WO2017168573A1 - Authentication system using position information, authentication device and authentication management server - Google Patents
Authentication system using position information, authentication device and authentication management server Download PDFInfo
- Publication number
- WO2017168573A1 WO2017168573A1 PCT/JP2016/060157 JP2016060157W WO2017168573A1 WO 2017168573 A1 WO2017168573 A1 WO 2017168573A1 JP 2016060157 W JP2016060157 W JP 2016060157W WO 2017168573 A1 WO2017168573 A1 WO 2017168573A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- authentication
- information
- management server
- identification information
- time
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
Definitions
- the present invention relates to an authentication system, an authentication apparatus, and an authentication management server using position information, and more particularly to a technique for performing authentication based on position information.
- lockable transport containers are used. By storing and transporting the article in a lockable transport container, it is possible to avoid the risk of the article being stolen, lost, or leaked during the transportation, and to reliably deliver the article from the transportation source to the transportation destination.
- the IC card is distributed to the consignor and the consignee, and the lock command and the unlock command are issued to the transport container by performing a collation determination using the consignor information and the consignee information of the IC card.
- a transport container management system is known (for example, see Patent Document 1).
- the card reader / writer installed at each of the shipping place and the receiving place stores the sender designation information and the recipient designation information in the storage means.
- the card reader / writer at the shipping place reads the sender specific information from the IC card of the shipper and compares it with the sender specification information in the storage means, and generates a locking command when it is determined that they match.
- the card reader / writer at the consignment location reads the consignee identification information from the IC card of the consignee, compares it with the consignee designation information in the storage means, and generates an unlocking command when they are determined to match. Unlock the electronic lock.
- locking information and unlocking information are electronically managed by a center device at a location different from the transportation source and transportation destination, and the shipper and consignee respectively send locking / unlocking requests to the center device via the Internet.
- a locking / unlocking control system that transmits locking information and unlocking information from a center device to a transport container by notification (see, for example, Patent Document 2).
- the center device when the lock request information is input from the shipper's shipping terminal, the center device refers to the database, and the customer ID of the shipper is registered or the password matches. Whether the customer ID of the recipient is registered, or the case terminal ID of the delivery container used for delivery is registered. If the lock request information matches the information stored in the database, the center device generates a password set for the electric lock of the delivery container. Further, the center device sends a locking instruction signal including the generated personal identification number to the case terminal of the delivery container to give a locking instruction.
- the center device when the unlocking request information is input from the receiving terminal of the recipient, the center device refers to the database, and the customer receives whether the customer ID of the recipient is registered or the password matches. It is verified whether or not it is specified by the person. If the unlock request information matches the information stored in the database, the center device transmits an unlock instruction signal including a password to the case terminal specified by the case terminal ID to unlock the case terminal. Give instructions.
- Patent Document 1 cannot exclude the possibility of unauthorized access to a package due to loss or theft of a physical IC card storing information used for unlocking.
- the sender and the recipient use the identification information (customer ID and password) to access the center apparatus and input the lock request or unlock request information. I have to. For this reason, the possibility of unauthorized access to the package due to theft or forgery of identification information cannot be excluded.
- a transport container management system that does not require a physical IC card or identification information of the shipper and consignee is known (for example, see Patent Document 3).
- position information of a transport destination where the key mechanism of the transport container is to be unlocked is stored in advance in the storage means. Then, at the time of the unlocking operation of the key mechanism, the location information of the transport destination stored in the storage means and the current location information detected by the position detection means are collated to check whether these location information matches. If it is determined that they match, the key mechanism is instructed to be unlocked.
- authentication designated point time data including a package tag ID number, package delivery destination designation position coordinate data, delivery destination designation time data, and a package receipt in advance are stored in the IC card memory of the delivery person. It records password encryption data obtained by encrypting a recipient authentication password known to the person.
- the IC card receives and encrypts the recipient authentication password from the recipient, The recipient is authenticated by comparing it with the password encryption data.
- the traveling position of the transport vehicle is confirmed through the position confirmation device, and the traveling position is transmitted to the information center.
- an ID such as a password is issued for the first time when the transport vehicle arrives at the destination, and when the ID is registered in the locking / unlocking control unit, the ID is notified to the consignee by telephone or fax at that time, A state where unlocking is possible by inputting an ID from a person.
- the present invention has been made to solve such a problem.
- unauthorized authentication can be more reliably prevented and security can be enhanced.
- security can be enhanced.
- the authentication device receives first authentication information including position information and first identification information transmitted from an information transmission device installed at a fixed location.
- the first authentication process is performed in the authentication management server by collating with the second authentication information stored in the authentication management server.
- the second identification information transmitted from the authentication management server to the authentication device and the first identification information transmitted from the information transmission device are collated.
- the authentication apparatus performs the second authentication process.
- the first authentication process in the authentication management server determines whether or not the authentication device is present at the correct location where authentication is permitted, based on the position information, and the identification information. The legitimacy of is determined. Furthermore, when the authentication is successful in the first authentication process, the validity of the identification information is determined again by the second authentication process executed in the authentication apparatus after the first authentication process.
- the authentication process based on the combination of the position information and the identification information is not only performed once, but the authentication process based on the identification information is further performed after the authentication process. For this reason, even if the forged position information and the forged identification information are simply transmitted once and received by the authentication device, the authentication cannot be succeeded by itself. Thereby, in an authentication system that performs authentication based on position information, unauthorized authentication can be more reliably prevented and security can be enhanced.
- FIG. 1 is a diagram illustrating an overall configuration example of an authentication system using position information according to the first embodiment.
- the authentication system of the present embodiment locks the transport container by authenticating it at the transport source and unlocking the transport container by authenticating it at the transport destination when the goods are stored in the transportable container and transported. It is something to lock.
- the authorized fixed locations established the information transmission apparatus 100 -1 as transport source, installed on the authorized fixed locations were as transport destination information
- a transmission device 100 -2 , a transport container 200 incorporating an authentication device, and an authentication management server 300 installed in a remote management center or the like are provided, and information transmitted from the information transmission devices 100 -1 and 100 -2 is used. Based on authentication.
- the information transmission devices 100 -1 and 100 -2 each include position information (for example, longitude / latitude information and ID information for specifying a position) indicating a fixed place that is permitted as a transportation source that performs shipping and a transportation destination that performs cargo reception.
- Predetermined first identification information (for example, a device ID unique to the device itself) is transmitted.
- the information transmission devices 100 -1 and 100 -2 always transmit the position information and the first identification information at regular time intervals.
- the position information is obtained by using, for example, an indoor positioning technology “IMES (Indoor MEssaging System)”.
- the information transmission device is referred to as a location information transmission device, and the first identification information is referred to as device ID-1. Further, the location information transmission devices 100 -1 and 100 -2 of the transportation source and the transportation destination are simply referred to as the positional information transmission device 100.
- the transport container 200 is for storing articles and information (eg, articles such as valuables) that require secure authentication with high safety and reliability, and has a built-in authentication device.
- the authentication device has a function of performing wireless communication with the location information transmitting device 100 and communicating with the authentication management server 300 via a communication network such as the Internet.
- the authentication device cooperates with the authentication management server 300 to authenticate whether the transport container 200 is allowed to be locked / unlocked.
- the authentication apparatus uses authentication information (hereinafter referred to as first authentication information) including the position information and device ID-1 received from the position information transmitting device 100 and a transport container ID, which will be described later, as the authentication management server 300. Send to. Further, the authentication device performs second authentication processing described later based on second identification information (described later) sent from the authentication management server 300.
- the authentication management server 300 cooperates with an authentication device built in the transport container 200 to authenticate whether or not to permit the locking / unlocking of the transport container 200. Specifically, the authentication management server 300 stores the information (position information, device ID-1 and transport container ID) on the location information transmission devices 100 -1 and 100 -2 of the transport source and the transport destination and the transport container 200 as the second information. It is managed as authentication information. The authentication management server 300 performs a first authentication process described later based on the second authentication information and the first authentication information sent from the authentication device.
- the second authentication process is performed by the authentication device of the transport container 200.
- the position information, device ID-1 and transport container ID transmitted as the first authentication information from the transport container 200 are the position information stored in advance as the second authentication information by the authentication management server 300,
- the first authentication is performed by checking whether the device ID-1 and the transport container ID match.
- the authentication management server 300 transmits the second identification information (hereinafter referred to as device ID-2) to the authentication device of the transport container 200.
- the device ID-2 transmitted here is the device ID-1 received as part of the first authentication information from the authentication device of the transport container 200 by the authentication management server 300.
- the authentication management server 300 uses this device ID-1 as a part of the first authentication information. It transmits to the authentication apparatus of the transport container 200 as device ID-2 for 2nd authentication.
- the authentication device performs authentication (second authentication) by checking whether or not the device ID-2 sent from the authentication management server 300 matches the device ID-1 received again from the location information transmission device 100. )I do.
- the transport container 200 can be locked or unlocked.
- the authentication management server 300 transmits a locking command together with the device ID-2 to the transportation container 200, and when the second authentication with the transportation container 200 is successful, the authentication command is made usable.
- the authentication management server 300 transmits the unlock command together with the device ID-2 to the transport container 200, and when the second authentication with the transport container 200 is successful, the unlock command can be used. To do.
- FIG. 2 is a block diagram illustrating a functional configuration example provided in each of the location information transmission device 100, the transport container 200, and the authentication management server 300 according to the first embodiment.
- Each functional block provided in each of the position information transmitting device 100, the transport container 200, and the authentication management server 300 can be configured by any of hardware, DSP (Digital Signal Processor), and software.
- DSP Digital Signal Processor
- each functional block is actually configured with a CPU, RAM, ROM, etc. of a computer, and a program stored in a recording medium such as a RAM, ROM, hard disk, or semiconductor memory operates. It is realized by.
- the location information transmission device 100 includes a first authentication information transmission unit 11 as a functional configuration.
- the transport container 200 includes an authentication device 201 and an electronic key device 202.
- the authentication apparatus 201 includes a first authentication information transmission / reception unit 21, a second identification information reception unit 22, and a second authentication processing unit 23 as functional configurations.
- the electronic key device 202 includes a locking / unlocking instruction unit 24 and a key processing unit 25 as its functional configuration.
- the authentication management server 300 includes a first authentication information reception unit 31, a first authentication processing unit 32, an elapsed time determination unit 33, and a second identification information transmission unit 34 as its functional configuration.
- the authentication management server 300 includes a second authentication information storage unit 30.
- the first authentication information transmitting unit 11 of the position information transmitting device 100 transmits position information indicating a fixed location and device ID-1 as information constituting a part of the first authentication information.
- the first authentication information transmitter 11 constantly transmits the position information and the device ID-1 at regular time intervals.
- the first authentication information transmission unit 11 performs positional information (for example, longitude and latitude using IMES) indicating the location of the transportation source. Information) and a device ID-1 unique to the device itself. Further, in the case of the location information transmission device 100 -2 installed at a location permitted as a transport destination, the first authentication information transmission unit 11 includes location information indicating the location of the transport destination and a device ID unique to the own device. Send 1 and. Device ID-1 is a fixed ID whose value does not change each time a call is made.
- the first authentication information transmitting / receiving unit 21 of the authentication device 201 provided in the transport container 200 receives the position information and the device ID-1 transmitted from the first authentication information transmitting unit 11 of the position information transmitting device 100 by wireless communication.
- the first authentication information transmitting / receiving unit 21 configures the first authentication information by adding the transport container ID unique to the transport container 200 to the received position information and device ID-1, and the first authentication information is And transmitted to the authentication management server 300 via the Internet.
- the transport container ID of the transport container 200 is stored in advance in a memory (not shown) of the authentication device 201.
- the first authentication information transmitting / receiving unit 21 supplies the device ID-1 received from the location information transmitting device 100 to the second authentication processing unit 23.
- the first authentication information receiving unit 31 of the authentication management server 300 receives the first authentication information transmitted from the first authentication information transmitting / receiving unit 21 of the authentication device 201 (position information and device ID-1 of the position information transmitting device 100 and the transport container). 200 transport container ID).
- the second authentication information storage unit 30 stores the second authentication information including the position information indicating the location of the transport source and the transport destination permitting the authentication, the device ID-1 of the position information transmitting device 100, and the transport container ID of the transport container 200.
- the second authentication information storage unit 30 uses the transport container 200 from which location to ship and receives the location in accordance with the transport plan that defines the location used for authentication at the transport source.
- the second authentication information including the information, the device ID-1 and the transport container ID is stored, and the second authentication information including the position information used for authentication at the transport destination, the device ID-1 and the transport container ID is stored.
- the second authentication information storage unit 30 transmits the device ID-2 to the authentication device 201 when the transport container 200 arrives (having a certain time width) with respect to the transport destination.
- the time zone (having a certain time width) is further stored.
- the arrival time zone is a planned value of a time zone during which the authentication management server 300 receives the first authentication information including the device ID-1 from the authentication device 201 of the transport container 200.
- the transmission time zone is a planned value of the time zone for transmitting the device ID-2 set at a timing later than the arrival time zone by a certain time.
- the first authentication information is transmitted from the authentication device 201 to the authentication management server 300 at that time, and the authentication management server 300 performs the first authentication process. If the first authentication is successful, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 in the subsequent transmission time zone, and the authentication device 201 performs the second authentication process. If the first authentication information is transmitted to the authentication management server 300 at a time other than the arrival time zone, the authentication fails.
- the correct installation place where the arrived transport container 200 should be placed is provided at the transport destination.
- This correct installation location is set in a wireless communication area in which the position information transmitted from the position information transmitting device 100 and the device ID-1 can be received.
- the transport container 200 arrives at the transport destination and enters the wireless communication area of the position information transmitting device 100, the first authentication information is transmitted from the authentication device 201 to the authentication management server 300 at that time, and the first authentication process is performed. . Thereafter, the transport container 200 is transported to the correct installation location, and when a predetermined time has elapsed since the first authentication was successful, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201, and the second authentication processing is performed. Done.
- the time from when the transport container 200 arrives and the first authentication information is transmitted to the authentication management server 300 until the authentication management server 300 transmits the device ID-2 to the transport container 200 is zero. But there is a case. In this case, the device ID-2 may be transmitted immediately after the first authentication process without causing a time difference between the arrival time zone and the transmission time zone.
- the first authentication processing unit 32 compares the first authentication information received by the first authentication information receiving unit 31 with the second authentication information stored in the second authentication information storage unit 30 to perform the first authentication. Do. That is, the first authentication processing unit 32 includes the position information, device ID-1 and transport container ID included in the first authentication information, and the position information, device ID-1 and transport included in the second authentication information. It is determined whether or not the container IDs match each other. If all match, the authentication is successful, and if there is even one difference, the authentication is failed. By performing the first authentication process, it is possible to confirm whether or not the transportation from the transportation source as planned to the transportation destination is correctly performed using the transportation container 200 as planned.
- the elapsed time determination unit 33 determines whether or not a predetermined time has elapsed since the first authentication process was performed.
- the second identification information transmission unit 34 transmits the device ID-2 to the authentication apparatus 201 when the first authentication by the first authentication processing unit 32 is successful.
- the second identification information transmission unit 34 transmits the device ID-1 used in the first authentication process by the first authentication processing unit 32 to the authentication apparatus 201 as the device ID-2.
- the second identification information transmission unit 34 does not immediately transmit the device ID-2 to the authentication device 201 when the first authentication by the first authentication processing unit 32 is successful, but the elapsed time determination unit 33. Is transmitted when it is determined that a predetermined time has passed. Normally, the authentication process is completed in a short time. However, when the first authentication process is completed, the authentication process in the authentication apparatus 201 and the first authentication process in the authentication management server 201 is performed by waiting for a predetermined time. The second authentication process is intentionally executed with a time difference.
- the second identification information transmission unit 34 also transmits a locking command or an unlocking command when transmitting the device ID-2 to the authentication device 201.
