and an address for high-value digital assets, making management complicated.

In addition, if a communication device such as a smartphone is broken, the private key must be regenerated using a mnemonic (recovery phrase; backup code; an English word or symbol that corresponds to the private key) that is managed separately. However, if the mnemonic is managed by an individual, there is a high possibility that it will be lost, so it is possible to have a third party (a service equivalent to a safe deposit box) manage the mnemonic.
In addition, if the blockchain is a private or consortium type, if the mnemonic or private key is lost and an individual can reliably prove that they are the owner of the mnemonic or private key, it may be possible to pay a designated fee to a third party (a service equivalent to a safe deposit box) that manages the key and process the reissue of the private key.

The inventors then came up with the idea of making it so that transactions cannot be broadcast (sent) to the blockchain unless a private key (an address created via the private key) is linked to a biometric authentication function (matching biometric authentication information acquired by a biometric authentication information acquisition means provided on a communication terminal such as a smartphone with biometric authentication information preregistered on a server to obtain personally identifiable information).

The inventors also came up with the idea of making it possible to obtain location information by using the Global Positioning System (GPS) or information from communication bases, and allowing address owners (individuals) to register their communications on a server by restricting the communication area to a specified range (for example, within Japan (or a more limited area)). For example, if someone is communicating with the server from overseas using a communication device such as a smartphone, they will not be allowed to log in to the server, making it possible to deal with cyber attacks.

(2-2) When an individual's private key is entrusted to a third-party institution or company for management Next, the inventors considered the possibility of entrusting an individual's private key to a third-party institution or company for management, and considered and examined the issues that would arise in this case.
If an individual's private key is entrusted to a third-party institution or company rather than to a communication device such as a smartphone, as mentioned above, it is generally difficult for an individual to use it, since even if the third-party institution or company is subjected to a cyber attack and digital assets are stolen, the stolen digital assets are not guaranteed.
Third-party institutions and companies would run applications (essentially cold wallets) in an environment disconnected from the shared network that would create transactions and sign them with private keys entrusted to them by individuals.
The wallet receives commands to execute specific processes from a customer's smartphone application via dedicated API communication or the like, and communicates with a server that has the functionality to execute the processes.
Here, the inventors of the present invention have devised a system in which, during communication, the wallet transmits the telephone number of the individual's communication terminal such as a smartphone and biometric authentication information (face, iris, fingerprint data, etc.) acquired by a biometric authentication information acquisition means (built-in camera, sensor, etc.) equipped on the individual's communication terminal such as a smartphone as personal identification information, and the server compares the personal identification information using the telephone number of the individual's communication terminal such as a smartphone and the individual's biometric authentication information (face, iris, fingerprint data, etc.) that have been registered in advance, and when the personal identification information matches and it is confirmed that the individual is the person in question, the individual can be made to log in to a function that executes processing on the server.

Signing transactions with private keys entrusted to them by individuals is done using a cold wallet. Signing transactions with private keys entrusted to them by individuals using a cold wallet is done by connecting to a shared network only at regular intervals for a set period of time, and is not a real-time process, so it is considered to be suitable for large remittances and payments.

The inventors also came up with the idea of making it possible to obtain location information from the personal communications device using GPS or other devices even when an individual's private key is entrusted to a third-party institution or company for management, and to allow the address owner (individual) to restrict communication areas to a specified range and register it on a server, so that, for example, if someone is communicating with the server from overseas using a communications device such as a smartphone, they will not be allowed to log in to the server, and to eliminate cyber attacks by verifying and activating a special code (linked to a phone number) set on the communications device such as a smartphone.

The inventors then came up with the idea that unless a private key (an address created via a private key) is linked to a biometric authentication function (matching of personal identification information obtained by a biometric authentication information acquisition means provided in a communication terminal such as a smartphone with biometric authentication information preregistered in a server), a transaction cannot be signed with a private key entrusted to the individual, and therefore cannot be broadcast (sent) to the blockchain.

(2-3) Consideration and examination of private key management in a multi-sig system that combines the above (2-1) and (2-2) Furthermore, the present inventors have considered private key management in a multi-sig system that combines the above (2-1) and (2-2).
Multisig is a security technology used on the Internet that requires multiple electronic signatures, but the inventors of the present invention considered applying a technology that enables broadcasting to the blockchain with only the electronic signatures of two of three private keys, such as 2/3 (2 of 3).

The inventors have come up with a system where at least three private keys are managed as follows: the first private key is managed by the individual (on a communications device such as a smartphone), the second private key is managed by a third-party institution/company (on its server), and the third private key is managed by a corporation (such as an auditing system) that is independent of both the individual and the third-party institution/company; transactions are usually signed using the two private keys of the individual and the third-party institution/company; and when an individual's private key is lost (due to loss or damage of a communications device such as a smartphone), the individual can apply to the independent corporation to create a new private key for the individual, which will then verify the individual's identity and, if confirmed, make it possible to create a new private key for the individual from the other two private keys.

A personal communication device, such as a smartphone, uses a provided application (effectively a wallet) to create transactions and sign them with a first private key in an environment that is disconnected from the shared network.
The wallet communicates with the servers of third-party institutions and companies via a dedicated API (communications are encrypted).
Here, the inventors have come up with the idea that, during this communication, the wallet will transmit the telephone number of the individual's communication terminal such as a smartphone and biometric authentication information (face, iris, fingerprint data, etc.) acquired by a biometric authentication information acquisition means (built-in camera, sensor, etc.) equipped on the individual's communication terminal such as a smartphone, and the server of the third-party institution/company will compare the individual's pre-registered telephone number and biometric authentication information (face, iris, fingerprint data, etc.) with the individual's personally identifiable information, and when the personally identifiable information matches and the individual is confirmed to be the person in question, the individual will be able to log in to a function that executes processing on the server of the third-party institution/company.

