System, method, and information processing apparatus

Patent metadata

Field	Value
Publication number	US-2024305621-A1
Application number	US-202418594118-A
Country	US
Kind code	A1
Filing date	Mar 4, 2024
Priority date	Mar 8, 2023
Publication date	Sep 12, 2024
Grant date	—

Abstract

A system includes a plurality of service providing servers, a plurality of data holding servers, and a platform server. The platform server acquires, for a first user, a graph having an account as a node, a first linkage between accounts at different service providing servers as a first edge, and a second linkage between an account at the service providing server and an account at the data holding server as a second edge. The platform server notify, when it is possible to reach a second account of a first user at a first data holding server from a first account of the first user at a first service providing server by tracing one or more first edges and one second edge, the first service providing server of information enabling the first service providing server to acquire data corresponding to the second account from the first data holding server.

First claim

What is claimed is:

1 . A system comprising:
a plurality of service providing servers that provide services; a plurality of data holding servers that hold data; and a processor configured to:
acquire a graph created for a first user, the graph having an account as a node, a first linkage set between accounts at different service providing servers as a first edge, and a second linkage set between an account at a service providing server and an account at a data holding server as a second edge; and
notify, when it is possible to reach a second account of a first user at a first data holding server from a first account of the first user at a first service providing server by tracing one or more first edges and one second edge in the graph, the first service providing server of first information enabling the first service providing server to acquire data corresponding to the second account from the first data holding server.

2 . The system according to claim 1 , wherein
the processor notifies the first service providing server of a third account of the first user at a second service providing server as the first information, the third account being able to be reached, in the graph for the first user, from the first account of the first user at the first service providing server by tracing one or more first edges and connected to the second account at the first data holding server by the second edge, and the first service providing server notifies the first data holding server of the third account at the second service providing server to acquire data corresponding to the second account from the first data holding server.

3 . The system according to claim 1 , wherein
each of the plurality of service providing servers holds, for an account of the first user, first linkage information regarding the first linkage with an account at another service providing server, and second linkage information regarding the second linkage with an account at a data holding server, the processor acquires the first linkage information and the second linkage information from the plurality of service providing servers to create the graph, the first linkage information includes two pieces of identification information of two service providing servers between which the first linkage for a user is set and two pieces of account information of the user at the two service providing servers, and the second linkage information includes identification information of a service providing server in which the second linkage for a user is set, account information of the user at the service providing server, and identification information of a data holding server in which the second linkage for the user with the service providing server is set.

4 . The system according to claim 2 , wherein
the processor: notifies the first information when it is determined that second information indicating that comprehensive consent is obtained from the first user is held in the second service providing server at which the third account of the first user exists, the comprehensive consent indicating that the first user allows another service providing server to acquire, by using the third account, data corresponding to an account of the first user at a data holding server in which the second linkage with the third account is set, and the third account being able to be reached, in the graph for the first user, from the first account of the first user at the first service providing server by tracing one or more first edges and connected to the second account at the first data holding server by the second edge, and does not notify the first information when it is determined that the second information is not held in the second service providing server.

5 . The system according to claim 4 , further comprising an authorization server configured to perform authorization corresponding to the second service providing server,
wherein the authorization server issues an access token associated with the second information to a terminal of the first user, the first service providing server transmits the access token together with a request for notification of the first information when receiving an access accompanied by the access token from the terminal of the first user, and the processor transmits a request for verification of the access token to the authorization server, when the access token is received from the first service providing server together with the request for notification of the first information, and determines whether the second information is held in the second service providing server based on a response from the authorization server to the request for verification.

6 . The system according to claim 1 , wherein
the processor is provided in an information processing apparatus that is independent of the plurality of service providing servers and the plurality of data holding servers.

7 . The system according to of claim 1 , wherein
the processor is provided in each of the plurality of service providing servers or in each of a plurality of information processing apparatuses including the plurality of service providing servers and the plurality of data holding servers.

8 . The system according to claim 7 , wherein
each of the plurality of service providing servers and each of the plurality of information processing apparatuses including the processor acquires the graph from a blockchain, and the plurality of service providing servers create a block including information on difference of the graph generated by addition or deletion of the first linkage or the second linkage, and add the block to the blockchain.

9 . A method executed by a computer, comprising:
acquiring a graph created for a first user, the graph having, as a node, an account at each of a plurality of service providing servers that provide services and a plurality of data holding servers that hold data, a first linkage set between accounts at different service providing servers as a first edge, and a second linkage set between an account at a service providing server and an account at a data holding server as a second edge; and notifying, when it is possible to reach a second account of a first user at a first data holding server from a first account of the first user at a first service providing server by tracing one or more first edges and one second edge in the graph, the first service providing server of first information enabling the first service providing server to acquire data corresponding to the second account from the first data holding server.

10 . The method according to claim 9 , wherein
the computer notifies the first service providing server of a third account of the first user at a second service providing server as the first information, the third account being able to be reached, in the graph for the first user, from the first account of the first user at the first service providing server by tracing one or more first edges and connected to the second account at the first data holding server by the second edge, and the first service providing server notifies the first data holding server of the third account at the second service providing server to acquire data corresponding to the second account from the first data holding server.

11 . The method according to claim 9 , wherein
each of the plurality of service providing servers holds, for an account of the first user, first linkage information regarding the first linkage with an account at another service providing server, and second linkage information regarding the second linkage with an account at a data holding server, the computer acquires the first linkage i

Assignees

• Toyota Motor Co Ltd

Inventors

• Nakatani sho
• Murata Kenichi

Classifications

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/40

  Network security protocols · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title