- the second identification information transmitting unit 34 transmits the device ID-2 and the lock command to the authentication device 201.
- the second identification information transmission unit 34 transmits the device ID-2 and the unlock command to the authentication device 201.
- the second identification information receiving unit 22 of the authentication apparatus 201 receives the device ID-2 and the lock / unlock command transmitted from the second identification information transmission unit 34 of the authentication management server 300.
- the second authentication processing unit 23 collates the device ID-1 received by the first authentication information transmitting / receiving unit 21 with the device ID-2 received by the second identification information receiving unit 22, and performs the second authentication process. Do.
- the device ID-1 is newly received by the first authentication information transmitting / receiving unit 21 at the timing when the second identification information receiving unit 22 receives the device ID-2 from the authentication management server 300.
- the second authentication processing unit 23 determines whether or not the device ID-1 received by the first authentication information transmitting / receiving unit 21 and the device ID-2 received by the second identification information receiving unit 22 match. If it does, authentication is successful. If they do not match, authentication fails. By performing the second authentication process by the second authentication processing unit 23, after receiving the first authentication at the correct location of the transport source or the transport destination, the transport container 200 continues to the correct location even after a predetermined time has elapsed. Whether or not exists.
- the second identification information receiving unit 22 receives the lock command or the unlock command received from the authentication management server 300 by the lock / unlock instruction of the electronic key device 202. To the unit 24. Upon receiving this locking command or unlocking command, the locking / unlocking instruction unit 24 of the electronic key device 202 locks or unlocks the electronic key device 202 by giving an execution command to the key processing unit 25.
- FIG. 3 is a flowchart showing an operation example of the authentication apparatus 201 according to the first embodiment configured as described above.
- the flowchart shown in FIG. 3 starts when the authentication apparatus 201 enters the wireless communication area of the location information transmission device 100 and can receive a signal from the location information transmission device 100.
- the first authentication information transmitting / receiving unit 21 determines whether or not the position information and the device ID-1 that are a part of the first authentication information transmitted from the position information transmitting device 100 have been received (step S1).
- the first authentication information transmitting / receiving unit 21 adds the transport container ID to the received position information and the device ID-1 to form the first authentication information.
- the first authentication information is transmitted to the authentication management server 300 (step S2).
- the first authentication information transmission / reception unit 21 is transmitted from the location information transmission device 100.
- the position information and device ID-1 are always received at regular time intervals.
- the second identification information receiving unit 22 determines whether or not the device ID-2 and the lock / unlock command are received from the authentication management server 300 (step S3). If the device ID-2 and the lock / unlock command have not been received, the determination process in step S3 is repeated.
- the first authentication information transmitting / receiving unit 21 transmits the position information and the device ID-1 received from the IMES device 100 to the authentication management server 300 once, the first authentication information transmission / reception unit 21 again from the IMES device 100 before receiving a response from the authentication management server 300. Even if the position information and the device ID-1 are received, it is preferable not to transmit the first authentication information including the transport container ID to the authentication management server 300.
- the second authentication processing unit 23 receives the latest device ID-1 received by the first authentication information transmitting / receiving unit 21. And the device ID-2 received by the second identification information receiving unit 22 are collated and a second authentication process is performed (step S4).
- the second authentication processing unit 23 determines whether or not the second authentication is successful, that is, the device ID-1 received from the location information transmission device 100 matches the device ID-2 received from the authentication management server 300. It is determined whether or not (step S5). Here, if it is determined that the second authentication has failed, the second authentication processing unit 23 discards the locking / unlocking command received from the authentication management server 300 (step S6), and performs the processing of the flowchart shown in FIG. finish.
- the second authentication processing unit 23 transmits the lock / unlock command received from the authentication management server 300 to the lock / unlock instruction unit 24 of the electronic key device 202 ( Step S7).
- an execution command is given from the locking / unlocking instruction unit 24 of the electronic key device 202 to the key processing unit 25, whereby the electronic key device 202 is locked or unlocked.
- FIG. 4 is a flowchart showing an operation example of the authentication management server 300 according to the first embodiment. The process of the flowchart shown in FIG. 4 is always executed while the power of the authentication management server 300 is turned on.
- the first authentication information receiving unit 31 determines whether or not the first authentication information has been received from the authentication device 201 of the transport container 200 (step S11). If the first authentication information has not been received, the determination process in step S11 is repeated.
- the first authentication processing unit 32 stores the first authentication information received by the first authentication information receiving unit 31 and the second authentication information storage unit 30. The first authentication process is performed by comparing the two authentication information (step S12).
- the first authentication processing unit 32 determines whether or not the first authentication is successful, that is, the position information, the device ID-1 and the transport container ID included in the first authentication information received from the authentication device 201, It is determined whether or not the position information, device ID-1 and transport container ID included in the second authentication information stored in the second authentication information storage unit 30 match each other (step S13). Here, it is also determined whether or not the first authentication information has been transmitted within the arrival time zone stored in the second authentication information storage unit 30 as the planned value.
- the processing of the flowchart shown in FIG. 4 is terminated without doing anything.
- the elapsed time determination unit 33 determines whether or not a predetermined time has elapsed since the first authentication processing unit 32 performed the first authentication process (step S14). ). If the predetermined time has not elapsed, the determination process in step S14 is repeated.
- the second identification information transmitting unit 34 uses the device ID-1 used in the first authentication processing by the first authentication processing unit 32.
- the device ID-2 is transmitted to the authentication device 201, and a lock / unlock command is transmitted to the authentication device 201 (step S15). Thereby, the process of the flowchart shown in FIG. 4 is completed.
- FIG. 5 is a diagram illustrating an example of the authentication system according to the first embodiment. Here, an example in which authentication is performed at the transport destination of the transport container 200 is shown.
- a legitimate shipper transports the transport container 200 to the correct transport destination (location indicated by the position information stored as the second authentication information in the second authentication information storage unit 30 of the authentication management server 300 according to the transport plan)
- the correct position information and device ID-1 are transmitted from the position information transmitting device 100-1 installed at the correct transport destination to the transport container 200 (P1), and the correct first authentication information configured by adding the transport container ID is obtained. It is transmitted to the authentication management server 300 (P2).
- the first authentication process is performed in the authentication management server 300 based on the correct first authentication information, and the first authentication is successful (P3).
- the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 of the transport container 200 (P4), the correct device ID-1 and which is received again from the position information transmitting device 100 -1 at that time (P5)
- the authentication device 201 performs the second authentication process.
- the second authentication is also successful (P6), and the transport container 200 is normally unlocked.
- the transport container 200 transmits the first authentication information to the authentication management server 300 because there is no correct location information transmitting device 100-1 there. Can not do it. Therefore, the first authentication process is not performed in the authentication management server 300, and naturally the second authentication process in the authentication apparatus 201 is not performed. Therefore, the transport container 200 cannot be unlocked.
- the authentication management server 300 performs the first authentication process. Although performed, the first authentication fails and the transport container 200 cannot be unlocked.
- the forged position information and Forged first authentication information including device ID-1 is transmitted from the transport container 200 to the authentication management server 300 (P2 '), and the authentication management server 300 performs a first authentication process based on the forged first authentication information. (P3 ′).
- the second authentication information stored in the authentication management server 300 matches the forged first authentication information, the first authentication is successful.
- the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 of the transport container 200 (P4 ').
- an unauthorized third party who does not know that the second authentication process is performed in the authentication apparatus 201 following the first authentication process does not transmit the camouflaged device ID-1 to the transport container 200 again. Therefore, in this case, the second authentication fails and the transport container 200 cannot be unlocked.
- the first authentication information including the position information and the device ID-1 transmitted from the position information transmission device 100 installed at the location of the transportation source and the transportation destination is authenticated.
- the authentication management server 300 performs the first authentication process by collating with the second authentication information transmitted from the apparatus 201 to the authentication management server 300 and stored in the authentication management server 300.
- the device ID-2 transmitted from the authentication management server 300 to the authentication device 201 and the device ID-1 transmitted from the location information transmitting device 100 are By the verification, the authentication device 201 performs the second authentication process.
- the first authentication process in the authentication management server 300 determines whether or not the transport container 200 exists in the correct place where authentication is permitted based on the position information. At the same time, the validity of the identification information is determined. Further, when the authentication is successful in the first authentication process, the validity of the identification information is determined again by the second authentication process executed in the authentication device 201 with a predetermined time difference from the first authentication process. .
- the first authentication process based on the combination of the position information and the identification information is not simply performed once, but the first authentication process is performed with a certain time difference from the first authentication process. 2 The authentication process is further performed. For this reason, even if the forged location information and the forged device ID-1 are simply transmitted once and received by the authentication apparatus 201, the authentication cannot be successful. Accordingly, in an authentication system that performs authentication based on position information, unauthorized authentication due to impersonation of position information and identification information can be more reliably prevented and security can be enhanced.
- FIG. 6 is a block diagram illustrating a functional configuration example of the authentication system according to the second embodiment.
- those given the same reference numerals as those shown in FIG. 2 have the same functions, and therefore redundant description is omitted here.
- the location information transmitting device 100 ′ further includes a one-time ID issuing unit 12 and an ID transmitting unit 13. Further, the location information transmission device 100 ′ includes a first authentication information transmission unit 11 ′ instead of the first authentication information transmission unit 11.
- the authentication management server 300 ′ further includes an ID receiving unit 35. Further, the authentication management server 300 ′ includes a second authentication information storage unit 30 ′ and a second identification information transmission unit 34 ′ instead of the second authentication information storage unit 30 and the second identification information transmission unit 34.
- the one-time ID issuing unit 12 of the location information transmitting device 100 issues a one-time ID whose value varies each time it is issued.
- the one-time ID issuing unit 12 repeatedly issues a one-time ID at a constant time interval.
- the first authentication information transmitting unit 11 ′ uses the one-time ID issued by the one-time ID issuing unit 12 as the first identification information, and always uses the one-time ID and the position information at regular time intervals using wireless communication technology. send.
- the ID transmitting unit 13 transmits the one-time ID issued by the one-time ID issuing unit 12 to the authentication management server 300 'via the Internet each time.
- the one-time ID is preferably transmitted after being encrypted.
- the ID receiving unit 35 of the authentication management server 300 receives the one-time ID transmitted from the location information transmitting device 100'. Then, the received one-time ID is stored in the second authentication information storage unit 30 'as the first identification information in the second authentication information. If the one-time ID is encrypted, it is decrypted and stored in the second authentication information storage unit 30 '.
- the second authentication information storage unit 30 ′ has the same one-time ID (first information as the one-time ID transmitted by the location information transmitting device 100 ′, the location information indicating the location of the transportation source and the destination to be authenticated.
- the second authentication information including the identification information) and the transport container ID of the transport container 200 is updated and stored as needed.
- the first authentication processing unit 32 includes the second authentication information storage unit 30 at the same time t as the first authentication information (including the one-time ID (t)) received by the first authentication information receiving unit 31 at a certain time t.
- the first authentication process is performed by collating the second authentication information (including the one-time ID (t)) stored in '. That is, the first authentication processing unit 32 includes the position information, the one-time ID (t) and the transport container ID included in the first authentication information, the position information included in the second authentication information, and the one-time ID ( It is determined whether or not t) and the transport container ID match, and if all match, authentication is successful, and if there is even one difference, authentication fails.
- the second identification information transmitting unit 34 ′ reads the one-time ID (t + ⁇ ) from the second authentication information storage unit 30 ′ as the second identification information and authenticates it.
- the one-time ID (t + ⁇ ) transmitted here is stored in the second authentication information storage unit 30 ′ when the elapsed time determination unit 33 determines that the predetermined time ⁇ has elapsed since the end of the first authentication process.
- the one-time ID (t + ⁇ ) is a one-time ID having the same value as the one-time ID transmitted by the first authentication information transmitting unit 11 ′ when a predetermined time ⁇ has elapsed since the end of the first authentication process. Time ID.
- the second identification information receiving unit 22 of the authentication device 201 receives the second identification information (one-time ID (t + ⁇ )) and the lock / unlock command transmitted from the second identification information transmission unit 34 ′ of the authentication management server 300 ′. Receive.
- the first authentication information transmitting / receiving unit 21 transmits the same one-time ID (t + ⁇ ) at the same timing as the second identification information receiving unit 22 receives the one-time ID (t + ⁇ ) from the authentication management server 300 ′.
- the wireless communication is received from the device 100 ′.
- the one-time ID (t + ⁇ ) issued by the one-time ID issuing unit 12 at the time t + ⁇ is transmitted to the authentication device 201 by the first authentication information transmitting unit 11 ′, while authentication management is performed by the ID transmitting unit 13.
- the server 300 ′ and stored in the second authentication information storage unit 30 ′ After being transmitted to the server 300 ′ and stored in the second authentication information storage unit 30 ′, it is transmitted from the authentication management server 300 ′ to the authentication device 201 by the second identification information transmission unit 34 ′.
- the reception time has a slight time difference due to communication delay. However, this time difference is sufficiently smaller than the time interval at which the one-time ID issuance unit 12 repeatedly issues the one-time ID, and can be ignored in terms of the synchronization of the one-time ID.
- the second authentication processing unit 23 includes the first identification information (one-time ID (t + ⁇ )) received by the first authentication information transmitting / receiving unit 21 and the second identification information (one-time received by the second identification information receiving unit 22).
- the second authentication process is performed by collating with the time ID (t + ⁇ )). That is, the second authentication processing unit 23 determines whether or not the one-time ID (t + ⁇ ) received from the location information transmission device 100 ′ matches the one-time ID (t + ⁇ ) received from the authentication management server 300 ′. If they match, authentication succeeds, and if they do not match, authentication fails.
- a one-time ID is used as identification information used for the first authentication process in the authentication management server 300 ′ and the second authentication process in the authentication apparatus 201.
- the one-time ID issued by the location information transmission device 100 ′ is used.
- the method of transmitting to the authentication management server 300 ′ has been described, the present invention is not limited to this.
- the authentication management server 300 ' may issue a one-time ID, and the issued one-time ID (which is preferably encrypted) may be transmitted to the IMES device 100' for synchronization.
- the following process may be performed. That is, in the authentication management server 300 ′, until the first authentication information receiving unit 31 receives the first authentication information from the authentication device 201, the one-time ID is issued at a fixed time interval to the position information transmitting device 100 ′. Send from time to time. On the other hand, after the first authentication information receiving unit 31 receives the first authentication information from the authentication device 201, the predetermined time has elapsed after the elapsed time determining unit 33 determines that the predetermined time has passed. The one-time ID is issued only at the timing and transmitted to the position information transmitting device 100 ′.
- the following may be performed to reduce the load. That is, only the location information is transmitted from the location information transmission device 100 ′ at a constant time interval, and the authentication device 201 that receives the location information transmits the location information to the authentication management server 300 ′, and the first authentication information reception unit 31.
- the authentication management server 300 ′ issues the first one-time ID and transmits it to the location information transmission device 100 ′.
- the position information transmission device 100 ′ transmits the position information and the one-time ID to the authentication apparatus 201.
- the first authentication process is performed based on the first authentication information sent from the authentication device 201 to the authentication management server 300 ′.
- the elapsed time determination unit 33 determines that a predetermined time has elapsed.
- the authentication management server 300 ′ issues a second one-time ID and transmits it to the location information transmission device 100 ′.
- the authentication management server 300 ′ first receives only the position information from the authentication device 201, the authentication management server 300 ′ performs authentication using only the position information, and issues the first one-time ID only when the authentication is successful. You may do it.
- the input value used when the one-time ID issuing unit 12 issues the one-time ID is used.
- the one-time ID may be issued from the location information transmitting device 100 ′ to the authentication management server 300 ′, and the authentication management server 300 ′ also uses the same input value.
- the authentication management server 300 ′ transmits an input value to the location information transmission device 100 ′, and both the authentication management server 300 ′ and the location information transmission device 100 ′ issue a one-time ID from the same input value. May be.