We envisioned an application (essentially a cold wallet) running on the server of a third-party institution or company in an environment isolated from the shared network, which would receive partially processed transactions (signed with the first private key, but not signed with the second private key) from an application on a customer's smartphone or other communication device via dedicated API communication, sign the remaining part of the transaction with the second private key, and make the transaction available for broadcast (send) to the blockchain.
Since the final signature of a transaction with a private key is multi-sig, it is possible to do this using a hot wallet; however, cold wallets are considered to be more secure and easier to prevent cyber attacks.

If one of the private keys is damaged or stolen, a new address will be created and the remaining two private keys will be used in a cold wallet to sign a transaction to transfer digital assets, after which operations will be switched to using the new address.
When such a private key change situation occurs, in order to refer to transaction records at the old address, it will be possible to record address information before the change in the address information on the blockchain.

The inventors also considered making it possible to obtain location information using the Global Positioning System (GPS) even in the case of multi-sig private key management, and allowing address owners (individuals) to restrict communication areas to a specified range and register it on a server, so that, for example, login to the server would not be permitted if someone was communicating with the server from overseas using a smartphone, and cyber attacks could be prevented by verifying and operating a special code (linked to a phone number) set on the smartphone.

The inventors of the present invention have come up with the idea that in order to sign a transaction with any two private keys and broadcast (send) it to the blockchain, unless one private key (the address created with it) is linked to a biometric authentication function (matching of personal identification information by comparing biometric authentication information acquired by a biometric authentication information acquisition means equipped in a smartphone with biometric authentication information pre-registered on a server), the transaction will not be signed and cannot be broadcast (sent) to the blockchain.

The management of private keys in the above multi-sig model has the instant processing capabilities of a hot wallet, and by using biometric authentication as the basis for identity verification via a personal smartphone or other communication device, it makes private key management virtually unconscious. In addition, the risk of digital assets being leaked due to the theft of private keys through cyber attacks is eliminated, making it highly secure.

In this way, the inventors of the present invention have come up with the private key operation simplification system of the present invention after much consideration and investigation into simplifying the operation of private keys in public key cryptography, which are used to sign transactions that constitute processing data for digital assets.

The private key operation simplification system of the present invention is constructed with at least one distributed ledger in distributed technology such as blockchain for managing transactions between all forms of digital assets, such as tokens (a general term for values defined digitally in distributed technology such as blockchain), digital currency, tokens and digital currency, or between tokens or between digital currencies, and a smart contract or server application for performing specified processing using the digital assets managed in the distributed ledger, and is a system that simplifies the operation of a private key in a public key cryptography method that signs transactions that form processing data for digital assets, and is provided in an individual communication terminal, and has a function of creating at least three private keys, at least three public keys that are paired with the respective private keys, and an address from one of the public keys, and a function of creating a public key that is disconnected from a shared network. a first private key management and signature means having a function of communicating with a server of a first other institution that keeps the second private key by a dedicated API and transmitting first personal identification information having at least a telephone number of the personal communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and biometric authentication information acquired by a biometric authentication information acquisition means provided in the personal communication terminal; and a first private key management and signature means that is provided in the server of the first other institution that keeps the second private key, communicates with the personal communication terminal by a dedicated API in an environment separated from a shared network, and after accepting a login via the first personal identification information transmitted from the first private key management and signature means, sends a transaction in which a part of a character string to be signed is signed with the first private key. a second private key management and signing means having a function of receiving a transaction from a third party institution and signing the remaining part of the character string to be signed with the second private key; a third private key storage means provided in a server separated from the shared network of the second third party institution that holds the third private key and that stores the third private key; an individual identification information pre-registration receiving means provided in the server of the first third party institution that holds the second private key and the server of the second third party institution that holds the third private key, the individual identification information pre-registration receiving means receiving pre-registration of server-registered individual identification information having at least a telephone number of an individual's communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and biometric authentication information of the individual acquired by a biometric authentication information acquisition means provided in the individual's communication terminal; The system is provided with at least an identity verification means having at least a function of comparing the server-registered personal identification information pre-registered via the personal identification information pre-registration reception means with the first personal identification information transmitted from the first private key management and signature means, and permitting login to the second private key management and signature means or the third private key storage means of the server if the two pieces of personal identification information match, and disallowing login to the second private key management and signature means or the third private key storage means of the server if they do not match, and a signed transaction approval smart contract having a function of permitting broadcasting to the blockchain of a transaction signed with any two of the three private keys, and disallowing broadcasting to the blockchain of a transaction signed with only one private key.

As in the private key management simplification system of the present invention, if a smart contract for approving signed transactions does not allow broadcasting of transactions signed with only one private key to the blockchain, even if one of the private keys, either the individual's first private key or the first other institution's second private key, is stolen and used to sign a transaction, the transaction can be prevented from being broadcast to the blockchain, and the theft of the individual's digital assets, who is the owner of the first private key, can be prevented.

