Service provision system

1 . A service provision system comprising:

a plurality of first devices of a plurality of users, each of the plurality of first devices providing verifiable credentials (VCs) verifiable as being of each one of the plurality of users; and

a plurality of second devices configured to provide a service to each one of the plurality of first devices via a network using multi-party computation (MPC) as a secret calculation in which each one VC of the VCs is divided into a plurality of shares by a secret sharing method and each of the plurality of shares is arranged in the plurality of second devices, the plurality of second devices being in an isolated state, wherein each one of the plurality of second devices perform calculation while maintaining secrecy of the VCs while performing communication with others of the plurality of second devices via the network to obtain a calculation result,

wherein at least one of the plurality of first devices comprises:

a VC storage unit that stores VC of a respective user;

a share provision unit configured to acquire the VC from the VC storage unit, divides the VC into the plurality of shares by the secret sharing method, and distributes each of the plurality of shares to the plurality of second devices, wherein the VC includes privacy information to be calculated and identity (ID) information for identifying the respective user, each one of the plurality of shares includes a share of the privacy information and a share of the ID information,

wherein at least one of the plurality of second devices comprises:

a share acquisition unit configured to acquire one share of the plurality of shares of the VC distributed from the at least one of the plurality of first devices;

a verification processing unit configured to verify, by performing the MPC between the plurality of second devices, whether the share of the ID information of the VC acquired by the share acquisition unit matches a share of the ID information in at least one other VC of the plurality of VCs, and group a plurality of shares of the privacy information in VCs having shares of the ID information matching the share of the ID information of the VC acquired by the share acquisition unit and issues a group ID;

a share storage unit that stores the group ID and information related to the share of the ID information; and

a first group synchronization unit configured to return information including the group ID to the at least one of the plurality of first devices,

wherein the at least one of the plurality of first devices further comprises:

a second group synchronization unit configured to acquire information of the group ID related to the VC returned from the at least one of the plurality of second device; and

an ID storage unit that stores the information of the group ID,

wherein the second group synchronization unit of the at least one of the plurality of first devices is further configured to decrypt a predetermined secret calculation result of the privacy information related to the service from the at least one of the plurality of second devices by the secret sharing method on a basis of the group ID and acquire decrypted predetermined secret calculation result, and

wherein the share provision unit of the at least one of the plurality of first devices separates the privacy information and non-privacy information in the VC, divides the non-privacy information into a plurality of shares in a state of being in a plaintext by the secret sharing method, concatenates one of the plurality of shares with the non-privacy information, and concatenates each share other than the one of the plurality of shares with plaintext, the plaintext is the same size as the non-privacy information in the state of being in the plaintext and does not affect decryption of the VC by the secret sharing method.

2 . The service provision system according to claim 1 , wherein

the non-privacy information includes format information in the VC, and

the verification processing unit of the at least one of the second devices verifies that, for at least one of the plurality of shares of the VC distributed from the at least one of the plurality of first devices, the privacy information included in the at least one share is data related to an element defined in the format information.

3 . The service provision system according to claim 1 , wherein at least one VC of the VCs satisfies all of the following conditions:

(1) there is an issuer responsible for issuing the at least one VC, and a digital signature is added as a means for proving that the at least one VC is issued by the issuer;

(2) the VC includes the ID information for identifying the respective user;

(3) the at least one VC issued is structured data or a set of the structured data, and the at least one VC is restorable when meta information assigned to each element is given even if a format and elements are separated;

(4) a storage location of the ID information is uniquely determined in structured data;

(5) the at least one VC includes information that uniquely determines a digital signature algorithm and a public key acquisition method; and

(6) the digital signature has been performed for the structured data or entire set of the structured data at a time.

4 . The service provision system according to claim 1 , wherein the ID information is a wallet address in a blockchain.

5 . The service provision system according to claim 1 , wherein a communication between the at least one of the plurality of first devices and each one of the plurality of second devices uses a communication means capable of concealing a connection path.