- the form for transmitting and synchronizing the input value for issuing the one-time ID is essentially equivalent to the form for transmitting and synchronizing the one-time ID, and is included in the scope of the present invention. .
- the one-time ID may be synchronized offline without performing communication between the location information transmitting device 100 ′ and the authentication management server 300 ′.
- synchronization can be achieved by both the location information transmission device 100 ′ and the authentication management server 300 ′ issuing the same one-time ID in the time synchronization method. That is, the location information transmitting device 100 ′ uses a password issuer called a token to issue a one-time ID whose value changes with time. Then, the location information transmission device 100 ′ transmits a one-time ID, a device ID, and location information.
- the authentication device 201 transmits the first authentication information (one-time ID, position information, and transport container ID) and the device ID to the authentication management server 300 '.
- the authentication management server 300 ′ knows which position information transmission device 100 ′ uses which token and what time ID each token issues at what time. Then, it is included in the first authentication information sent from the authentication device 201 by verifying the time when the first authentication information is sent from the authentication device 201 and the device ID of the position information transmitting device 100 ′. The one-time ID and the one-time ID at the same time known by the authentication management server 300 ′ can be collated.
- the Example in which this invention exhibits an effect is this. It is not limited.
- the transport container 200 is transported to the correct destination, and after the first authentication process is performed using the first authentication information acquired from the correct position information transmission device 100-1 , the transport container 200 is obtained. It is also possible to prevent unauthorized access to move to another location. This is because even if the first authentication in the arrival time zone is successful, the device ID-1 cannot be received again in an unauthorized place in the subsequent transmission time zone, and the second authentication fails.
- the authentication device 201 is applied to the authentication performed when the transport container 200 is locked at the transport source and the transport container 200 is unlocked at the transport destination has been described.
- the present invention is not limited to this.
- a portable information processing terminal capable of positioning such as a mobile smart phone, a tablet terminal, and a wearable terminal, screen display, application activation, and functions of the application
- the authentication by the authentication device 201 may be applied to the execution of the command, and a predetermined execution command may be issued when the authentication is successful.
- a smartphone has the function of the authentication device 201 and performs authentication in cooperation with an application that performs check-in. That is, when a user with a smartphone goes to a specific location (for example, a store or a restaurant) to start an application and presses the check-in button, authentication management is performed for coupons and points sent from the server.
- a specific location for example, a store or a restaurant
- authentication management is performed for coupons and points sent from the server.
- the present invention can also be applied to an embodiment in which the first authentication performed by the server 300 and the second authentication performed by the smartphone are completed at the time of completion.
- the position information transmission device 100, 100 ' is used as the information transmission device and the positional information by IMES is transmitted
- the present invention is not limited to this.
- the position information may be transmitted by GPS (Global Positioning System), Bluetooth (registered trademark), BLE (Bluetooth Low Energy), sound wave, ultrasonic wave, or wireless LAN.
- IMES, Bluetooth (registered trademark), BLE, sound wave, ultrasonic wave, and wireless LAN are preferable to GPS in that they can be used indoors.
- each of the first and second embodiments described above is merely an example of a specific example for carrying out the present invention, and the technical scope of the present invention should not be interpreted in a limited manner. It will not be. That is, the present invention can be implemented in various forms without departing from the gist or the main features thereof.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Lock And Its Accessories (AREA)
Abstract
In the present invention, first authentication information including position information and first identification information transmitted from a position information transmission device 100 are received by an authentication device 201 and transmitted to an authentication management server 300, and are subjected to first authentication processing by comparison against second authentication information stored in a second authentication information storage unit 30. Furthermore, when the first authentication is successful, second authentication processing is performed by comparison between second identification information transmitted from the authentication management server 300 to the authentication device 201 and the first identification information transmitted from the position information transmission device 100. As a result, authentication processing is not just performed one time based on a combination of position information and identification information, but is performed again based on identification information, so that authentication cannot be successful just by causing fake position information and fake identification information to be transmitted and received by the authentication device 201 just one time.
Description
本発明は、位置情報を用いた認証システム、認証装置および認証管理サーバに関し、特に、位置情報に基づいて認証を行う技術に関するものである。
The present invention relates to an authentication system, an authentication apparatus, and an authentication management server using position information, and more particularly to a technique for performing authentication based on position information.
一般に、金銭や貴重品等の物品を輸送する際には、施錠可能な輸送容器が利用される。施錠可能な輸送容器に物品を収納して輸送することにより、輸送途中における物品の盗難、紛失、漏洩等のリスクを回避し、輸送元から輸送先へ物品を確実に届けることが可能となる。
Generally, when transporting items such as money or valuables, lockable transport containers are used. By storing and transporting the article in a lockable transport container, it is possible to avoid the risk of the article being stolen, lost, or leaked during the transportation, and to reliably deliver the article from the transportation source to the transportation destination.
例えば、荷送人と荷受人にICカードを配布し、ICカードの荷送人情報と荷受人情報とを用いて照合判定することにより、施錠指令および解錠指令を輸送容器に対して行うようにした輸送容器管理システムが知られている(例えば、特許文献1参照)。
For example, the IC card is distributed to the consignor and the consignee, and the lock command and the unlock command are issued to the transport container by performing a collation determination using the consignor information and the consignee information of the IC card. A transport container management system is known (for example, see Patent Document 1).
この特許文献1に記載のシステムでは、荷送場所および荷受場所のそれぞれに設置されたカードリーダ/ライタが、荷送人指定情報および荷受人指定情報をそれぞれ記憶手段に記憶する。荷送場所のカードリーダ/ライタは、荷送人のICカードから荷送人特定情報を読み取って記憶手段の荷送人指定情報と比較し、両者が一致と判定したときに施錠指令を生成して電子錠の施錠を行う。また、荷受場所のカードリーダ/ライタは、荷受人のICカードから荷受人特定情報を読み取って記憶手段の荷受人指定情報と比較し、両者が一致と判定したときに解錠指令を生成して電子錠の解錠を行う。
In the system described in Patent Document 1, the card reader / writer installed at each of the shipping place and the receiving place stores the sender designation information and the recipient designation information in the storage means. The card reader / writer at the shipping place reads the sender specific information from the IC card of the shipper and compares it with the sender specification information in the storage means, and generates a locking command when it is determined that they match. To lock the electronic lock. The card reader / writer at the consignment location reads the consignee identification information from the IC card of the consignee, compares it with the consignee designation information in the storage means, and generates an unlocking command when they are determined to match. Unlock the electronic lock.
また、施錠情報および解錠情報を輸送元および輸送先とは別の場所にあるセンタ装置で電子的に管理し、荷送人および荷受人がそれぞれ施錠/解錠要求をインターネット経由でセンタ装置に通知することにより、施錠情報および解錠情報をセンタ装置から輸送容器に送信するようにした施解錠制御システムも知られている(例えば、特許文献2参照)。
In addition, locking information and unlocking information are electronically managed by a center device at a location different from the transportation source and transportation destination, and the shipper and consignee respectively send locking / unlocking requests to the center device via the Internet. There is also known a locking / unlocking control system that transmits locking information and unlocking information from a center device to a transport container by notification (see, for example, Patent Document 2).
この特許文献2に記載のシステムでは、センタ装置は、発送者の発送端末から施錠依頼の情報が入力されると、データベースを参照し、発送者の顧客IDが登録されているか、パスワードが一致するか、受領者の顧客IDが登録されているか、配達に用いる配送容器のケース端末IDが登録されているか否か照合する。そして、施錠依頼情報とデータベースに記憶されている情報とが一致する場合、センタ装置は、配送容器の電気錠に設定される暗証番号を生成する。さらに、センタ装置は、配送容器のケース端末に対し、生成した暗証番号を含む施錠指示信号を送信して施錠指示を行う。
In the system described in Patent Literature 2, when the lock request information is input from the shipper's shipping terminal, the center device refers to the database, and the customer ID of the shipper is registered or the password matches. Whether the customer ID of the recipient is registered, or the case terminal ID of the delivery container used for delivery is registered. If the lock request information matches the information stored in the database, the center device generates a password set for the electric lock of the delivery container. Further, the center device sends a locking instruction signal including the generated personal identification number to the case terminal of the delivery container to give a locking instruction.
同様に、センタ装置は、受領者の受領端末から解錠依頼の情報が入力されると、データベースを参照し、受領者の顧客IDが登録されているか、パスワードが一致するか、その顧客が受領者に指定されているか否かを照合する。そして、解錠依頼情報とデータベースに記憶されている情報とが一致する場合、センタ装置は、ケース端末IDで特定されるケース端末に対し、暗証番号を含む解錠指示信号を送信して解錠指示を行う。
Similarly, when the unlocking request information is input from the receiving terminal of the recipient, the center device refers to the database, and the customer receives whether the customer ID of the recipient is registered or the password matches. It is verified whether or not it is specified by the person. If the unlock request information matches the information stored in the database, the center device transmits an unlock instruction signal including a password to the case terminal specified by the case terminal ID to unlock the case terminal. Give instructions.
なお、上記特許文献1に記載のシステムにおいては、解錠に用いる情報を記憶した物理的なICカードの紛失や盗難などによって荷物へ不正にアクセスされる可能性を排除することはできない。また、上記特許文献2に記載のシステムにおいては、発送者および受領者が自身の識別情報(顧客IDおよびパスワード)を用いてセンタ装置にアクセスし、施錠要求または解錠要求の情報を入力するようにしている。そのため、識別情報の盗難や偽造などによって荷物へ不正にアクセスされる可能性を排除することはできない。
Note that the system described in Patent Document 1 cannot exclude the possibility of unauthorized access to a package due to loss or theft of a physical IC card storing information used for unlocking. In the system described in Patent Document 2, the sender and the recipient use the identification information (customer ID and password) to access the center apparatus and input the lock request or unlock request information. I have to. For this reason, the possibility of unauthorized access to the package due to theft or forgery of identification information cannot be excluded.
一方、物理的なICカードや、荷送人および荷受人の識別情報を必要としない輸送容器管理システムが知られている(例えば、特許文献3参照)。この特許文献3に記載のシステムでは、輸送容器の鍵機構を解錠すべき輸送先の位置情報を記憶手段に予め記憶する。そして、鍵機構の解錠操作時に、記憶手段に記憶されている輸送先の位置情報と、位置検出手段により検出された現在の所在位置情報とを照合してこれらの位置情報が一致するか否かを判定し、一致すると判定された場合に鍵機構の解錠を指示する。
On the other hand, a transport container management system that does not require a physical IC card or identification information of the shipper and consignee is known (for example, see Patent Document 3). In the system described in Patent Document 3, position information of a transport destination where the key mechanism of the transport container is to be unlocked is stored in advance in the storage means. Then, at the time of the unlocking operation of the key mechanism, the location information of the transport destination stored in the storage means and the current location information detected by the position detection means are collated to check whether these location information matches. If it is determined that they match, the key mechanism is instructed to be unlocked.
しかしながら、この特許文献3に記載のシステムでは、位置情報としてGPS信号を用いた場合、現在位置情報の偽造が可能である。したがって、特許文献3に記載のシステムでは、現在位置情報の偽造によって荷物へ不正にアクセスされる可能性を排除することはできない。これに対し、現在位置情報による認証とパスワードによる認証とを組み合わせた技術も提案されている(例えば、特許文献4,5参照)。
However, in the system described in Patent Document 3, the current position information can be forged when a GPS signal is used as the position information. Therefore, the system described in Patent Document 3 cannot eliminate the possibility of unauthorized access to the package due to forgery of the current position information. On the other hand, a technique combining authentication based on current position information and authentication based on a password has been proposed (see, for example, Patent Documents 4 and 5).
特許文献4に記載のシステムでは、配達員のICカードのメモリに対し、荷物のタグID番号、荷物の届け先指定位置座標データ、届け先指定時刻データからなる認証指定地点時刻データと、予め荷物の受取人に知らされている受取人認証用パスワードを暗号化したパスワード暗号データとを記録する。そして、荷物を受取人に届けた地点と時刻を表すGPS位置座標データと時刻データが、認証指定地点時刻データに一致した場合に、ICカードが受取人から受取人認証用パスワードを受け取り暗号化し、パスワード暗号データと比較することで受取人を認証する。
In the system described in Patent Document 4, authentication designated point time data including a package tag ID number, package delivery destination designation position coordinate data, delivery destination designation time data, and a package receipt in advance are stored in the IC card memory of the delivery person. It records password encryption data obtained by encrypting a recipient authentication password known to the person. When the GPS position coordinate data and the time data representing the point and time at which the package is delivered to the recipient match the authentication designated point time data, the IC card receives and encrypts the recipient authentication password from the recipient, The recipient is authenticated by comparing it with the password encryption data.
また、特許文献5に記載のシステムでは、位置確認装置を通じて輸送車の走行位置を確認し、この走行位置を情報センタに送信する。情報センタでは、輸送車が目的地に到着した時点で初めてパスワード等のIDを発行し、施解錠制御部においてIDを登録すると当時に、当該IDを荷受人に電話またはFAX等により連絡し、荷受人からのIDの入力により解錠が可能な状態とする。
In the system described in Patent Document 5, the traveling position of the transport vehicle is confirmed through the position confirmation device, and the traveling position is transmitted to the information center. At the information center, an ID such as a password is issued for the first time when the transport vehicle arrives at the destination, and when the ID is registered in the locking / unlocking control unit, the ID is notified to the consignee by telephone or fax at that time, A state where unlocking is possible by inputting an ID from a person.
上記特許文献4,5に記載のシステムによれば、GPS信号等の現在位置情報の偽造が行われても、正しいパスワードを入力しなければ、荷物へアクセスすることはできない。この点で、単に現在位置情報のみを用いて認証を行う特許文献3の技術に比べて、セキュリティを強化することができる。しかしながら、現在位置情報の偽造に加えてパスワードの偽造も行われると、荷物へ不正にアクセスされることを防ぐことができないという問題があった。
According to the systems described in Patent Documents 4 and 5, even if the current position information such as GPS signals is forged, the baggage cannot be accessed unless the correct password is entered. In this respect, security can be enhanced compared to the technique of Patent Document 3 in which authentication is performed using only current position information. However, if the password is forged in addition to the current position information, unauthorized access to the package cannot be prevented.
本発明は、このような問題を解決するために成されたものであり、位置情報に基づいて認証を行う認証システムにおいて、不正な認証をより確実に防止して、セキュリティを強化できるようにすることを目的とする。
The present invention has been made to solve such a problem. In an authentication system that performs authentication based on position information, unauthorized authentication can be more reliably prevented and security can be enhanced. For the purpose.
上記した課題を解決するために、本発明の認証システムでは、固定の場所に設置された情報発信装置から発信される位置情報および第1識別情報を含む第1認証情報を、認証装置で受信して認証管理サーバに送信し、認証管理サーバに記憶されている第2認証情報との照合により、認証管理サーバにおいて第1認証処理を行う。さらに、本発明の認証システムでは、第1認証に成功した場合に認証管理サーバから認証装置に送信される第2識別情報と、上記情報発信装置から発信される第1識別情報との照合により、認証装置において第2認証処理を行うようにしている。
In order to solve the above-described problem, in the authentication system of the present invention, the authentication device receives first authentication information including position information and first identification information transmitted from an information transmission device installed at a fixed location. The first authentication process is performed in the authentication management server by collating with the second authentication information stored in the authentication management server. Further, in the authentication system of the present invention, when the first authentication is successful, the second identification information transmitted from the authentication management server to the authentication device and the first identification information transmitted from the information transmission device are collated. The authentication apparatus performs the second authentication process.