Also, as in the private key operation simplification system of the present invention, a personal identification information pre-registration reception means is provided in the server of the first other organization that keeps the second private key and the server of the second other organization that keeps the third private key, and receives pre-registration of server-registered personal identification information having at least a telephone number of an individual's communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and biometric authentication information of the individual acquired by a biometric authentication information acquisition means provided in the individual's communication terminal, and a personal identification information pre-registration reception means is provided in the server of the first other organization that keeps the second private key and the server of the second other organization that keeps the third private key, and receives the server-registered personal identification information pre-registered via the personal identification information pre-registration reception means from the first private key management and signature means. and an identity verification means having at least the function of comparing the server-registered personal identification information with the first personal identification information transmitted from the first private key management and signature means, and permitting login to the second private key management and signature means or the third private key storage means of the server if the two pieces of personal identification information match, and disallowing login to the second private key management and signature means or the third private key storage means of the server if they do not match. In this case, even if an individual's first private key is stolen along with a communication terminal such as a smartphone, the identity verification means will compare the server-registered personal identification information with the first personal identification information transmitted from the first private key management and signature means, and will not allow login to the second private key management and signature means of the server with the first personal identification information whose biometric authentication information is information about another person (who stole the first private key along with a communication terminal such as a smartphone).
As a result, in a transaction in which a portion of a string to be signed is signed with the first private key, the remaining portion of the string to be signed cannot be signed by the second private key management and signing means, preventing the transaction from being broadcast to the blockchain and preventing the theft of digital assets of the individual who owns the first private key.

Furthermore, as in the private key operation simplification system of the present invention, if the first private key management/signature means creates at least three private keys, at least three public keys paired with each of the private keys, and an address from one of the public keys, the second private key management/signature means is provided in a server of the first other institution that holds the second private key, and the third private key storage means is provided in a server separated from the shared network of the second other institution that holds the third private key, then if any of the private keys is destroyed or stolen, it will be possible to create a new address and sign transactions with the remaining two private keys, and then switch to operation using the new address and recover.
For example, if the owner of the first private key loses the first private key due to loss or damage of a communication terminal such as a smartphone, the owner creates a new address and then transfers all of the digital assets in the old address to the new address using the old second private key and the old third private key.

In the private key management simplification system of the present invention, the first private key management and signature means is provided in the personal communication terminal, and the biometric authentication information constituting the first personal identification information that the personal identification means compares with the server-registered personal identification information for personal identification can be easily acquired by the biometric authentication information acquisition means provided in the communication terminal. Moreover, as described above, even if the private key is stolen, theft of digital assets can be prevented. Therefore, while using the private key, an individual can instantly perform processes such as transferring digital assets via signing a transaction using the first private key without being aware of the theft of the private key.

In addition, the private key management simplification system of the present invention preferably further comprises a communication area pre-registration accepting means provided in the server of a first other organization holding the second private key and the server of a second other organization holding the third private key, and accepting pre-registration of the individual's communication area to said servers, and the identity verification means further has a function of acquiring location information by using a GPS (Global Positioning System) of the individual's communication terminal or information on communication bases, etc., and a function of comparing the acquired location information of the individual's communication terminal based on GPS or the like with the individual's communication area pre-registered via the communication area pre-registration accepting means, and disallowing login to the second private key management/signature means or the third private key storage means of the server if the location information of the individual's communication terminal based on GPS or the like is outside the individual's communication area.
With this configuration, even if an individual's first private key is stolen along with a communications terminal such as a smartphone and biometric authentication information (e.g., a fingerprint) is copied, if communications from another person who has stolen the individual's first private key along with a communications terminal such as a smartphone and copied the biometric authentication information (e.g., a fingerprint) are received outside of a communication area, such as overseas, login to the server's second private key management/signature means can be disallowed, thereby further enhancing the effectiveness of preventing theft of digital assets in the event that an individual's first private key and a communications terminal such as a smartphone are stolen.

In the private key management simplification system of the present invention, the biometric authentication information acquired by the biometric authentication information acquisition means preferably comprises at least one of face, fingerprint, iris, vein, or voiceprint.
In this way, biometric authentication information is embodied in the personal identification information used for identity verification. In addition, by combining a plurality of pieces of biometric authentication information, the matching condition for the personal identification information when the identity verification means collates the server-registered personal identification information with the first personal identification information becomes stricter, and it becomes possible to further enhance the effect of preventing the theft of digital assets due to the theft of a private key, etc.

In addition, in the private key management simplification system of the present invention, preferably, the first personal identification information further has an authentication code for the individual, and the personal identification information pre-registration acceptance means further accepts pre-registration of the authentication code for the individual as part of the server-registered personal identification information.
By configuring it in this manner, the conditions for matching the personal identification information when the identity verification means compares the server-registered personal identification information with the first personal identification information become stricter, making it possible to further enhance the effect of preventing theft of digital assets due to theft of private keys, etc.

In the private key management simplification system of the present invention, the personal authentication code preferably comprises at least one of information known only to the person in question, such as a password or a security question.
In this way, an individual authentication code in the individual identifying information used for identity verification is realized. Also, by combining a plurality of individual authentication codes, the matching condition of the individual identifying information when the identity verification means collates the server-registered individual identifying information with the first individual identifying information becomes stricter, and it becomes possible to further enhance the effect of preventing the theft of digital assets due to the theft of a private key, etc.

In the private key management simplification system of the present invention, the server having the second private key management and signature means is preferably separated from the shared network.
With this configuration, it is possible to minimize the risk of the second private key being stolen from a server having the second private key management and signature means.

