Presentation Ohyama - e

Introduction of new ID number
and my portal for checking access logs
NICSS: Next generation IC card System Study group
Tokyo Institute of Technology
ASIST: Advanced research center for Social
Information Science and Technology
Prof. Nagaaki OHYAMA
C
Copyright 東京工業大学大山永昭
1
Updated ICT strategy
•
Issued in July, 2010
•
Main issue is an introduction of new ID number for every
citizen living in Japan
•
Three major objectives
•
①
Realization of citizen centric e-Government
②
Reactivation of local communities
③
Investment in worldwide new market
Objectives are essentially very similar to the former strategy,
although terms are different
C
Copyright 東京工業大学大山永昭
2
Introduction of new ID number
•
On 31st , Jan., 2011 Japanese government party issued “Basic
policy for introduction of new ID number”.
•
Cabinet office, together with IT strategic headquarter, is making
an implementation scheme  institutional and technical WGs
were organized in Jan., 2011.
•
Plan to issue the new ID number from 1st, Jun., 2014
•
Start to use the new ID number from 1st , Jan., 2015 in practice
•
New regulation was proposed to the parliament on 14th of May,
2012 and is under discussion
C
Copyright 東京工業大学大山永昭
3
Major discussion items
•
Visible or invisible ?
–
Visible means the third private party could handle with the new ID number
•
ID number for national pension can be used among employee, employer and national pension
bureau  private - private - public
–
Invisible means the third private party is prohibited to use the new ID number
•
Resident registration number is allowed to use between individual and government only by
regulation  private - public
•
Restricted or not ?
–
Primary purpose of the new ID number is taxation  visible number
–
ID number for national pension is used in limited area in effective
–
The new ID number will be used in much wider area, because of its purpose
–
The new ID number cannot be used to link privacy data as a matching key in
any case except for the administrative businesses listed in the regulation
C
Copyright 東京工業大学大山永昭
4
Major discussion items
•
Use of ID number; flat or sectral model
–
Flat model; unique ID number in all areas and no restriction on its use
–
Sectral model; each area uses different ID number and their link is
restricted, known as Austrian model
–
•
Leading opinion insists on Quasi-sectral model
Quasi-sectral model
–
The use of new ID number is limited to taxation and social
security areas; exclusive use.
–
Health, medical and care areas may use different ID number.
C
Copyright 東京工業大学大山永昭
5
Other discussion items
•
How the new ID number could contribute to the
realization of one-stop service for e-Government
•
Industry side insists on that the new ID number should be
just like SSN in USA; private sector can use the new ID
number without restriction  this requirement is hardly
fulfilled for the moment in Japan
C
Copyright 東京工業大学大山永昭
6
Introduction of new ID number
• The new ID number is nicknamed by “my number”.
• Because “my number” will be used widely in Japan, the
following actions will be taken
– The use of new ID number is strictly restricted by new regulation: it
can be used only in Taxation and Social security areas except for
health and medical care fields
– Privacy data could be linked in only cases explicitly stated in the new
regulation  116 administrative works are listed up
– Third party committee will be officially established for reinforcement
of privacy protection
C
Copyright 東京工業大学大山永昭
7
New infrastructure
• In conjunction with “new ICT strategy”, one stop service for
e-Government needs to be implemented
• Because of much respect to the social acceptance, new basic
infrastructure is now under design; requirements are following
– Introduction of link code; go-between system  No additional
matching key
– My portal for visualization of access log of the privacy data; when, why,
what, from which organization to where and the basis, etc.
– All administrative processes mentioned in regulations will be listed in
white  keep the transparency
C
Copyright 東京工業大学大山永昭
8
Concept of link code : personal basis
My portal
Link code A
New ID #
Personal data A
IC card
National ID#
Link code P
Link code A
Link code B
Resident registration
code
・
・
・
・
・
Link code X
Link system using pseudonym
Agencies in tax and
social security area
Link code B
Internal ID #
Personal data B
Local government
Link code X
internal ID #
Personal data X
Private sector
C
Copyright 東京工業大学大山永昭
9
Link system
• Three major functions supported by the link system
1.
Conversion of the link codes
2.
Access control of the link system  compliance with the new regulation
3.
Storage of access log  people could check all access log to their own
privacy data through my portal
•
Business process flow
–
Used to register the administrative work flow to the white list
–
Defined by, for example, the subset of BPMN （Business Process
Management Notation）
–
Standardization and conformance test will be necessary
C
Copyright 東京工業大学大山永昭
10
Business Process Flow; A needs IB and IC kept by B and C, respectively
Regist.
of event
A
refistration of
event、 BP-ID
Link system
B
C
Activate
sub-process
EV-ID
Reg. of BPID, issue
EV-ID
Activate
sub-process
BPF end
Log
BP-ID,
LA
EV-ID、
LA、
C、IC
EV-ID、
LA、
B、IB
Execute
sub-process
（A-B)
Execute
sub-process
（A-C)
Record log
prepare α
prepare β
Sub process
C
Copyright 東京工業大学大山永昭
Relevant activities
• In addition to the new regulation under draft, current
regulations concerning resident registration and JPKI are
under revision
• Fundamental elements already available are
– Resident registration card  ID card with IC chip
– Personal authentication service  digital signature for non-
repudiation
C
Copyright 東京工業大学大山永昭
12
Resident registration cards
• Resident registration law was revised in Aug., 1999
• This card is issued on request of residents
• The total number of issued RR cards is 5.5 M since
Aug., 2003, 8 years
• In order to improve the security level, RRC vs2.0 is
under design supporting SHA256 and RSA 2048 bit
• New IC card will be the access key to my portal
• My number card will be owned by everyone  130M
C
Copyright 東京工業大学大山永昭
13
Personal authentication service: JPKI
• Personal authentication law
– This regulation was approved by the parliament on 6, Dec.,
2002.
– By this law, all local governments started RA service to the
residents from 29th Jan., 2004.
– By this law, e-government services, which require the
digital signature such as tax declaration, were launched.
– Use of this service is voluntary, not compulsory.
– The total number of issuance is about 2 M  more users
are needed
C
Copyright 東京工業大学大山永昭
14
Revised JPKI under plan
• Restrictions of current JPKI by institution
– CRL is not disclosed to private sector
– JPKI supports only non-repudiation; digital
signature
– Public key certificate includes 4 personal
information: name, registered address, birth date,
gender
C
Copyright 東京工業大学大山永昭
15
Expansion of JPKI service under plan
• Expansion to the authorized private sector
– Covering social security area especially private hospitals
and clinics
• Additional certificate for authentication
– Logical link to the corresponding certificate for nonrepudiation
– Only name, possibly pseudonym, will be written in the
certificate for authentication
C
Copyright 東京工業大学大山永昭
16
Summary
• New ID number for taxation and national pension will be
introduced in 2014
• Resident registration card will be upgraded to “my number card”
• Personal authentication service will be expanded to the social
security area
• RR card together with JPKI will support IAS (Identification,
Authentication, Digital signature) to be fully functional eID in
Japan
• Experimental study will be achieved in 2012
• Use of facial photos is under plan in case of disasters for
identification of sufferers for government and social security
business
C
Copyright 東京工業大学大山永昭
17

Download Report