上記のように構成した本発明によれば、認証管理サーバにおける第1認証処理により、認証を許可する正しい場所に認証装置が存在するか否かが位置情報に基づいて判定されるとともに、識別情報の正当性が判定される。さらに、この第1認証処理において認証が成功となった場合に、当該第1認証処理の後に認証装置において実行される第2認証処理により、識別情報の正当性が再度判定される。
According to the present invention configured as described above, the first authentication process in the authentication management server determines whether or not the authentication device is present at the correct location where authentication is permitted, based on the position information, and the identification information. The legitimacy of is determined. Furthermore, when the authentication is successful in the first authentication process, the validity of the identification information is determined again by the second authentication process executed in the authentication apparatus after the first authentication process.
このように、本発明によれば、位置情報と識別情報との組み合わせによる認証処理が単に1回行われるだけでなく、その認証処理の後に識別情報による認証処理がさらに行われる。このため、偽造した位置情報と偽造した識別情報とを単に1回発信させて認証装置に受信させても、それだけでは認証を成功させることはできない。これにより、位置情報に基づいて認証を行う認証システムにおいて、不正な認証をより確実に防止して、セキュリティを強化することができる。
Thus, according to the present invention, the authentication process based on the combination of the position information and the identification information is not only performed once, but the authentication process based on the identification information is further performed after the authentication process. For this reason, even if the forged position information and the forged identification information are simply transmitted once and received by the authentication device, the authentication cannot be succeeded by itself. Thereby, in an authentication system that performs authentication based on position information, unauthorized authentication can be more reliably prevented and security can be enhanced.
(第1の実施形態)
以下、本発明による第1の実施形態を図面に基づいて説明する。図1は、第1の実施形態による位置情報を用いた認証システムの全体構成例を示す図である。本実施形態の認証システムは、施錠可能な輸送容器に物品を収納して輸送する際に、輸送元で認証を行うことによって輸送容器を施錠し、輸送先で認証を行うことによって輸送容器を解錠するものである。 (First embodiment)
DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, a first embodiment of the invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating an overall configuration example of an authentication system using position information according to the first embodiment. The authentication system of the present embodiment locks the transport container by authenticating it at the transport source and unlocking the transport container by authenticating it at the transport destination when the goods are stored in the transportable container and transported. It is something to lock.
以下、本発明による第1の実施形態を図面に基づいて説明する。図1は、第1の実施形態による位置情報を用いた認証システムの全体構成例を示す図である。本実施形態の認証システムは、施錠可能な輸送容器に物品を収納して輸送する際に、輸送元で認証を行うことによって輸送容器を施錠し、輸送先で認証を行うことによって輸送容器を解錠するものである。 (First embodiment)
DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, a first embodiment of the invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating an overall configuration example of an authentication system using position information according to the first embodiment. The authentication system of the present embodiment locks the transport container by authenticating it at the transport source and unlocking the transport container by authenticating it at the transport destination when the goods are stored in the transportable container and transported. It is something to lock.
図1に示すように、本実施形態の認証システムは、輸送元として許可された固定の場所に設置された情報発信装置100-1と、輸送先として許可された固定の場所に設置された情報発信装置100-2と、認証装置を内蔵した輸送容器200と、遠隔の管理センタ等に設置された認証管理サーバ300とを備え、情報発信装置100-1,100-2から発信される情報に基づいて認証を行うように成されている。
As shown in FIG. 1, the authentication system of this embodiment, the authorized fixed locations established the information transmission apparatus 100 -1 as transport source, installed on the authorized fixed locations were as transport destination information A transmission device 100 -2 , a transport container 200 incorporating an authentication device, and an authentication management server 300 installed in a remote management center or the like are provided, and information transmitted from the information transmission devices 100 -1 and 100 -2 is used. Based on authentication.
情報発信装置100-1,100-2は、荷送を行う輸送元および荷受を行う輸送先として許可された固定の場所を表す位置情報(例えば、経緯度情報や位置を特定するID情報)と、所定の第1識別情報(例えば、自装置に固有のデバイスID)とを発信する。情報発信装置100-1,100-2は、この位置情報および第1識別情報を一定の時間間隔で常時発信している。ここで、位置情報は、例えば、屋内測位技術「IMES(Indoor MEssaging System)」を利用して取得されるものである。
The information transmission devices 100 -1 and 100 -2 each include position information (for example, longitude / latitude information and ID information for specifying a position) indicating a fixed place that is permitted as a transportation source that performs shipping and a transportation destination that performs cargo reception. , Predetermined first identification information (for example, a device ID unique to the device itself) is transmitted. The information transmission devices 100 -1 and 100 -2 always transmit the position information and the first identification information at regular time intervals. Here, the position information is obtained by using, for example, an indoor positioning technology “IMES (Indoor MEssaging System)”.
なお、以下では、情報発信装置を位置情報発信デバイスと呼び、第1識別情報をデバイスID-1と呼ぶことにする。また、輸送元および輸送先の位置情報発信デバイス100-1,100-2を単に位置情報発信デバイス100と総称する。
In the following, the information transmission device is referred to as a location information transmission device, and the first identification information is referred to as device ID-1. Further, the location information transmission devices 100 -1 and 100 -2 of the transportation source and the transportation destination are simply referred to as the positional information transmission device 100.
輸送容器200は、安全性および信頼性の高いセキュアな認証を必要とする物品や情報(例えば、貴重品等の物品)を保管するためのものであり、認証装置を内蔵している。認証装置は、位置情報発信デバイス100との間で無線通信を行うとともに、認証管理サーバ300との間でインターネット等の通信ネットワークを介して通信する機能を有している。
The transport container 200 is for storing articles and information (eg, articles such as valuables) that require secure authentication with high safety and reliability, and has a built-in authentication device. The authentication device has a function of performing wireless communication with the location information transmitting device 100 and communicating with the authentication management server 300 via a communication network such as the Internet.
また、認証装置は、認証管理サーバ300と協働して、輸送容器200の施錠/解錠を許可するか否かの認証を行う。具体的には、認証装置は、位置情報発信デバイス100から受信した位置情報およびデバイスID-1と、後述する輸送容器IDとを含む認証情報(以下、第1認証情報という)を認証管理サーバ300に送信する。また、認証装置は、認証管理サーバ300から送られてくる第2識別情報(後述する)に基づいて、後述する第2認証処理を行う。
In addition, the authentication device cooperates with the authentication management server 300 to authenticate whether the transport container 200 is allowed to be locked / unlocked. Specifically, the authentication apparatus uses authentication information (hereinafter referred to as first authentication information) including the position information and device ID-1 received from the position information transmitting device 100 and a transport container ID, which will be described later, as the authentication management server 300. Send to. Further, the authentication device performs second authentication processing described later based on second identification information (described later) sent from the authentication management server 300.
認証管理サーバ300は、輸送容器200に内蔵された認証装置と協働して、輸送容器200の施錠/解錠を許可するか否かの認証を行う。具体的には、認証管理サーバ300は、輸送元と輸送先の位置情報発信デバイス100-1,100-2および輸送容器200に関する情報(位置情報、デバイスID-1および輸送容器ID)を第2認証情報として管理している。認証管理サーバ300は、この第2認証情報と、認証装置から送られてくる第1認証情報とに基づいて、後述する第1認証処理を行う。
The authentication management server 300 cooperates with an authentication device built in the transport container 200 to authenticate whether or not to permit the locking / unlocking of the transport container 200. Specifically, the authentication management server 300 stores the information (position information, device ID-1 and transport container ID) on the location information transmission devices 100 -1 and 100 -2 of the transport source and the transport destination and the transport container 200 as the second information. It is managed as authentication information. The authentication management server 300 performs a first authentication process described later based on the second authentication information and the first authentication information sent from the authentication device.
このように、第1の実施形態では、認証管理サーバ300で行う第1認証処理に加え、輸送容器200の認証装置で第2認証処理を行う点を大きな特徴としている。認証管理サーバ300では、輸送容器200から第1認証情報として送信されてくる位置情報、デバイスID-1および輸送容器IDが、認証管理サーバ300があらかじめ第2認証情報として記憶している位置情報、デバイスID-1および輸送容器IDと一致するか否かを照合することによって第1認証を行う。
Thus, in the first embodiment, in addition to the first authentication process performed by the authentication management server 300, the second authentication process is performed by the authentication device of the transport container 200. In the authentication management server 300, the position information, device ID-1 and transport container ID transmitted as the first authentication information from the transport container 200 are the position information stored in advance as the second authentication information by the authentication management server 300, The first authentication is performed by checking whether the device ID-1 and the transport container ID match.
認証管理サーバ300での第1認証に成功すると、認証管理サーバ300は、第2識別情報(以下、デバイスID-2という)を輸送容器200の認証装置に送信する。ここで送信するデバイスID-2は、認証管理サーバ300が輸送容器200の認証装置から第1認証情報の一部として受信したデバイスID-1であり、認証管理サーバ300はこのデバイスID-1を第2認証のためにデバイスID-2として輸送容器200の認証装置に送信する。認証装置は、認証管理サーバ300から送られてくるデバイスID-2と、位置情報発信デバイス100から再び受信されるデバイスID-1とが一致するか否かを照合することによって認証(第2認証)を行う。
If the first authentication in the authentication management server 300 is successful, the authentication management server 300 transmits the second identification information (hereinafter referred to as device ID-2) to the authentication device of the transport container 200. The device ID-2 transmitted here is the device ID-1 received as part of the first authentication information from the authentication device of the transport container 200 by the authentication management server 300. The authentication management server 300 uses this device ID-1 as a part of the first authentication information. It transmits to the authentication apparatus of the transport container 200 as device ID-2 for 2nd authentication. The authentication device performs authentication (second authentication) by checking whether or not the device ID-2 sent from the authentication management server 300 matches the device ID-1 received again from the location information transmission device 100. )I do.
本実施形態では、認証管理サーバ300での第1認証に続いて、輸送容器200の認証装置での第2認証に成功した場合に、輸送容器200の施錠または解錠が可能な状態となる。例えば、輸送元の場合、認証管理サーバ300はデバイスID-2と共に施錠コマンドを輸送容器200に送信し、輸送容器200での第2認証に成功した場合に、施錠コマンドを使える状態にする。輸送先の場合も同様に、認証管理サーバ300はデバイスID-2と共に解錠コマンドを輸送容器200に送信し、輸送容器200での第2認証に成功した場合に、解錠コマンドを使える状態にする。
In this embodiment, following the first authentication in the authentication management server 300, when the second authentication by the authentication device of the transport container 200 is successful, the transport container 200 can be locked or unlocked. For example, in the case of a transportation source, the authentication management server 300 transmits a locking command together with the device ID-2 to the transportation container 200, and when the second authentication with the transportation container 200 is successful, the authentication command is made usable. Similarly, in the case of the transport destination, the authentication management server 300 transmits the unlock command together with the device ID-2 to the transport container 200, and when the second authentication with the transport container 200 is successful, the unlock command can be used. To do.
図2は、第1の実施形態による位置情報発信デバイス100、輸送容器200および認証管理サーバ300がそれぞれ備える機能構成例を示すブロック図である。なお、位置情報発信デバイス100、輸送容器200および認証管理サーバ300がそれぞれ備える各機能ブロックは、ハードウェア、DSP(Digital Signal Processor)、ソフトウェアの何れによっても構成することが可能である。例えばソフトウェアによって構成する場合、各機能ブロックは、実際にはコンピュータのCPU、RAM、ROMなどを備えて構成され、RAMやROM、ハードディスクまたは半導体メモリ等の記録媒体に記憶されたプログラムが動作することによって実現される。
FIG. 2 is a block diagram illustrating a functional configuration example provided in each of the location information transmission device 100, the transport container 200, and the authentication management server 300 according to the first embodiment. Each functional block provided in each of the position information transmitting device 100, the transport container 200, and the authentication management server 300 can be configured by any of hardware, DSP (Digital Signal Processor), and software. For example, when configured by software, each functional block is actually configured with a CPU, RAM, ROM, etc. of a computer, and a program stored in a recording medium such as a RAM, ROM, hard disk, or semiconductor memory operates. It is realized by.
図2に示すように、位置情報発信デバイス100は、その機能構成として、第1認証情報発信部11を備えている。
As shown in FIG. 2, the location information transmission device 100 includes a first authentication information transmission unit 11 as a functional configuration.
輸送容器200は、認証装置201および電子鍵装置202を備えている。認証装置201は、その機能構成として、第1認証情報送受信部21、第2識別情報受信部22および第2認証処理部23を備えている。また、電子鍵装置202は、その機能構成として、施錠/解錠指示部24および鍵処理部25を備えている。
The transport container 200 includes an authentication device 201 and an electronic key device 202. The authentication apparatus 201 includes a first authentication information transmission / reception unit 21, a second identification information reception unit 22, and a second authentication processing unit 23 as functional configurations. The electronic key device 202 includes a locking / unlocking instruction unit 24 and a key processing unit 25 as its functional configuration.
認証管理サーバ300は、その機能構成として、第1認証情報受信部31、第1認証処理部32、経過時間判定部33および第2識別情報送信部34を備えている。また、認証管理サーバ300は、第2認証情報記憶部30を備えている。
The authentication management server 300 includes a first authentication information reception unit 31, a first authentication processing unit 32, an elapsed time determination unit 33, and a second identification information transmission unit 34 as its functional configuration. In addition, the authentication management server 300 includes a second authentication information storage unit 30.
位置情報発信デバイス100の第1認証情報発信部11は、第1認証情報の一部を構成する情報として、固定の場所を表す位置情報およびデバイスID-1を発信する。第1認証情報発信部11は、位置情報およびデバイスID-1を一定の時間間隔で常時発信している。
The first authentication information transmitting unit 11 of the position information transmitting device 100 transmits position information indicating a fixed location and device ID-1 as information constituting a part of the first authentication information. The first authentication information transmitter 11 constantly transmits the position information and the device ID-1 at regular time intervals.
ここで、輸送元として許可された場所に設置された位置情報発信デバイス100-1の場合、第1認証情報発信部11は、輸送元の場所を表す位置情報(例えば、IMESを利用した経緯度情報)と、自装置に固有のデバイスID-1とを発信する。また、輸送先として許可された場所に設置された位置情報発信デバイス100-2の場合、第1認証情報発信部11は、輸送先の場所を表す位置情報と、自装置に固有のデバイスID-1とを発信する。デバイスID-1は、発信のたびに値が変わらない固定IDである。
Here, in the case of the location information transmission device 100 -1 installed in a place permitted as a transportation source, the first authentication information transmission unit 11 performs positional information (for example, longitude and latitude using IMES) indicating the location of the transportation source. Information) and a device ID-1 unique to the device itself. Further, in the case of the location information transmission device 100 -2 installed at a location permitted as a transport destination, the first authentication information transmission unit 11 includes location information indicating the location of the transport destination and a device ID unique to the own device. Send 1 and. Device ID-1 is a fixed ID whose value does not change each time a call is made.
輸送容器200が備える認証装置201の第1認証情報送受信部21は、位置情報発信デバイス100の第1認証情報発信部11から発信された位置情報およびデバイスID-1を無線通信により受信する。また、第1認証情報送受信部21は、当該受信した位置情報およびデバイスID-1に対して輸送容器200に固有の輸送容器IDを加えて第1認証情報を構成し、当該第1認証情報を、インターネットを介して認証管理サーバ300に送信する。なお、輸送容器200の輸送容器IDは、認証装置201の図示しないメモリにあらかじめ記憶しておく。
The first authentication information transmitting / receiving unit 21 of the authentication device 201 provided in the transport container 200 receives the position information and the device ID-1 transmitted from the first authentication information transmitting unit 11 of the position information transmitting device 100 by wireless communication. In addition, the first authentication information transmitting / receiving unit 21 configures the first authentication information by adding the transport container ID unique to the transport container 200 to the received position information and device ID-1, and the first authentication information is And transmitted to the authentication management server 300 via the Internet. The transport container ID of the transport container 200 is stored in advance in a memory (not shown) of the authentication device 201.
また、第1認証情報送受信部21は、位置情報発信デバイス100から受信したデバイスID-1を第2認証処理部23に供給する。
Further, the first authentication information transmitting / receiving unit 21 supplies the device ID-1 received from the location information transmitting device 100 to the second authentication processing unit 23.