Therefore, according to the present invention, it is possible to obtain a private key management simplification system that eliminates the risk of digital asset theft associated with the theft of private keys through cyber attacks, etc., and enables digital assets to be used even if an individual loses their private key, thereby significantly reducing the burden of managing an individual's private key.
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

First Embodiment FIG. 1 is an explanatory diagram showing in outline the overall configuration of a private key management simplification system according to a first embodiment of the present invention.
The first embodiment of the system for simplifying the private key management of digital assets is constructed with at least one type of distributed ledger in distributed technology such as blockchain for managing transactions between all forms of digital assets, such as tokens (a general term for values defined digitally in distributed technology such as blockchain), digital currencies, tokens and digital currencies, or between tokens or between digital currencies, and a smart contract or server application for performing predetermined processing using the digital assets managed in the distributed ledger, and is a system that simplifies the management of a private key of a public key cryptography method that signs a transaction that constitutes processing data of a digital asset. As shown in FIG. 1, the system includes a first private key management/signature means 11, a second private key management/signature means 12, a third private key storage means 13, a personal identification information pre-registration acceptance means 14, a personal identification means 15, a signed transaction approval smart contract 16, and a communication area pre-registration acceptance means 17.
It should be noted that the private key management simplification system of this embodiment is premised on being equipped with, for example, a digital asset trading system (not shown).
In the digital asset trading system, a smart contract for digital asset trading that processes orders for digital assets operates for each stock and performs matching and settlement processing for orders for each stock.
The private key management simplification system of this embodiment operates when the need arises to move digital assets, for example, for settlement after a digital asset transaction is concluded in a digital asset trading system not shown, or for lending and borrowing digital assets in a digital asset transaction.

First private key management and signature means 11
The first private key management and signature means 11 is provided in an individual's communication terminal 40, and as shown in FIG. 2, is configured to have the following functions.
(11-1) The ability to create at least three private keys, at least three public keys paired with each private key, and an address from one public key.
(11-2) A function for creating a transaction in an environment isolated from the shared network and signing a portion of a string to be signed for the transaction using a first private key among at least three private keys.
(11-3) A function of communicating with the server 50 of the first other institution holding the second private key or the server 60 of the second other institution holding the third private key via a dedicated API, and transmitting first personal identification information including at least the telephone number of the individual's communication terminal 40 (in the case where the communication terminal 40 is a telephone communication device such as a smartphone) and biometric authentication information acquired by a biometric authentication information acquisition means (not shown) provided on the individual's communication terminal 40.
Examples of the biometric authentication information acquisition means provided in the communication terminal 40 include authentication functions that utilize the human body, such as face authentication, iris authentication, fingerprint authentication, vein authentication, or voiceprint authentication, using a camera, sensor, or voice recorder built into the communication terminal 40. Examples of the biometric information include at least one of the face, iris, fingerprint, vein, and voiceprint.
It is more preferable that the first individual identification information further includes an authentication code of the individual.
The authentication code may be at least one of a password, a secret question, or other information that is known only to the user.

Second private key management and signature means 12
The second private key management/signature means 12 is provided in a server 50 of the first third party institution which holds the second private key of the at least three private keys created by the first private key management/signature means 11, and as shown in FIG. 3, is configured to have the following functions:
(12-1) A function of communicating with an individual's communication terminal 40 via a dedicated API (the communication is encrypted) in an environment disconnected from the shared network, accepting a login via the first personal identification information sent from the first private key management/signature means 11, receiving a transaction in which a portion of a character string to be signed has been signed with a first private key, and signing the remaining portion of the character string to be signed in the transaction with a second private key.

Third private key storage means 13
The third private key storage means 13 is provided in a server 60 isolated from the shared network of the second third party institution, which holds the third private key of the at least three private keys created by the first private key management/signature means 11, and is configured to store the third private key, as shown in Figure 4.

Individual identification information advance registration acceptance means 14
The personal identification information pre-registration acceptance means 14 is provided in the first other party's server 50 that holds the second private key and the second other party's server 60 that holds the third private key, and is configured to accept pre-registration of server-registered personal identification information to the server, which includes at least the telephone number of an individual's communication terminal 40 (in the case that the communication terminal 40 is a telephone communication device such as a smartphone) and the individual's biometric authentication information acquired by a biometric authentication information acquisition means provided in the individual's communication terminal 40, as shown in FIG. 5.
It is more preferable that the individual identifying information advance registration accepting means 14 is configured to further accept advance registration of the individual's authentication code as part of the server-registered individual identifying information.

Identity verification means 15
The identity verification means 15 is provided in the server 50 of the first other institution which holds the second private key and in the server 60 of the second other institution which holds the third private key, and is configured to have at least the following functions, as shown in FIG. 6:
(15-1) A function of comparing the server-registered personal identification information pre-registered via the personal identification information pre-registration acceptance means 14 with the first personal identification information transmitted from the first private key management and signature means 11, and if the two pieces of personal identification information match (and the identity of the individual can be confirmed), permitting login to the second private key management and signature means 12 or third private key storage means 13 of the server, and disallowing login to the second private key management and signature means 12 or third private key storage means 13 of the server if they do not match.
The personal identification means 15 is further configured to have the following functions.
(15-2) A function for acquiring location information by using the GPS (Global Positioning System) of an individual's communication terminal 40 or information on communication bases.
(15-3) A function for comparing the acquired location information of the personal communication terminal 40 using GPS or the like with the communication area of the personal communication terminal 40 pre-registered via the communication area pre-registration reception means 17, and for not allowing login to the second private key management/signature means 12 or the third private key storage means 13 of the server if the location information of the personal communication terminal 40 using GPS or the like is outside the communication area of the personal communication terminal 40.