認証管理サーバ300の第1認証情報受信部31は、認証装置201の第1認証情報送受信部21から送信された第1認証情報(位置情報発信デバイス100の位置情報とデバイスID-1および輸送容器200の輸送容器ID)を受信する。
The first authentication information receiving unit 31 of the authentication management server 300 receives the first authentication information transmitted from the first authentication information transmitting / receiving unit 21 of the authentication device 201 (position information and device ID-1 of the position information transmitting device 100 and the transport container). 200 transport container ID).
第2認証情報記憶部30は、認証を許可する輸送元および輸送先の場所を表す位置情報、位置情報発信デバイス100のデバイスID-1および輸送容器200の輸送容器IDを含む第2認証情報をあらかじめ記憶する。すなわち、第2認証情報記憶部30は、どの輸送容器200を用いてどの場所から荷送を行い、それをどの場所で荷受するかを定めた輸送計画に従って、輸送元での認証に使用する位置情報、デバイスID-1および輸送容器IDを含む第2認証情報を記憶するとともに、輸送先での認証に使用する位置情報、デバイスID-1および輸送容器IDを含む第2認証情報を記憶する。
The second authentication information storage unit 30 stores the second authentication information including the position information indicating the location of the transport source and the transport destination permitting the authentication, the device ID-1 of the position information transmitting device 100, and the transport container ID of the transport container 200. Remember in advance. That is, the second authentication information storage unit 30 uses the transport container 200 from which location to ship and receives the location in accordance with the transport plan that defines the location used for authentication at the transport source. The second authentication information including the information, the device ID-1 and the transport container ID is stored, and the second authentication information including the position information used for authentication at the transport destination, the device ID-1 and the transport container ID is stored.
また、第2認証情報記憶部30は、輸送先に関して、輸送容器200が到着する時間帯(一定の時間幅を有する)と、認証管理サーバ300が認証装置201に対してデバイスID-2を送信する時間帯(一定の時間幅を有する)とを更に記憶している。到着時間帯は、認証管理サーバ300が輸送容器200の認証装置201からデバイスID-1を含む第1認証情報を受信する時間帯の計画値である。一方、送信時間帯は、到着時間帯よりもある時間だけ遅いタイミングに設定された、デバイスID-2を送信する時間帯の計画値である。
Further, the second authentication information storage unit 30 transmits the device ID-2 to the authentication device 201 when the transport container 200 arrives (having a certain time width) with respect to the transport destination. The time zone (having a certain time width) is further stored. The arrival time zone is a planned value of a time zone during which the authentication management server 300 receives the first authentication information including the device ID-1 from the authentication device 201 of the transport container 200. On the other hand, the transmission time zone is a planned value of the time zone for transmitting the device ID-2 set at a timing later than the arrival time zone by a certain time.
輸送容器200が到着時間帯内に輸送先に到着すると、その時点で認証装置201から認証管理サーバ300に第1認証情報が送信されて、認証管理サーバ300にて第1認証処理が行われる。そして、この第1認証に成功すると、その後の送信時間帯において認証管理サーバ300から認証装置201にデバイスID-2が送信されて、認証装置201にて第2認証処理が行われる。なお、到着時間帯以外の時間に第1認証情報が認証管理サーバ300に送信された場合、認証は失敗となる。
When the transport container 200 arrives at the transport destination within the arrival time zone, the first authentication information is transmitted from the authentication device 201 to the authentication management server 300 at that time, and the authentication management server 300 performs the first authentication process. If the first authentication is successful, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 in the subsequent transmission time zone, and the authentication device 201 performs the second authentication process. If the first authentication information is transmitted to the authentication management server 300 at a time other than the arrival time zone, the authentication fails.
すなわち、本実施形態では、輸送先には、到着した輸送容器200を置くべき正しい設置場所が設けられている。この正しい設置場所は、位置情報発信デバイス100から発信される位置情報およびデバイスID-1を受信可能な無線通信圏内に設定されている。輸送容器200が輸送先に到着して位置情報発信デバイス100の無線通信圏内に入ると、その時点で認証装置201から認証管理サーバ300に第1認証情報が送信され、第1認証処理が行われる。その後、輸送容器200が正しい設置場所に運ばれ、第1認証の成功から所定の時間が経過した時点で、認証管理サーバ300から認証装置201にデバイスID-2が送信され、第2認証処理が行われる。
That is, in this embodiment, the correct installation place where the arrived transport container 200 should be placed is provided at the transport destination. This correct installation location is set in a wireless communication area in which the position information transmitted from the position information transmitting device 100 and the device ID-1 can be received. When the transport container 200 arrives at the transport destination and enters the wireless communication area of the position information transmitting device 100, the first authentication information is transmitted from the authentication device 201 to the authentication management server 300 at that time, and the first authentication process is performed. . Thereafter, the transport container 200 is transported to the correct installation location, and when a predetermined time has elapsed since the first authentication was successful, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201, and the second authentication processing is performed. Done.
なお、輸送先によっては、輸送容器200が到着して第1認証情報が認証管理サーバ300に送信されてから、認証管理サーバ300がデバイスID-2を輸送容器200に送信するまでの時間がゼロでもよい場合がある。その場合には、到着時間帯と送信時間帯とに時間差を持たせずに、第1認証処理を行った後すぐにデバイスID-2を送信するようにしてもよい。
Depending on the shipping destination, the time from when the transport container 200 arrives and the first authentication information is transmitted to the authentication management server 300 until the authentication management server 300 transmits the device ID-2 to the transport container 200 is zero. But there is a case. In this case, the device ID-2 may be transmitted immediately after the first authentication process without causing a time difference between the arrival time zone and the transmission time zone.
第1認証処理部32は、第1認証情報受信部31により受信された第1認証情報と、第2認証情報記憶部30に記憶されている第2認証情報とを照合して第1認証を行う。すなわち、第1認証処理部32は、第1認証情報に含まれている位置情報、デバイスID-1および輸送容器IDと、第2認証情報に含まれている位置情報、デバイスID-1および輸送容器IDとがそれぞれ一致するか否かを判定し、全て一致する場合は認証成功、1つでも相違があれば認証失敗とする。この第1認証処理を行うことにより、計画通りの輸送容器200を使って、計画通りの輸送元から輸送先へ輸送が正しく行われているか否かを確認することができる。
The first authentication processing unit 32 compares the first authentication information received by the first authentication information receiving unit 31 with the second authentication information stored in the second authentication information storage unit 30 to perform the first authentication. Do. That is, the first authentication processing unit 32 includes the position information, device ID-1 and transport container ID included in the first authentication information, and the position information, device ID-1 and transport included in the second authentication information. It is determined whether or not the container IDs match each other. If all match, the authentication is successful, and if there is even one difference, the authentication is failed. By performing the first authentication process, it is possible to confirm whether or not the transportation from the transportation source as planned to the transportation destination is correctly performed using the transportation container 200 as planned.
経過時間判定部33は、第1認証処理部32による第1認証が成功した場合、当該第1認証処理を行ってから所定の時間が経過したか否かを判定する。第2識別情報送信部34は、第1認証処理部32による第1認証が成功した場合、デバイスID-2を認証装置201に送信する。本実施形態では、第2識別情報送信部34は、第1認証処理部32による第1認証処理において使用したデバイスID-1を、デバイスID-2として認証装置201に送信する。
When the first authentication by the first authentication processing unit 32 is successful, the elapsed time determination unit 33 determines whether or not a predetermined time has elapsed since the first authentication process was performed. The second identification information transmission unit 34 transmits the device ID-2 to the authentication apparatus 201 when the first authentication by the first authentication processing unit 32 is successful. In the present embodiment, the second identification information transmission unit 34 transmits the device ID-1 used in the first authentication process by the first authentication processing unit 32 to the authentication apparatus 201 as the device ID-2.
ここで、第2識別情報送信部34は、第1認証処理部32による第1認証が成功した場合に、デバイスID-2を直ちに認証装置201に送信するのではなくて、経過時間判定部33により所定の時間が経過したと判定されたときに送信する。通常は、認証処理はわずかな時間で済んでしまうが、第1認証処理が終わったときに所定の時間の経過を待つことにより、認証管理サーバ300での第1認証処理と認証装置201での第2認証処理とを意図的に時間差をもって実行させるようにしている。
Here, the second identification information transmission unit 34 does not immediately transmit the device ID-2 to the authentication device 201 when the first authentication by the first authentication processing unit 32 is successful, but the elapsed time determination unit 33. Is transmitted when it is determined that a predetermined time has passed. Normally, the authentication process is completed in a short time. However, when the first authentication process is completed, the authentication process in the authentication apparatus 201 and the first authentication process in the authentication management server 201 is performed by waiting for a predetermined time. The second authentication process is intentionally executed with a time difference.
このように第1認証処理の実行から第2認証処理の実行まで時間差を持たせているのは、上述のように、輸送容器200が位置情報発信デバイス100の無線通信圏内に入ってから正しい設置場所に運ばれるまでに要する時間を考慮したものである。時間差を持たせることにより、輸送容器200が位置情報発信デバイス100の無線通信圏内に到着してすぐに、第2認証処理まで実行されて解錠されてしまうことを防ぐことができる。つまり、輸送容器200が位置情報発信デバイス100の無線通信圏内に入っても、所定の時間が経過しないと解錠することができないように時間制限をかけることができる。
As described above, there is a time difference from the execution of the first authentication process to the execution of the second authentication process as described above, after the transport container 200 enters the wireless communication area of the position information transmission device 100. It takes into account the time it takes to get to the place. By giving the time difference, it is possible to prevent the transport container 200 from being executed until the second authentication process and being unlocked as soon as it arrives within the wireless communication area of the position information transmitting device 100. In other words, even if the transport container 200 enters the wireless communication area of the position information transmission device 100, a time limit can be imposed so that the container cannot be unlocked until a predetermined time has elapsed.
第2識別情報送信部34は、認証装置201にデバイスID-2を送信する際に、施錠コマンドまたは解錠コマンドも送信する。ここで、輸送元で行われた第1認証処理において認証が成功した場合、第2識別情報送信部34はデバイスID-2と施錠コマンドとを認証装置201に送信する。一方、輸送先で行われた第1認証処理において認証が成功した場合、第2識別情報送信部34はデバイスID-2と解錠コマンドとを認証装置201に送信する。
The second identification information transmission unit 34 also transmits a locking command or an unlocking command when transmitting the device ID-2 to the authentication device 201. Here, when the authentication is successful in the first authentication process performed at the transportation source, the second identification information transmitting unit 34 transmits the device ID-2 and the lock command to the authentication device 201. On the other hand, when the authentication is successful in the first authentication process performed at the transport destination, the second identification information transmission unit 34 transmits the device ID-2 and the unlock command to the authentication device 201.
認証装置201の第2識別情報受信部22は、認証管理サーバ300の第2識別情報送信部34から送信されたデバイスID-2および施錠/解錠コマンドを受信する。
The second identification information receiving unit 22 of the authentication apparatus 201 receives the device ID-2 and the lock / unlock command transmitted from the second identification information transmission unit 34 of the authentication management server 300.
第2認証処理部23は、第1認証情報送受信部21により受信されたデバイスID-1と、第2識別情報受信部22により受信されたデバイスID-2とを照合して第2認証処理を行う。ここで、デバイスID-1は、第2識別情報受信部22が認証管理サーバ300からデバイスID-2を受信したタイミングで第1認証情報送受信部21により新たに受信されるものである。
The second authentication processing unit 23 collates the device ID-1 received by the first authentication information transmitting / receiving unit 21 with the device ID-2 received by the second identification information receiving unit 22, and performs the second authentication process. Do. Here, the device ID-1 is newly received by the first authentication information transmitting / receiving unit 21 at the timing when the second identification information receiving unit 22 receives the device ID-2 from the authentication management server 300.
第2認証処理部23は、第1認証情報送受信部21で受信したデバイスID-1と、第2識別情報受信部22で受信したデバイスID-2とが一致するか否かを判定し、一致する場合は認証成功、一致しない場合は認証失敗とする。この第2認証処理部23による第2認証処理を行うことにより、輸送元または輸送先の正しい場所で第1認証を受けた後、所定の時間を経過した後も引き続きその正しい場所に輸送容器200が存在するか否かを確認することができる。
The second authentication processing unit 23 determines whether or not the device ID-1 received by the first authentication information transmitting / receiving unit 21 and the device ID-2 received by the second identification information receiving unit 22 match. If it does, authentication is successful. If they do not match, authentication fails. By performing the second authentication process by the second authentication processing unit 23, after receiving the first authentication at the correct location of the transport source or the transport destination, the transport container 200 continues to the correct location even after a predetermined time has elapsed. Whether or not exists.
第2認証処理部23は、第2認証に成功した場合、第2識別情報受信部22が認証管理サーバ300から受信していた施錠コマンドまたは解錠コマンドを電子鍵装置202の施錠/解錠指示部24に送信する。電子鍵装置202の施錠/解錠指示部24は、この施錠コマンドまたは解錠コマンドを受けると、鍵処理部25に実行命令を与えることにより、電子鍵装置202の施錠または解錠を行う。
When the second authentication processing unit 23 succeeds in the second authentication, the second identification information receiving unit 22 receives the lock command or the unlock command received from the authentication management server 300 by the lock / unlock instruction of the electronic key device 202. To the unit 24. Upon receiving this locking command or unlocking command, the locking / unlocking instruction unit 24 of the electronic key device 202 locks or unlocks the electronic key device 202 by giving an execution command to the key processing unit 25.
図3は、上記のように構成した第1の実施形態による認証装置201の動作例を示すフローチャートである。この図3に示すフローチャートは、認証装置201が位置情報発信デバイス100の無線通信圏内に入り、位置情報発信デバイス100から信号を受信できるようになった状態のときに開始する。
FIG. 3 is a flowchart showing an operation example of the authentication apparatus 201 according to the first embodiment configured as described above. The flowchart shown in FIG. 3 starts when the authentication apparatus 201 enters the wireless communication area of the location information transmission device 100 and can receive a signal from the location information transmission device 100.
まず、第1認証情報送受信部21は、位置情報発信デバイス100から発信された第1認証情報の一部である位置情報およびデバイスID-1を受信したか否かを判定する(ステップS1)。第1認証情報送受信部21は、位置情報発信デバイス100から位置情報およびデバイスID-1を受信した場合、当該受信した位置情報およびデバイスID-1に輸送容器IDを加えて第1認証情報を構成し、当該第1認証情報を認証管理サーバ300に送信する(ステップS2)。なお、図3のフローチャートでは図示を省略しているが、認証装置201が位置情報発信デバイス100の無線通信圏内に入った後は、第1認証情報送受信部21は位置情報発信デバイス100から発信された位置情報およびデバイスID-1を一定の時間間隔で常時受信する。
First, the first authentication information transmitting / receiving unit 21 determines whether or not the position information and the device ID-1 that are a part of the first authentication information transmitted from the position information transmitting device 100 have been received (step S1). When receiving the position information and the device ID-1 from the position information transmitting device 100, the first authentication information transmitting / receiving unit 21 adds the transport container ID to the received position information and the device ID-1 to form the first authentication information. Then, the first authentication information is transmitted to the authentication management server 300 (step S2). Although not shown in the flowchart of FIG. 3, after the authentication apparatus 201 enters the wireless communication area of the location information transmission device 100, the first authentication information transmission / reception unit 21 is transmitted from the location information transmission device 100. The position information and device ID-1 are always received at regular time intervals.
次に、第2識別情報受信部22は、認証管理サーバ300からデバイスID-2および施錠/解錠コマンドを受信したか否かを判定する(ステップS3)。デバイスID-2および施錠/解錠コマンドを受信していない場合、ステップS3の判定処理を繰り返す。
Next, the second identification information receiving unit 22 determines whether or not the device ID-2 and the lock / unlock command are received from the authentication management server 300 (step S3). If the device ID-2 and the lock / unlock command have not been received, the determination process in step S3 is repeated.
なお、第1認証情報送受信部21がIMESデバイス100から受信した位置情報およびデバイスID-1を一度認証管理サーバ300に送信した後は、認証管理サーバ300から応答がある前にIMESデバイス100から再び位置情報およびデバイスID-1を受信しても、輸送容器IDを加えた第1認証情報を認証管理サーバ300に送信しないようにするのが好ましい。
Note that after the first authentication information transmitting / receiving unit 21 transmits the position information and the device ID-1 received from the IMES device 100 to the authentication management server 300 once, the first authentication information transmission / reception unit 21 again from the IMES device 100 before receiving a response from the authentication management server 300. Even if the position information and the device ID-1 are received, it is preferable not to transmit the first authentication information including the transport container ID to the authentication management server 300.
図3のフローチャートには図示していないが、認証管理サーバ300からデバイスID-2および施錠/解錠コマンドを所定のタイムアウト時間内に受信しない場合、認証管理サーバ300で行われた第1認証に失敗したことを意味する。よって、この場合は、図3に示すフローチャートの処理を終了する。すなわち、輸送容器200の施錠または解錠は行わない。なお、ここではタイムアウト時間を設定する例を説明したが、第1認証に失敗したことを認証管理サーバ300から輸送容器200に通知するようにしてもよい。
Although not shown in the flowchart of FIG. 3, when the device ID-2 and the lock / unlock command are not received from the authentication management server 300 within a predetermined timeout time, the first authentication performed by the authentication management server 300 is performed. Means failure. Therefore, in this case, the process of the flowchart shown in FIG. That is, the transport container 200 is not locked or unlocked. In addition, although the example which sets timeout time was demonstrated here, you may make it notify the shipping container 200 from the authentication management server 300 that 1st authentication failed.
一方、ステップS3で認証管理サーバ300からデバイスID-2および施錠/解錠コマンドを受信した場合、第2認証処理部23は、第1認証情報送受信部21により受信された最新のデバイスID-1と、第2識別情報受信部22により受信されたデバイスID-2とを照合して第2認証処理を行う(ステップS4)。
On the other hand, when the device ID-2 and the lock / unlock command are received from the authentication management server 300 in step S3, the second authentication processing unit 23 receives the latest device ID-1 received by the first authentication information transmitting / receiving unit 21. And the device ID-2 received by the second identification information receiving unit 22 are collated and a second authentication process is performed (step S4).
そして、第2認証処理部23は、第2認証に成功したか否か、すなわち、位置情報発信デバイス100から受信したデバイスID-1と、認証管理サーバ300から受信したデバイスID-2とが一致したか否かを判定する(ステップS5)。ここで、第2認証に失敗したと判定した場合、第2認証処理部23は、認証管理サーバ300から受信した施錠/解錠コマンドを破棄し(ステップS6)、図3に示すフローチャートの処理を終了する。
Then, the second authentication processing unit 23 determines whether or not the second authentication is successful, that is, the device ID-1 received from the location information transmission device 100 matches the device ID-2 received from the authentication management server 300. It is determined whether or not (step S5). Here, if it is determined that the second authentication has failed, the second authentication processing unit 23 discards the locking / unlocking command received from the authentication management server 300 (step S6), and performs the processing of the flowchart shown in FIG. finish.
一方、第2認証に成功したと判定した場合、第2認証処理部23は、認証管理サーバ300から受信した施錠/解錠コマンドを電子鍵装置202の施錠/解錠指示部24に送信する(ステップS7)。これにより、電子鍵装置202の施錠/解錠指示部24から鍵処理部25に実行命令が与えられることにより、電子鍵装置202の施錠または解錠が行われる。そして、図3に示すフローチャートの処理を終了する。
On the other hand, if it is determined that the second authentication is successful, the second authentication processing unit 23 transmits the lock / unlock command received from the authentication management server 300 to the lock / unlock instruction unit 24 of the electronic key device 202 ( Step S7). As a result, an execution command is given from the locking / unlocking instruction unit 24 of the electronic key device 202 to the key processing unit 25, whereby the electronic key device 202 is locked or unlocked. And the process of the flowchart shown in FIG. 3 is complete | finished.
図4は、第1の実施形態による認証管理サーバ300の動作例を示すフローチャートである。この図4に示すフローチャートの処理は、認証管理サーバ300の電源がオンとされている間は常に実行されている。
FIG. 4 is a flowchart showing an operation example of the authentication management server 300 according to the first embodiment. The process of the flowchart shown in FIG. 4 is always executed while the power of the authentication management server 300 is turned on.
まず、第1認証情報受信部31は、輸送容器200の認証装置201から第1認証情報を受信したか否かを判定する(ステップS11)。第1認証情報を受信していない場合は、ステップS11の判定処理を繰り返す。認証装置201から第1認証情報を受信すると、第1認証処理部32は、第1認証情報受信部31により受信された第1認証情報と、第2認証情報記憶部30に記憶されている第2認証情報とを照合して第1認証処理を行う(ステップS12)。
First, the first authentication information receiving unit 31 determines whether or not the first authentication information has been received from the authentication device 201 of the transport container 200 (step S11). If the first authentication information has not been received, the determination process in step S11 is repeated. When receiving the first authentication information from the authentication device 201, the first authentication processing unit 32 stores the first authentication information received by the first authentication information receiving unit 31 and the second authentication information storage unit 30. The first authentication process is performed by comparing the two authentication information (step S12).
そして、第1認証処理部32は、第1認証に成功したか否か、すなわち、認証装置201から受信した第1認証情報に含まれている位置情報、デバイスID-1および輸送容器IDと、第2認証情報記憶部30に記憶されている第2認証情報に含まれている位置情報、デバイスID-1および輸送容器IDとがそれぞれ一致するか否かを判定する(ステップS13)。また、ここでは、計画値として第2認証情報記憶部30に記憶されている到着時間帯内に第1認証情報が送信されてきたか否かについても判定する。
The first authentication processing unit 32 determines whether or not the first authentication is successful, that is, the position information, the device ID-1 and the transport container ID included in the first authentication information received from the authentication device 201, It is determined whether or not the position information, device ID-1 and transport container ID included in the second authentication information stored in the second authentication information storage unit 30 match each other (step S13). Here, it is also determined whether or not the first authentication information has been transmitted within the arrival time zone stored in the second authentication information storage unit 30 as the planned value.
ここで、第1認証に失敗したと判定した場合、特に何もせずに、図4に示すフローチャートの処理を終了する。一方、第1認証に成功したと判定した場合、経過時間判定部33は、第1認証処理部32が第1認証処理を行ってから所定の時間が経過したか否かを判定する(ステップS14)。所定の時間が経過していない場合は、ステップS14の判定処理を繰り返す。
Here, if it is determined that the first authentication has failed, the processing of the flowchart shown in FIG. 4 is terminated without doing anything. On the other hand, when it is determined that the first authentication is successful, the elapsed time determination unit 33 determines whether or not a predetermined time has elapsed since the first authentication processing unit 32 performed the first authentication process (step S14). ). If the predetermined time has not elapsed, the determination process in step S14 is repeated.
第1認証処理部32が第1認証処理を行ってから所定の時間が経過すると、第2識別情報送信部34は、第1認証処理部32による第1認証処理において使用したデバイスID-1をデバイスID-2として認証装置201に送信するとともに、施錠/解錠コマンドを認証装置201に送信する(ステップS15)。これにより、図4に示すフローチャートの処理を終了する。
When a predetermined time has elapsed since the first authentication processing unit 32 performed the first authentication processing, the second identification information transmitting unit 34 uses the device ID-1 used in the first authentication processing by the first authentication processing unit 32. The device ID-2 is transmitted to the authentication device 201, and a lock / unlock command is transmitted to the authentication device 201 (step S15). Thereby, the process of the flowchart shown in FIG. 4 is completed.
図5は、上述した第1の実施形態による認証システムの実施例を示す図である。ここでは、輸送容器200の輸送先で認証を行う場合の例を示している。正当な荷送人が輸送容器200を正しい輸送先(認証管理サーバ300の第2認証情報記憶部30に輸送計画に従って第2認証情報として記憶された位置情報により示される場所)に輸送した場合、その正しい輸送先に設置されている位置情報発信デバイス100-1から輸送容器200に正しい位置情報およびデバイスID-1が送信され(P1)、輸送容器IDを加えて構成した正しい第1認証情報が認証管理サーバ300に送信される(P2)。
FIG. 5 is a diagram illustrating an example of the authentication system according to the first embodiment. Here, an example in which authentication is performed at the transport destination of the transport container 200 is shown. When a legitimate shipper transports the transport container 200 to the correct transport destination (location indicated by the position information stored as the second authentication information in the second authentication information storage unit 30 of the authentication management server 300 according to the transport plan), The correct position information and device ID-1 are transmitted from the position information transmitting device 100-1 installed at the correct transport destination to the transport container 200 (P1), and the correct first authentication information configured by adding the transport container ID is obtained. It is transmitted to the authentication management server 300 (P2).
これにより、正しい第1認証情報に基づいて認証管理サーバ300にて第1認証処理が行われ、第1認証は成功となる(P3)。その後、認証管理サーバ300から輸送容器200の認証装置201にデバイスID-2が送信され(P4)、その時点で位置情報発信デバイス100-1から再び受信される正しいデバイスID-1と(P5)、上記デバイスID-2とに基づいて認証装置201にて第2認証処理が行われる。そして、この第2認証も成功となり(P6)、輸送容器200の解錠が正常に行われる。
Accordingly, the first authentication process is performed in the authentication management server 300 based on the correct first authentication information, and the first authentication is successful (P3). Thereafter, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 of the transport container 200 (P4), the correct device ID-1 and which is received again from the position information transmitting device 100 -1 at that time (P5) Based on the device ID-2, the authentication device 201 performs the second authentication process. Then, the second authentication is also successful (P6), and the transport container 200 is normally unlocked.
一方、不正の第三者が輸送容器200を不正な場所に輸送した場合、そこには正しい位置情報発信デバイス100-1がないので、輸送容器200は第1認証情報を認証管理サーバ300に送信することができない。よって、認証管理サーバ300にて第1認証処理が行われず、当然ながら認証装置201における第2認証処理も行われない。したがって、輸送容器200を解錠することはできない。また、不正の第三者が、認証に第1識別情報が必要であることを知らず、位置情報のみを偽装して輸送容器200に送信した場合は、認証管理サーバ300にて第1認証処理が行われるものの、第1認証は失敗となり、輸送容器200を解錠することはできない。
On the other hand, when an unauthorized third party transports the transport container 200 to an unauthorized place, the transport container 200 transmits the first authentication information to the authentication management server 300 because there is no correct location information transmitting device 100-1 there. Can not do it. Therefore, the first authentication process is not performed in the authentication management server 300, and naturally the second authentication process in the authentication apparatus 201 is not performed. Therefore, the transport container 200 cannot be unlocked. In addition, when an unauthorized third party does not know that the first identification information is necessary for authentication and transmits the information to the transport container 200 by impersonating only the position information, the authentication management server 300 performs the first authentication process. Although performed, the first authentication fails and the transport container 200 cannot be unlocked.
これに対して、不正の第三者が位置情報発信デバイス100’を偽造して、偽造した位置情報およびデバイスID-1を輸送容器200に送信すると(P1’)、その偽造された位置情報およびデバイスID-1を含む偽造第1認証情報が輸送容器200から認証管理サーバ300に送信され(P2’)、当該偽造第1認証情報に基づいて認証管理サーバ300にて第1認証処理が行われる(P3’)。
On the other hand, when an unauthorized third party forges the position information transmission device 100 ′ and transmits the forged position information and device ID-1 to the transport container 200 (P1 ′), the forged position information and Forged first authentication information including device ID-1 is transmitted from the transport container 200 to the authentication management server 300 (P2 '), and the authentication management server 300 performs a first authentication process based on the forged first authentication information. (P3 ′).
ここで、認証管理サーバ300に記憶されている第2認証情報と偽造第1認証情報とが一致すると、第1認証は成功となってしまう。この場合、認証管理サーバ300から輸送容器200の認証装置201にデバイスID-2が送信される(P4’)。しかし、第1認証処理に続いて認証装置201で第2認証処理が行われることを知らない不正の第三者は、偽装したデバイスID-1を再び輸送容器200に送信することをしない。よって、この場合は第2認証が失敗となり、輸送容器200を解錠することはできない。
Here, if the second authentication information stored in the authentication management server 300 matches the forged first authentication information, the first authentication is successful. In this case, the device ID-2 is transmitted from the authentication management server 300 to the authentication device 201 of the transport container 200 (P4 '). However, an unauthorized third party who does not know that the second authentication process is performed in the authentication apparatus 201 following the first authentication process does not transmit the camouflaged device ID-1 to the transport container 200 again. Therefore, in this case, the second authentication fails and the transport container 200 cannot be unlocked.
以上詳しく説明したように、第1の実施形態では、輸送元および輸送先の場所に設置された位置情報発信デバイス100から発信される位置情報およびデバイスID-1を含む第1認証情報を、認証装置201から認証管理サーバ300に送信し、認証管理サーバ300に記憶されている第2認証情報との照合により、認証管理サーバ300において第1認証処理を行う。さらに、第1の実施形態では、第1認証に成功した場合に認証管理サーバ300から認証装置201に送信されるデバイスID-2と、位置情報発信デバイス100から発信されるデバイスID-1との照合により、認証装置201において第2認証処理を行うようにしている。
As described above in detail, in the first embodiment, the first authentication information including the position information and the device ID-1 transmitted from the position information transmission device 100 installed at the location of the transportation source and the transportation destination is authenticated. The authentication management server 300 performs the first authentication process by collating with the second authentication information transmitted from the apparatus 201 to the authentication management server 300 and stored in the authentication management server 300. Furthermore, in the first embodiment, when the first authentication is successful, the device ID-2 transmitted from the authentication management server 300 to the authentication device 201 and the device ID-1 transmitted from the location information transmitting device 100 are By the verification, the authentication device 201 performs the second authentication process.
このように構成した第1の実施形態によれば、認証管理サーバ300における第1認証処理により、認証を許可する正しい場所に輸送容器200が存在するか否かが位置情報に基づいて判定されるとともに、識別情報の正当性が判定される。さらに、この第1認証処理において認証が成功となった場合に、当該第1認証処理から所定の時間差をもって認証装置201において実行される第2認証処理により、識別情報の正当性が再度判定される。
According to the first embodiment configured as described above, the first authentication process in the authentication management server 300 determines whether or not the transport container 200 exists in the correct place where authentication is permitted based on the position information. At the same time, the validity of the identification information is determined. Further, when the authentication is successful in the first authentication process, the validity of the identification information is determined again by the second authentication process executed in the authentication device 201 with a predetermined time difference from the first authentication process. .
このように、第1の実施形態によれば、位置情報と識別情報との組み合わせによる第1認証処理が単に1回行われるだけでなく、その第1認証処理からある程度の時間差をもって識別情報による第2認証処理がさらに行われる。このため、偽造した位置情報と偽造したデバイスID-1とを単に1回発信させて認証装置201に受信させても、それだけでは認証を成功させることはできない。これにより、位置情報に基づいて認証を行う認証システムにおいて、位置情報と識別情報の偽装による不正な認証をより確実に防止して、セキュリティを強化することができる。
As described above, according to the first embodiment, the first authentication process based on the combination of the position information and the identification information is not simply performed once, but the first authentication process is performed with a certain time difference from the first authentication process. 2 The authentication process is further performed. For this reason, even if the forged location information and the forged device ID-1 are simply transmitted once and received by the authentication apparatus 201, the authentication cannot be successful. Accordingly, in an authentication system that performs authentication based on position information, unauthorized authentication due to impersonation of position information and identification information can be more reliably prevented and security can be enhanced.