Signed Transaction Approval Smart Contract 16
As shown in FIG. 7, the signed transaction approval smart contract 16 is configured to have the following functions:
(16-1) A function that allows transactions signed with any two of the three private keys to be broadcast to the blockchain, and disallows transactions signed with only one private key to be broadcast to the blockchain.

Communication area advance registration acceptance means 17
The communication area pre-registration acceptance means 17 is provided in the server 50 of the first other institution that holds the second private key and in the server 60 of the second other institution that holds the third private key, and is configured to accept pre-registration of an individual's communication area (for example, within Japan (or further limited areas, etc.)) to the relevant servers, as shown in Figure 8.

The process flow in the private key management simplification system of this embodiment configured as described above will be explained. Note that here, the first other organization is a third-party organization or company, and the second other organization is an auditing organization. Also, a smartphone is used as the personal communication terminal 40.

(1) Creation of a private key An individual creates first to third private keys via the first private key management and signature means 11 provided in the smartphone 40. At this time, first to third public keys are also created at the same time. In addition, an address is also created using the first public key.
The individual deposits the second private key with a first third party organization (a third-party organization or company) and deposits the third private key with a second third party organization (an auditing organization).

(2) Advance registration of personal identification information : An individual registers his/her personal identification information on server 50 of a first other organization (third-party organization or company) that holds the second private key and on server 60 of a second other organization (auditing organization) that holds the third private key.
At that time, the personal identification information pre-registration acceptance means 14 provided in the server 50 of the first other institution (third-party institution/company) that holds the second private key accepts pre-registration of server-registered personal identification information that includes at least the telephone number of the individual's smartphone 40 and the individual's biometric authentication information (e.g., at least one of face, iris, fingerprint, vein or voiceprint, etc.) acquired by a biometric authentication information acquisition means provided in the individual's smartphone 40 (e.g., authentication functions that use the human body, such as face authentication, iris authentication, fingerprint authentication, vein authentication or voiceprint authentication using a camera, sensor or voice recorder, etc.).
If the individual so desires, the personal identification information pre-registration acceptance means 14 further accepts the pre-registration of the individual's authentication code (e.g., at least one of information known only to the individual, such as a password or security question) as part of the server-registered personal identification information.
Furthermore, if the individual so desires, the communication area pre-registration accepting means 17 accepts pre-registration of the individual's communication area (for example, within Japan (or further limited areas)) with the server.

(3) Signing a Transaction with the First Private Key An individual creates a transaction in an environment separated from the shared network via the first private key management and signature means 11 provided in the smartphone 40.
The first private key management and signature means 11 signs a part of the character string to be signed for the transaction using the first private key.
The first private key management and signature means 11 communicates with a server 50 of a first other organization (third-party organization or company) that holds the second private key through a dedicated API (communication is encrypted).When communicating, the first personal identification information is transmitted, which includes at least the telephone number of the smartphone 40 of the individual, and biometric authentication information (e.g., at least one of face, iris, fingerprint, vein, or voiceprint, etc.) acquired by a biometric authentication information acquisition means (e.g., authentication function using the human body such as face authentication using a camera, sensor, or voice recorder, etc., iris authentication, fingerprint authentication, vein authentication, or voiceprint authentication) provided in the smartphone 40 of the individual.
In server 50 of the first other organization (third-party organization or company) which holds the second private key, identity verification means 15 compares the server-registered personal identification information pre-registered via personal identification information pre-registration acceptance means 14 with the first personal identification information transmitted from first private key management/signature means 11, and if the two pieces of personal identification information match (and it can be confirmed that the individual is the real person), then login to the server's second private key management/signature means 12 is permitted.

(4) Signing the transaction with the second private key The first other institution (third-party institution/company) communicates with the individual's smartphone 40 using a dedicated API (the communication is encrypted) via the second private key management/signature means 12 in an environment isolated from the shared network, and after accepting a login via the first personally identifiable information sent from the first private key management/signature means 11, receives a transaction in which a portion of the string to be signed is signed with the first private key, signs the remaining portion of the string to be signed in the transaction with the second private key, and makes the transaction available for broadcast (transmission) to the blockchain.

(5) Approval of a Signed Transaction The smart contract for approving a signed transaction 16 allows a transaction that has been signed with two private keys (a first private key and a second private key) to be broadcast to the blockchain.

(6) Processing function when trouble occurs
(6-1) Function for preventing theft of digital assets in the event that the first private key is stolen In this embodiment, it is assumed that the first private key is stolen, and the third party who stole the first private key creates a transaction via a specified wallet on the third party’s smartphone and signs the created transaction with the stolen first private key.
In this case, the smart contract 16 for approving signed transactions does not allow transactions signed with only one private key (the first private key) to be broadcast to the blockchain.
This prevents the digital assets of the individual who owns the first private key from being stolen.

(6-2) Anti-theft function for digital assets in case the second private key is stolen Even if the second private key is stolen and another person who stole the second private key creates a transaction via a specified wallet on the other person's smartphone and signs it with the stolen second private key, the smart contract 16 for approving signed transactions will not allow the broadcast of a transaction signed with only one private key (the second private key) to the blockchain.
This prevents the digital assets of the individual who owns the first private key from being stolen.

(6-3) Anti-theft function for digital assets in the event that an individual's first private key is stolen along with smartphone 40 Here, it is assumed that a third party who has stolen an individual's first private key along with smartphone 40 creates a transaction in an environment isolated from the shared network via the first private key management and signature means 11 provided on said smartphone 40, signs a portion of the string to be signed for said transaction with the first private key, and then communicates with server 50 of the first third party institution (third-party institution or company) that holds the second private key via a dedicated API (communication is encrypted).
In this case, when communicating, the first private key management/signature means 11 transmits first personal identification information which includes at least the telephone number of the individual's smartphone 40 and the biometric authentication information (e.g., at least one of face, iris, fingerprint, vein or voiceprint, etc.) of another person (who has stolen the first private key along with the smartphone) acquired by a biometric authentication information acquisition means (e.g., authentication functions that utilize the human body, such as face authentication, iris authentication, fingerprint authentication, vein authentication or voiceprint authentication using a camera, sensor or voice recorder, etc.) provided on the individual's smartphone 40.
In server 50 of the first other organization (third-party organization/company) that holds the second private key, identity verification means 15 compares the server-registered individual identifying information preregistered via individual identifying information preregistration acceptance means 14 with the first individual identifying information transmitted from first private key management/signature means 11. At this time, the biometric authentication information in the first individual identifying information is information about another person (who stole the first private key together with the smartphone 40), while the biometric authentication information in the server-registered individual identifying information is information about the individual (who had the first private key together with the smartphone 40 stolen), and the two pieces of individual identifying information do not match. For this reason, identity verification means 15 does not permit login to second private key management/signature means 12 of the server.
As a result, in a transaction in which a portion of a character string to be signed has been signed with the first private key, the second private key management and signature means 12 does not sign the remaining portion of the character string to be signed.
The smart contract 16 for approving signed transactions does not allow transactions signed with only one private key (the first private key) to be broadcast to the blockchain.
This prevents the digital assets of the individual who owns the first private key from being stolen.

(6-4) Anti-theft function for digital assets in the case where an individual's first private key is stolen along with smartphone 40 and biometric authentication information (e.g., a fingerprint) is copied. Here, it is assumed that another person who steals an individual's first private key along with smartphone 40 and copies the biometric authentication information (here, for example, a fingerprint) creates a transaction in an environment separated from the shared network via first private key management and signature means 11 provided on said smartphone 40, signs a part of the string to be signed to said transaction with the first private key, and then communicates with server 50 of the first other organization (third-party organization or company) that holds the second private key via a dedicated API (communication is encrypted).
In this case, when communicating, the first private key management/signature means 11 transmits first personal identification information that includes at least the telephone number of the individual's smartphone 40 and the individual's biometric authentication information (here, a fingerprint) copied by another person (who has stolen the first private key along with the smartphone 40) acquired by a biometric authentication information acquisition means (here, for example, a fingerprint authentication function using a sensor) provided on the individual's smartphone 40.
In the server 50 of the first other organization (third-party organization/company) that holds the second private key, the identity verification means 15 compares the server-registered individual identifying information preregistered via the individual identifying information preregistration receiving means 14 with the first individual identifying information transmitted from the first private key management/signature means 11. At this time, the biometric authentication information in the first individual identifying information is the individual's biometric authentication information (here, a fingerprint) copied by a third party (who has stolen the first private key together with the smartphone 40), and matches the biometric authentication information (here, a fingerprint) in the server-registered individual identifying information. As a result, the identity verification means 15 allows login to the second private key management/signature means 12 of the server.

In preparation for such a case, if the individual pre-registers the individual's communication area (for example, within Japan (or a further limited area)) with the server via the communication area pre-registration reception means 17, then in the event that communication from another person who has stolen the individual's first private key along with the smartphone 40 and copied the biometric authentication information (here, a fingerprint) is outside the communication area, for example, overseas, the identity verification means 15 will acquire location information of the other person communicating with the individual's smartphone 40 by using a GPS (Global Positioning System) or communication base information, etc., and will compare the acquired location information of the other person based on GPS, etc. (here, overseas) with the individual's communication area pre-registered via the communication area pre-registration reception means 17 (here, within Japan), and will not permit login to the server's second private key management/signature means 12 because the location information of the individual's smartphone 40 based on GPS, etc., with which the other person is communicating is outside the communication area.
As a result, in a transaction in which a portion of a character string to be signed has been signed with the first private key, the second private key management and signature means 12 does not sign the remaining portion of the character string to be signed.
The smart contract 16 for approving signed transactions does not allow transactions signed with only one private key (the first private key) to be broadcast to the blockchain.
This prevents the digital assets of the individual who owns the first private key from being stolen.

If any of the private keys are destroyed or stolen, a new address will be created, transactions will be signed with the remaining two private keys, and then operations will be switched to the new address.
For example, if the owner of the first private key loses the first private key due to loss or damage of a communication terminal 40 such as a smartphone, the owner creates a new address and then transfers all of the digital assets in the old address to the new address using the old second private key and the old third private key.
In addition, when such a private key switch is performed, in order to refer to the transaction records at the old address, it will be possible to record the old address information as the address information to be recorded in the blockchain.

Effects of the private key management simplification system of the present embodiment According to the private key management simplification system of the present embodiment , the smart contract 16 for approving signed transactions does not allow a transaction signed with only one private key to be broadcast to the blockchain. Therefore, even if either an individual's first private key or the second private key of the first other institution (third-party institution or company) is stolen and used to sign a transaction, the transaction can be prevented from being broadcast to the blockchain, and the theft of the digital assets of the individual who owns the first private key can be prevented.