(第2の実施形態)
次に、本発明による第2の実施形態を図面に基づいて説明する。第2の実施形態による認証システムの全体構成は、図1と同様である。図6は、第2の実施形態による認証システムの機能構成例を示すブロック図である。なお、この図6において、図2に示した符号と同一の符号を付したものは同一の機能を有するものであるので、ここでは重複する説明を省略する。 (Second Embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings. The overall configuration of the authentication system according to the second embodiment is the same as that shown in FIG. FIG. 6 is a block diagram illustrating a functional configuration example of the authentication system according to the second embodiment. In FIG. 6, those given the same reference numerals as those shown in FIG. 2 have the same functions, and therefore redundant description is omitted here.
次に、本発明による第2の実施形態を図面に基づいて説明する。第2の実施形態による認証システムの全体構成は、図1と同様である。図6は、第2の実施形態による認証システムの機能構成例を示すブロック図である。なお、この図6において、図2に示した符号と同一の符号を付したものは同一の機能を有するものであるので、ここでは重複する説明を省略する。 (Second Embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings. The overall configuration of the authentication system according to the second embodiment is the same as that shown in FIG. FIG. 6 is a block diagram illustrating a functional configuration example of the authentication system according to the second embodiment. In FIG. 6, those given the same reference numerals as those shown in FIG. 2 have the same functions, and therefore redundant description is omitted here.
図6に示すように、位置情報発信デバイス100’は、ワンタイムID発行部12およびID送信部13をさらに備えている。また、位置情報発信デバイス100’は、第1認証情報発信部11に代えて第1認証情報発信部11’を備えている。また、認証管理サーバ300’は、ID受信部35をさらに備えている。また、認証管理サーバ300’は、第2認証情報記憶部30および第2識別情報送信部34に代えて第2認証情報記憶部30’および第2識別情報送信部34’を備えている。
As shown in FIG. 6, the location information transmitting device 100 ′ further includes a one-time ID issuing unit 12 and an ID transmitting unit 13. Further, the location information transmission device 100 ′ includes a first authentication information transmission unit 11 ′ instead of the first authentication information transmission unit 11. The authentication management server 300 ′ further includes an ID receiving unit 35. Further, the authentication management server 300 ′ includes a second authentication information storage unit 30 ′ and a second identification information transmission unit 34 ′ instead of the second authentication information storage unit 30 and the second identification information transmission unit 34.
位置情報発信デバイス100’のワンタイムID発行部12は、発行のたびに値が変動するワンタイムIDを発行する。このワンタイムID発行部12は、一定の時間間隔でワンタイムIDを繰り返し発行する。第1認証情報発信部11’は、ワンタイムID発行部12により発行されたワンタイムIDを第1識別情報として、これと位置情報とを、無線通信技術を利用して一定の時間間隔で常時発信する。
The one-time ID issuing unit 12 of the location information transmitting device 100 'issues a one-time ID whose value varies each time it is issued. The one-time ID issuing unit 12 repeatedly issues a one-time ID at a constant time interval. The first authentication information transmitting unit 11 ′ uses the one-time ID issued by the one-time ID issuing unit 12 as the first identification information, and always uses the one-time ID and the position information at regular time intervals using wireless communication technology. send.
ID送信部13は、ワンタイムID発行部12により発行されたワンタイムIDを、その都度インターネットを介して認証管理サーバ300’に送信する。なお、送信されたワンタイムIDがネットワーク上で盗まれるかもしれないというリスクを考慮して、ワンタイムIDを暗号化して送信するのが好ましい。
The ID transmitting unit 13 transmits the one-time ID issued by the one-time ID issuing unit 12 to the authentication management server 300 'via the Internet each time. In consideration of the risk that the transmitted one-time ID may be stolen on the network, the one-time ID is preferably transmitted after being encrypted.
認証管理サーバ300’のID受信部35は、位置情報発信デバイス100’から送信されたワンタイムIDを受信する。そして、受信したワンタイムIDを、第2認証情報の中の第1識別情報として第2認証情報記憶部30’に記憶させる。ワンタイムIDが暗号化されている場合は、これを復号化して第2認証情報記憶部30’に記憶させる。
The ID receiving unit 35 of the authentication management server 300 'receives the one-time ID transmitted from the location information transmitting device 100'. Then, the received one-time ID is stored in the second authentication information storage unit 30 'as the first identification information in the second authentication information. If the one-time ID is encrypted, it is decrypted and stored in the second authentication information storage unit 30 '.
これにより、第2認証情報記憶部30’には、認証を許可する輸送元および輸送先の場所を表す位置情報、位置情報発信デバイス100’が発信するワンタイムIDと同じワンタイムID(第1識別情報)および輸送容器200の輸送容器IDを含む第2認証情報が随時更新して記憶される。
As a result, the second authentication information storage unit 30 ′ has the same one-time ID (first information as the one-time ID transmitted by the location information transmitting device 100 ′, the location information indicating the location of the transportation source and the destination to be authenticated. The second authentication information including the identification information) and the transport container ID of the transport container 200 is updated and stored as needed.
第1認証処理部32は、ある時刻tにおいて第1認証情報受信部31により受信された第1認証情報(ワンタイムID(t)を含む)と、同じ時刻tに第2認証情報記憶部30’に記憶された第2認証情報(ワンタイムID(t)を含む)とを照合して第1認証処理を行う。すなわち、第1認証処理部32は、第1認証情報に含まれている位置情報、ワンタイムID(t)および輸送容器IDと、第2認証情報に含まれている位置情報、ワンタイムID(t)および輸送容器IDとがそれぞれ一致するか否かを判定し、全て一致する場合は認証成功、1つでも相違があれば認証失敗とする。
The first authentication processing unit 32 includes the second authentication information storage unit 30 at the same time t as the first authentication information (including the one-time ID (t)) received by the first authentication information receiving unit 31 at a certain time t. The first authentication process is performed by collating the second authentication information (including the one-time ID (t)) stored in '. That is, the first authentication processing unit 32 includes the position information, the one-time ID (t) and the transport container ID included in the first authentication information, the position information included in the second authentication information, and the one-time ID ( It is determined whether or not t) and the transport container ID match, and if all match, authentication is successful, and if there is even one difference, authentication fails.
第2識別情報送信部34’は、第1認証処理部32による第1認証が成功した場合、第2識別情報として、第2認証情報記憶部30’からワンタイムID(t+Δ)を読み出して認証装置201に送信する。ここで送信するワンタイムID(t+Δ)は、第1認証処理が終了した時点から所定の時間Δが経過したと経過時間判定部33により判定されたときに第2認証情報記憶部30’に記憶されたワンタイムIDである。また、このワンタイムID(t+Δ)は、第1認証情報発信部11’により、第1認証処理が終了した時点から所定の時間Δが経過した時点で発信されるワンタイムIDと同じ値のワンタイムIDである。
When the first authentication by the first authentication processing unit 32 is successful, the second identification information transmitting unit 34 ′ reads the one-time ID (t + Δ) from the second authentication information storage unit 30 ′ as the second identification information and authenticates it. To the device 201. The one-time ID (t + Δ) transmitted here is stored in the second authentication information storage unit 30 ′ when the elapsed time determination unit 33 determines that the predetermined time Δ has elapsed since the end of the first authentication process. The one-time ID. The one-time ID (t + Δ) is a one-time ID having the same value as the one-time ID transmitted by the first authentication information transmitting unit 11 ′ when a predetermined time Δ has elapsed since the end of the first authentication process. Time ID.
認証装置201の第2識別情報受信部22は、認証管理サーバ300’の第2識別情報送信部34’から送信された第2識別情報(ワンタイムID(t+Δ))および施錠/解錠コマンドを受信する。第1認証情報送受信部21は、第2識別情報受信部22が認証管理サーバ300’からワンタイムID(t+Δ)を受信したのと同期したタイミングで、同じワンタイムID(t+Δ)を位置情報発信デバイス100’から無線通信により受信している。
The second identification information receiving unit 22 of the authentication device 201 receives the second identification information (one-time ID (t + Δ)) and the lock / unlock command transmitted from the second identification information transmission unit 34 ′ of the authentication management server 300 ′. Receive. The first authentication information transmitting / receiving unit 21 transmits the same one-time ID (t + Δ) at the same timing as the second identification information receiving unit 22 receives the one-time ID (t + Δ) from the authentication management server 300 ′. The wireless communication is received from the device 100 ′.
なお、同期したタイミングとは、完全に同じ時刻を意味するものではない。すなわち、時刻t+Δの時点でワンタイムID発行部12により発行されたワンタイムID(t+Δ)は、第1認証情報発信部11’により認証装置201に送信される一方、ID送信部13により認証管理サーバ300’に送信されて第2認証情報記憶部30’に記憶された後、第2識別情報送信部34’によって認証管理サーバ300’から認証装置201に送信される。したがって、第1認証情報送受信部21が位置情報発信デバイス100’からワンタイムID(t+Δ)を受信する時刻と、第2識別情報受信部22が認証管理サーバ300’からワンタイムID(t+Δ)を受信する時刻とは、通信の遅延に伴う僅かな時間差を有する。しかし、この時間差は、ワンタイムID発行部12によりワンタイムIDが繰り返し発行される時間間隔に比べて十分に小さく、ワンタイムIDの同期という点において無視することができる。
Note that synchronized timing does not mean the exact same time. That is, the one-time ID (t + Δ) issued by the one-time ID issuing unit 12 at the time t + Δ is transmitted to the authentication device 201 by the first authentication information transmitting unit 11 ′, while authentication management is performed by the ID transmitting unit 13. After being transmitted to the server 300 ′ and stored in the second authentication information storage unit 30 ′, it is transmitted from the authentication management server 300 ′ to the authentication device 201 by the second identification information transmission unit 34 ′. Therefore, the time when the first authentication information transmitting / receiving unit 21 receives the one-time ID (t + Δ) from the location information transmitting device 100 ′, and the second identification information receiving unit 22 receives the one-time ID (t + Δ) from the authentication management server 300 ′. The reception time has a slight time difference due to communication delay. However, this time difference is sufficiently smaller than the time interval at which the one-time ID issuance unit 12 repeatedly issues the one-time ID, and can be ignored in terms of the synchronization of the one-time ID.
第2認証処理部23は、第1認証情報送受信部21により受信された第1識別情報(ワンタイムID(t+Δ))と、第2識別情報受信部22により受信された第2識別情報(ワンタイムID(t+Δ))とを照合して第2認証処理を行う。すなわち、第2認証処理部23は、位置情報発信デバイス100’から受信したワンタイムID(t+Δ)と、認証管理サーバ300’から受信したワンタイムID(t+Δ)とが一致するか否かを判定し、一致する場合は認証成功、一致しない場合は認証失敗とする。
The second authentication processing unit 23 includes the first identification information (one-time ID (t + Δ)) received by the first authentication information transmitting / receiving unit 21 and the second identification information (one-time received by the second identification information receiving unit 22). The second authentication process is performed by collating with the time ID (t + Δ)). That is, the second authentication processing unit 23 determines whether or not the one-time ID (t + Δ) received from the location information transmission device 100 ′ matches the one-time ID (t + Δ) received from the authentication management server 300 ′. If they match, authentication succeeds, and if they do not match, authentication fails.
このように、第2の実施形態によれば、認証管理サーバ300’における第1認証処理および認証装置201における第2認証処理に使用する識別情報としてワンタイムIDを用いている。これにより、第1の実施形態と比べて、位置情報と識別情報の偽装による不正な認証をより確実に防止して、より強いセキュリティを構築することができる。すなわち、第2の実施形態によれば、不正の第三者が2回の認証に成功しなければならない(つまり、偽造した識別情報を2回発行しなければならない)ことを知っていたとしても、識別情報はワンタイムIDとして常に変動していて特定が極めて困難であるため、認証に成功するような識別情報を偽造することが難しく、位置情報と識別情報の偽装による不正な認証をより確実に防止することができる。
Thus, according to the second embodiment, a one-time ID is used as identification information used for the first authentication process in the authentication management server 300 ′ and the second authentication process in the authentication apparatus 201. Thereby, compared with the first embodiment, it is possible to more reliably prevent unauthorized authentication due to impersonation of position information and identification information, and to build stronger security. That is, according to the second embodiment, even if an unauthorized third party knows that the authentication must be successful twice (that is, the forged identification information must be issued twice). Because identification information always fluctuates as a one-time ID and is extremely difficult to identify, it is difficult to forge identification information that can be successfully authenticated, and unauthorized authentication by impersonating location information and identification information is more reliable. Can be prevented.
なお、上記第2の実施形態では、位置情報発信デバイス100’と認証管理サーバ300’との間でワンタイムIDの同期をとる方法として、位置情報発信デバイス100’で発行されたワンタイムIDを認証管理サーバ300’に送信する方法について説明したが、本発明はこれに限定されない。例えば、認証管理サーバ300’においてワンタイムIDを発行し、発行したワンタイムID(暗号化するのが好ましい)をIMESデバイス100’に送信することによって同期をとるようにしてもよい。
In the second embodiment, as a method for synchronizing the one-time ID between the location information transmission device 100 ′ and the authentication management server 300 ′, the one-time ID issued by the location information transmission device 100 ′ is used. Although the method of transmitting to the authentication management server 300 ′ has been described, the present invention is not limited to this. For example, the authentication management server 300 'may issue a one-time ID, and the issued one-time ID (which is preferably encrypted) may be transmitted to the IMES device 100' for synchronization.
この場合、認証管理サーバ300’におけるワンタイムIDの発行処理にかかる負荷を軽減するために、例えば以下のように処理するようにしてもよい。すなわち、認証管理サーバ300’では、第1認証情報受信部31が認証装置201から第1認証情報を受信するまでは、一定の時間間隔でワンタイムIDを発行して位置情報発信デバイス100’に随時送信する。一方、第1認証情報受信部31が認証装置201から第1認証情報を受信した後は、経過時間判定部33により所定の時間が経過したと判定されるまで待って、所定の時間が経過したタイミングのみでワンタイムIDを発行して位置情報発信デバイス100’に送信するようにする。
In this case, in order to reduce the load on the one-time ID issuance process in the authentication management server 300 ′, for example, the following process may be performed. That is, in the authentication management server 300 ′, until the first authentication information receiving unit 31 receives the first authentication information from the authentication device 201, the one-time ID is issued at a fixed time interval to the position information transmitting device 100 ′. Send from time to time. On the other hand, after the first authentication information receiving unit 31 receives the first authentication information from the authentication device 201, the predetermined time has elapsed after the elapsed time determining unit 33 determines that the predetermined time has passed. The one-time ID is issued only at the timing and transmitted to the position information transmitting device 100 ′.
あるいは、負荷軽減のために以下のようにしてもよい。すなわち、位置情報発信デバイス100’からは位置情報のみを一定の時間間隔で発信し続け、それを受信した認証装置201が位置情報を認証管理サーバ300’に送信し、第1認証情報受信部31がこの位置情報を受信したタイミングで、認証管理サーバ300’が1回目のワンタイムIDを発行して位置情報発信デバイス100’に送信する。これを受けて位置情報発信デバイス100’は、位置情報およびワンタイムIDを認証装置201に送信する。
Alternatively, the following may be performed to reduce the load. That is, only the location information is transmitted from the location information transmission device 100 ′ at a constant time interval, and the authentication device 201 that receives the location information transmits the location information to the authentication management server 300 ′, and the first authentication information reception unit 31. When the location information is received, the authentication management server 300 ′ issues the first one-time ID and transmits it to the location information transmission device 100 ′. In response to this, the position information transmission device 100 ′ transmits the position information and the one-time ID to the authentication apparatus 201.