Moreover, according to the private key operation simplification system of the present embodiment, the server 50 of the first other organization (third-party organization/company) that keeps the second private key and the server 60 of the second other organization (audit organization) that keeps the third private key are provided with an individual identification information pre-registration receiving means 14 that receives pre-registration of server-registered individual identification information to the server, the individual identification information having at least the telephone number of an individual's communication terminal 40 (when the communication terminal 40 is a telephone communication device such as a smartphone) and the biometric authentication information of the individual acquired by a biometric authentication information acquisition means provided in the individual's communication terminal 40, and the server 50 of the first other organization (third-party organization/company) that keeps the second private key and the server 60 of the second other organization (audit organization) that keeps the third private key, and the server-registered individual identification information that has been pre-registered via the individual identification information pre-registration receiving means 14 is transmitted to the first private key management/signature means 1. and an identity verification means 15 having at least the function of comparing the server-registered individual identifying information with the first individual identifying information transmitted from the first private key management and signature means 11, and permitting login to the second private key management and signature means 12 or the third private key storage means 13 of the server if the two pieces of individual identifying information match, and disallowing login to the second private key management and signature means 12 or the third private key storage means 13 of the server if they do not match. Therefore, even if an individual's first private key is stolen along with a communication terminal 40 such as a smartphone, the identity verification means 15 compares the server-registered individual identifying information with the first individual identifying information transmitted from the first private key management and signature means 11, and does not permit login to the second private key management and signature means 12 of the server with the first individual identifying information whose biometric authentication information is information about another person (who has stolen the first private key along with the communication terminal 40 such as a smartphone).
As a result, in a transaction in which a portion of a string to be signed has been signed with the first private key, the second private key management and signing means 12 does not sign the remaining portion of the string to be signed, preventing the transaction from being broadcast to the blockchain and preventing the theft of the digital assets of the individual who owns the first private key.

Furthermore, according to the private key operation simplification system of this embodiment, the first private key management/signature means 11 creates at least three private keys, at least three public keys paired with each of the private keys, and an address from one public key, while the second private key management/signature means 12 is provided in a server 50 of a first other organization (third-party organization/company) that holds the second private key, and the third private key storage means 13 is provided in a server 60 that is separated from the shared network of a second other organization (auditory organization) that holds the third private key. Therefore, if any of the private keys is destroyed or stolen, a new address can be created and a transaction can be signed with the remaining two private keys, and then operation can be switched to and restored using the new address.
For example, as described above, if the owner of the first private key loses the first private key due to loss or damage of a communication terminal such as a smartphone, the owner creates a new address and then transfers all of the digital assets in the old address to the new address using the old second private key and the old third private key.

And, according to the private key management simplification system of this embodiment, the first private key management/signature means 11 is provided in the personal communication terminal 40, and the biometric authentication information constituting the first personal identification information that the personal identification means 15 compares with the server-registered personal identification information for personal identification can be easily acquired by the biometric authentication information acquisition means provided in the communication terminal. Moreover, as described above, even if the private key is stolen, theft of digital assets can be prevented. Therefore, while using the private key, an individual can instantly perform processes such as transferring digital assets via signing a transaction using the first private key without being aware of the theft of the private key.

In addition, according to the private key operation simplification system of this embodiment, the server 50 of the first other organization (third-party organization/company) that holds the second private key and the server 60 of the second other organization (audit organization) that holds the third private key are provided with a communication area pre-registration acceptance means 17 that accepts pre-registration of an individual's communication area to the server, and the personal identification means 15 is provided with a GPS (Global Positioning System) of the individual's communication terminal 40. The system further has a function of acquiring location information by using the GPS or communication base information, and a function of comparing the acquired location information of the personal communication terminal 40 by GPS or the like with the personal communication area pre-registered via the communication area pre-registration receiving means 17, and disallowing login to the second private key management and signature means 12 or the third private key storage means 13 of the server if the location information of the personal communication terminal 40 by GPS or the like is outside the personal communication area. Therefore, even if the personal first private key is stolen together with the communication terminal 40 such as a smartphone and the biometric authentication information (e.g., fingerprint) is copied, if the communication from the other person who stole the personal first private key together with the communication terminal 40 such as a smartphone and copied the biometric authentication information (e.g., fingerprint) is outside the communication area, for example, overseas, login to the second private key management and signature means 12 of the server can be disallowed, and the theft prevention effect of digital assets can be further strengthened when the personal first private key and the communication terminal 40 such as a smartphone are stolen.

In addition, according to the private key management simplification system of this embodiment, the biometric authentication information acquired by the biometric authentication information acquisition means is made up of at least one of face, fingerprint, iris, vein, or voiceprint, so that the biometric authentication information in the personal identification information used for identity verification is realized. Furthermore, by combining multiple pieces of biometric authentication information, the matching conditions for the personal identification information when the identity verification means 15 compares the server-registered personal identification information with the first personal identification information become stricter, and the effect of preventing theft of digital assets due to theft of private keys, etc. can be further strengthened.

In addition, according to the private key management simplification system of this embodiment, the first personal identification information further includes an authentication code for the individual, and the personal identification information pre-registration acceptance means 14 is configured to further accept the pre-registration of the authentication code for the individual as part of the server-registered personal identification information. This makes the matching conditions for the personal identification information stricter when the identity verification means 15 compares the server-registered personal identification information with the first personal identification information, thereby making it possible to further enhance the effect of preventing theft of digital assets due to theft of private keys, etc.

In addition, in the private key management simplification system of this embodiment, the personal authentication code is made up of at least one of information known only to the person, such as a password or a secret question, and thus the personal authentication code in the personal identification information used for identity verification is embodied. Furthermore, by combining multiple personal authentication codes, the matching conditions for the personal identification information when the identity verification means 15 compares the server-registered personal identification information with the first personal identification information become stricter, making it possible to further enhance the effect of preventing theft of digital assets due to theft of private keys, etc.

In addition, according to the private key management simplification system of this embodiment, the server equipped with the second private key management/signature means 12 is configured to be isolated from the shared network, so that the risk of theft of the second private key in the server equipped with the second private key management/signature means 12 can be reduced as much as possible.

Therefore, according to this embodiment, a private key management simplification system is obtained that eliminates the risk of digital asset theft associated with the theft of private keys through cyber attacks, etc., and allows digital assets to be used even if an individual loses their private key, significantly reducing the management burden of individuals' private keys.

Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to the above-described embodiments, and various modifications and substitutions can be made to the above-described embodiments without departing from the scope of the present invention.

The private key management simplification system of the present invention is useful in fields that handle transactions using digital assets, such as precious metals, non-ferrous metals, energy such as oil, gas, and electricity, storable agricultural products such as rice and sugar, art, and drinking water, which are widely sold, as well as other items whose economic value is expressed digitally.

REFERENCE SIGNS LIST 11 First private key management and signature means 12 Second private key management and signature means 13 Third private key storage means 14 Personal identification information advance registration acceptance means 15 Identity verification means 16 Signed transaction approval smart contract 17 Communication available area advance registration acceptance means 40 Personal communication terminal (such as a smartphone) 50 Server of first other organization (third-party organization/company) 60 Server of second other organization (auditory organization)

Claims (6)

A system that is constructed including at least one distributed ledger in distributed technology such as blockchain for managing transactions between any form of digital assets, such as tokens (a general term for values defined digitally in distributed technology such as blockchain), digital currencies, tokens and digital currencies, or between tokens or between digital currencies, and a smart contract or server application for performing predetermined processing using the digital assets managed in the distributed ledger, and that simplifies the operation of a private key in a public key cryptography system that signs transactions that form processing data for digital assets,
a first private key management and signature means provided in an individual's communication terminal and having a function of creating at least three private keys, at least three public keys paired with the respective private keys, and an address from one of the public keys; a function of creating a transaction in an environment separated from the shared network and signing a part of a character string to be signed to the transaction with a first private key of the at least three private keys; a function of communicating with a server of a first other institution that holds the second private key via a dedicated API and transmitting first individual identifying information having at least the telephone number (when the communication terminal is a telephone communication device such as a smartphone) of the individual's communication terminal (a device including a smartphone or a personal computer with a WEB-based function that connects to a shared network such as an Internet service, and including all of the functions of a smartphone that implements a wallet function for managing address information (private keys)) and biometric authentication information acquired by a biometric authentication information acquisition means provided in the individual's communication terminal;
a second private key management and signature means, which is provided in a server of a first third party institution that holds the second private key, and which communicates with the individual's communication terminal via a dedicated API in an environment that is separated from a shared network, and has a function of receiving a login via the first individual identifying information transmitted from the first private key management and signature means, receiving a transaction in which a part of a character string to be signed has been signed with the first private key, and signing the remaining part of the character string to be signed with the second private key to the transaction;
a third private key storage means provided in a server separated from the shared network of the second third party institution that keeps the third private key, and that stores the third private key;
a personal identification information pre-registration receiving means provided in the first server of the other organization that holds the second private key and the second server of the other organization that holds the third private key, which receives pre-registration of server-registered personal identification information to the server, the server-registered personal identification information including at least a telephone number of an individual's communication terminal (when the communication terminal is a telephone communication device such as a smartphone) and the individual's biometric authentication information acquired by a biometric authentication information acquisition means provided in the individual's communication terminal;
an identity verification means provided in the server of the first other organization that holds the second private key and the server of the second other organization that holds the third private key, the identity verification means having at least a function of comparing the server-registered personal identification information pre-registered via the personal identification information pre-registration receiving means with the first personal identification information transmitted from the first private key management and signature means, and permitting login to the second private key management and signature means or the third private key storage means of the server if the two pieces of personal identification information match, and disallowing login to the second private key management and signature means or the third private key storage means of the server if they do not match;
a smart contract for approving signed transactions, the smart contract having a function of causing a computer to execute a process of permitting broadcasting of a transaction signed with any two of the three private keys to the blockchain and disallowing broadcasting of a transaction signed with only one private key to the blockchain;
A private key management simplification system comprising at least the above. a communication area pre-registration accepting unit that is provided in a server of a first other organization that holds the second private key and a server of a second other organization that holds the third private key and that accepts pre-registration of the communication area of the individual to said server;
The identity verification means is
A function of acquiring location information by using the personal communication device's GPS (Global Positioning System) or information on communication points, etc.;
The private key operation simplification system of claim 1, further comprising a function of comparing the acquired location information of the personal communication terminal using GPS or the like with the communication area of the personal pre-registered via the communication area pre-registration reception means, and disallowing login to the second private key management/signature means or the third private key storage means of the server if the location information of the personal communication terminal using GPS or the like is outside the communication area of the personal. The private key operation simplification system according to claim 1 or 2, characterized in that the biometric authentication information acquired by the biometric authentication information acquisition means is at least one of face, iris, fingerprint, vein, and voiceprint. The first personally identifying information further comprises an authentication code of the individual;
A private key management simplification system as described in any one of claims 1 to 3, characterized in that the personal identification information pre-registration acceptance means further accepts pre-registration of the individual's authentication code as part of the server-registered personal identification information. The private key management simplification system according to claim 4, characterized in that the personal authentication code is at least one of information known only to the person, such as a password or a secret question. The private key management simplification system according to any one of claims 1 to 5, characterized in that the server equipped with the second private key management and signature means is separated from the shared network.

Images