その後、認証装置201から認証管理サーバ300’に送られる第1認証情報に基づいて第1認証処理を行い、その認証に成功した後、経過時間判定部33により所定の時間が経過したと判定されたタイミングで、認証管理サーバ300’が2回目のワンタイムIDを発行して位置情報発信デバイス100’に送信する。なお、最初に認証管理サーバ300’が認証装置201から位置情報のみを受信した際に、当該位置情報のみを用いた認証を行い、これに成功した場合にのみ1回目のワンタイムIDを発行するようにしてもよい。
Thereafter, the first authentication process is performed based on the first authentication information sent from the authentication device 201 to the authentication management server 300 ′. After the authentication is successful, the elapsed time determination unit 33 determines that a predetermined time has elapsed. At the same timing, the authentication management server 300 ′ issues a second one-time ID and transmits it to the location information transmission device 100 ′. When the authentication management server 300 ′ first receives only the position information from the authentication device 201, the authentication management server 300 ′ performs authentication using only the position information, and issues the first one-time ID only when the authentication is successful. You may do it.
また、位置情報発信デバイス100’と認証管理サーバ300’との間でワンタイムIDの同期をとる別の方法として、ワンタイムID発行部12がワンタイムIDを発行する際に用いたインプット値を位置情報発信デバイス100’から認証管理サーバ300’に送信し、認証管理サーバ300’においても同じインプット値を用いてワンタイムIDを発行するようにしてもよい。逆に、認証管理サーバ300’から位置情報発信デバイス100’にインプット値を送信し、認証管理サーバ300’および位置情報発信デバイス100’の双方において同じインプット値からそれぞれワンタイムIDを発行するようにしてもよい。このようにワンタイムIDを発行するためのインプット値を送信して同期をとる形態も、ワンタイムIDを送信して同期をとる形態と本質的には等価であり、本発明の範囲に含まれる。
Further, as another method of synchronizing the one-time ID between the location information transmitting device 100 ′ and the authentication management server 300 ′, the input value used when the one-time ID issuing unit 12 issues the one-time ID is used. The one-time ID may be issued from the location information transmitting device 100 ′ to the authentication management server 300 ′, and the authentication management server 300 ′ also uses the same input value. Conversely, the authentication management server 300 ′ transmits an input value to the location information transmission device 100 ′, and both the authentication management server 300 ′ and the location information transmission device 100 ′ issue a one-time ID from the same input value. May be. In this way, the form for transmitting and synchronizing the input value for issuing the one-time ID is essentially equivalent to the form for transmitting and synchronizing the one-time ID, and is included in the scope of the present invention. .
あるいは、位置情報発信デバイス100’と認証管理サーバ300’との間で通信を行わず、オフラインでワンタイムIDの同期をとるようにしてもよい。例えば、時刻同期方式で位置情報発信デバイス100’と認証管理サーバ300’との双方がそれぞれ同じワンタイムIDを発行することによって同期をとることが可能である。すなわち、位置情報発信デバイス100’では、トークンと呼ばれるパスワード発行器を用いて、時刻の経過に伴って値が変わるワンタイムIDを発行する。そして、位置情報発信デバイス100’は、ワンタイムIDとデバイスIDと位置情報とを発信する。認証装置201は、第1認証情報(ワンタイムID、位置情報および輸送容器ID)とデバイスIDとを認証管理サーバ300’に送信する。
Alternatively, the one-time ID may be synchronized offline without performing communication between the location information transmitting device 100 ′ and the authentication management server 300 ′. For example, synchronization can be achieved by both the location information transmission device 100 ′ and the authentication management server 300 ′ issuing the same one-time ID in the time synchronization method. That is, the location information transmitting device 100 ′ uses a password issuer called a token to issue a one-time ID whose value changes with time. Then, the location information transmission device 100 ′ transmits a one-time ID, a device ID, and location information. The authentication device 201 transmits the first authentication information (one-time ID, position information, and transport container ID) and the device ID to the authentication management server 300 '.
一方、認証管理サーバ300’では、どの位置情報発信デバイス100’がどのトークンを使っているか、そして各トークンがどの時刻にどんなワンタイムIDを発行するかを把握している。そして、認証装置201から第1認証情報が送られてきた時刻と位置情報発信デバイス100’のデバイスIDとを検証することにより、認証装置201から送られてくる第1認証情報に含まれているワンタイムIDと、認証管理サーバ300’が把握している同じ時刻のワンタイムIDとの照合を行うことができる。
On the other hand, the authentication management server 300 ′ knows which position information transmission device 100 ′ uses which token and what time ID each token issues at what time. Then, it is included in the first authentication information sent from the authentication device 201 by verifying the time when the first authentication information is sent from the authentication device 201 and the device ID of the position information transmitting device 100 ′. The one-time ID and the one-time ID at the same time known by the authentication management server 300 ′ can be collated.
また、上記第1および第2の実施形態では、位置情報発信デバイス100の偽造による輸送容器200への不正なアクセスを防止する例について説明したが、本発明が効果を発揮する実施例はこれに限定されない。例えば、図7に示すように、まずは正しい輸送先に輸送容器200を輸送して、正しい位置情報発信デバイス100-1から取得した第1認証情報により第1認証処理を行った後、輸送容器200を別の場所に移動して行おうとする不正なアクセスを防止することもできる。到着時間帯における第1認証に成功しても、その後の送信時間帯において不正な場所ではデバイスID-1を再び受けることができず、第2認証に失敗するからである。
Moreover, although the said 1st and 2nd embodiment demonstrated the example which prevents the unauthorized access to the transport container 200 by the forgery of the positional information transmission device 100, the Example in which this invention exhibits an effect is this. It is not limited. For example, as shown in FIG. 7, first, the transport container 200 is transported to the correct destination, and after the first authentication process is performed using the first authentication information acquired from the correct position information transmission device 100-1 , the transport container 200 is obtained. It is also possible to prevent unauthorized access to move to another location. This is because even if the first authentication in the arrival time zone is successful, the device ID-1 cannot be received again in an unauthorized place in the subsequent transmission time zone, and the second authentication fails.
また、上記第1および第2の実施形態では、輸送元での輸送容器200の施錠および輸送先での輸送容器200の解錠の際に実施する認証に認証装置201を適用する例について説明したが、本発明はこれに限定されない。例えば、輸送物の施錠/解錠ではなく、図8に示すように、モバイルスマートフォン、タブレット端末、ウェアラブル端末といった位置測位可能な可搬型情報処理端末において、画面表示、アプリケーションの起動、アプリケーションが有する機能の実行などに認証装置201による認証を適用し、認証に成功した場合に所定の実行コマンドを発行するようにしてもよい。
In the first and second embodiments, the example in which the authentication device 201 is applied to the authentication performed when the transport container 200 is locked at the transport source and the transport container 200 is unlocked at the transport destination has been described. However, the present invention is not limited to this. For example, instead of locking / unlocking a transported object, as shown in FIG. 8, in a portable information processing terminal capable of positioning such as a mobile smart phone, a tablet terminal, and a wearable terminal, screen display, application activation, and functions of the application The authentication by the authentication device 201 may be applied to the execution of the command, and a predetermined execution command may be issued when the authentication is successful.
一例として、スマートフォンに認証装置201の機能を持たせ、チェックインを行うアプリケーションと協働して認証を行う実施例が挙げられる。すなわち、スマートフォンを持ったユーザが特定の場所(例えば、店舗や飲食店など)に行ってアプリケーションを起動し、チェックインボタンを押下したときにサーバから送られてくるクーポンやポイントなどを、認証管理サーバ300で行われる第1認証およびスマートフォンで行われる第2認証が完了した時点で有効となるようにするといった実施例にも適用が可能である。
As an example, there is an embodiment in which a smartphone has the function of the authentication device 201 and performs authentication in cooperation with an application that performs check-in. That is, when a user with a smartphone goes to a specific location (for example, a store or a restaurant) to start an application and presses the check-in button, authentication management is performed for coupons and points sent from the server. The present invention can also be applied to an embodiment in which the first authentication performed by the server 300 and the second authentication performed by the smartphone are completed at the time of completion.
また、上記第1および第2の実施形態では、情報発信装置として位置情報発信デバイス100,100’を用い、IMESによる位置情報を発信する例について説明したが、本発明はこれに限定されない。例えば、GPS(Global Positioning System)、Bluetooth(登録商標)、BLE(Bluetooth Low Energy)、音波、超音波または無線LANで位置情報を発信するようにしてもよい。なお、IMES、Bluetooth(登録商標)、BLE、音波、超音波、無線LANは、屋内でも利用可能な点においてGPSよりも好ましい。
In the first and second embodiments, the example in which the positional information transmission device 100, 100 'is used as the information transmission device and the positional information by IMES is transmitted has been described. However, the present invention is not limited to this. For example, the position information may be transmitted by GPS (Global Positioning System), Bluetooth (registered trademark), BLE (Bluetooth Low Energy), sound wave, ultrasonic wave, or wireless LAN. IMES, Bluetooth (registered trademark), BLE, sound wave, ultrasonic wave, and wireless LAN are preferable to GPS in that they can be used indoors.
その他、上記第1および第2の実施形態は、何れも本発明を実施するにあたっての具体化の一例を示したものに過ぎず、これらによって本発明の技術的範囲が限定的に解釈されてはならないものである。すなわち、本発明はその要旨、またはその主要な特徴から逸脱することなく、様々な形で実施することができる。
In addition, each of the first and second embodiments described above is merely an example of a specific example for carrying out the present invention, and the technical scope of the present invention should not be interpreted in a limited manner. It will not be. That is, the present invention can be implemented in various forms without departing from the gist or the main features thereof.
11,11’ 第1認証情報発信部
12 ワンタイムID発行部
13 ID送信部
21 第1認証情報送受信部
22 第2識別情報受信部
23 第2認証処理部
30,30’ 第2認証情報記憶部
31 第1認証情報受信部
32 第1認証処理部
33 経過時間判定部
34,34’ 第2識別情報送信部
35 ID受信部
100,100’ 位置情報発信デバイス(情報発信装置)
200 輸送容器
201 認証装置
300,300’ 認証管理サーバ DESCRIPTION OFSYMBOLS 11, 11 '1st authentication information transmission part 12 One time ID issuing part 13 ID transmission part 21 1st authentication information transmission / reception part 22 2nd identification information receiving part 23 2nd authentication process part 30, 30' 2nd authentication information storage part 31 First Authentication Information Receiving Unit 32 First Authentication Processing Unit 33 Elapsed Time Determination Unit 34, 34 ′ Second Identification Information Transmitting Unit 35 ID Receiving Unit 100, 100 ′ Location Information Transmitting Device (Information Transmitting Device)
200Transport Container 201 Authentication Device 300, 300 ′ Authentication Management Server
12 ワンタイムID発行部
13 ID送信部
21 第1認証情報送受信部
22 第2識別情報受信部
23 第2認証処理部
30,30’ 第2認証情報記憶部
31 第1認証情報受信部
32 第1認証処理部
33 経過時間判定部
34,34’ 第2識別情報送信部
35 ID受信部
100,100’ 位置情報発信デバイス(情報発信装置)
200 輸送容器
201 認証装置
300,300’ 認証管理サーバ DESCRIPTION OF
200
Claims (7)
- 固定の場所に設置された情報発信装置と、認証装置と、認証管理サーバとを備え、上記情報発信装置から発信される情報に基づいて認証を行う位置情報を用いた認証システムであって、
上記情報発信装置は、
上記固定の場所を表す位置情報および第1識別情報を含む第1認証情報を発信する第1認証情報発信部を備え、
上記認証装置は、
上記情報発信装置から発信された上記第1認証情報を受信し、当該第1認証情報を上記認証管理サーバに送信する第1認証情報送受信部と、
上記認証管理サーバから送信された第2識別情報を受信する第2識別情報受信部と、
上記第1認証情報送受信部により受信された上記第1認証情報のうちの上記第1識別情報と、上記第2識別情報受信部により受信された上記第2識別情報とを照合して認証を行う第2認証処理部とを備え、
上記認証管理サーバは、
上記認証装置から送信された上記第1認証情報を受信する第1認証情報受信部と、
認証を許可する場所を表す位置情報および上記第1識別情報を含む第2認証情報を記憶する第2認証情報記憶部と、
上記第1認証情報受信部により受信された上記第1認証情報と上記第2認証情報記憶部に記憶されている上記第2認証情報とを照合して認証を行う第1認証処理部と、
上記第1認証処理部による認証が成功した場合、上記第2識別情報を上記認証装置に送信する第2識別情報送信部とを備えたことを特徴とする位置情報を用いた認証システム。 An authentication system using location information that includes an information transmission device installed in a fixed location, an authentication device, and an authentication management server, and performs authentication based on information transmitted from the information transmission device,
The information transmission device
A first authentication information transmission unit for transmitting first authentication information including position information representing the fixed location and first identification information;
The authentication device
A first authentication information transmitting / receiving unit that receives the first authentication information transmitted from the information transmitting device and transmits the first authentication information to the authentication management server;
A second identification information receiving unit for receiving the second identification information transmitted from the authentication management server;
Authentication is performed by comparing the first identification information of the first authentication information received by the first authentication information transmitting / receiving unit with the second identification information received by the second identification information receiving unit. A second authentication processing unit,
The authentication management server
A first authentication information receiving unit for receiving the first authentication information transmitted from the authentication device;
A second authentication information storage unit that stores position information indicating a place where authentication is permitted and second authentication information including the first identification information;
A first authentication processing unit that performs authentication by comparing the first authentication information received by the first authentication information receiving unit with the second authentication information stored in the second authentication information storage unit;
An authentication system using position information, comprising: a second identification information transmission unit configured to transmit the second identification information to the authentication device when authentication by the first authentication processing unit is successful. - 上記情報発信装置の上記第1認証情報発信部は、上記第1識別情報として、発行のたびに値が変動するワンタイムIDを含む上記第1認証情報を発信し、
上記認証管理サーバの上記第2認証情報記憶部は、上記情報発信装置の上記第1認証情報発信部が発信するワンタイムIDと同じワンタイムIDを上記第1識別情報として含む上記第2認証情報を記憶することを特徴とする請求項1に記載の位置情報を用いた認証システム。 The first authentication information transmission unit of the information transmission device transmits the first authentication information including a one-time ID whose value varies every time it is issued as the first identification information.
The second authentication information storage unit of the authentication management server includes the second authentication information including, as the first identification information, the same one-time ID as the one-time ID transmitted by the first authentication information transmission unit of the information transmission device. The authentication system using position information according to claim 1, wherein: - 上記認証管理サーバの上記第2識別情報送信部は、上記第2識別情報として、発行のたびに値が変動するワンタイムIDであって、上記第2認証情報記憶部に記憶されたワンタイムIDと同じ値のワンタイムIDを上記認証装置に送信することを特徴とする請求項2に記載の位置情報を用いた認証システム。 The second identification information transmission unit of the authentication management server is a one-time ID whose value varies as the second identification information every time it is issued, and the one-time ID stored in the second authentication information storage unit 3. The authentication system using position information according to claim 2, wherein a one-time ID having the same value as that of the location information is transmitted to the authentication device.
- 上記情報発信装置の上記第1認証情報発信部は、上記第1識別情報として、発行のたびに値が変わらない固定IDを含む上記第1認証情報を発信し、
上記認証管理サーバの上記第2識別情報送信部は、上記第2識別情報として、上記第1識別情報を上記認証装置に送信することを特徴とする請求項1に記載の位置情報を用いた認証システム。 The first authentication information transmission unit of the information transmission device transmits the first authentication information including a fixed ID whose value does not change every time it is issued as the first identification information,
2. The authentication using location information according to claim 1, wherein the second identification information transmission unit of the authentication management server transmits the first identification information to the authentication device as the second identification information. system. - 上記認証管理サーバは、上記第1認証処理部による認証が成功した場合、当該認証を行ってから所定の時間が経過したか否かを判定する経過時間判定部をさらに備え、
上記第2識別情報送信部は、上記第1認証処理部による認証が成功した場合、上記経過時間判定部により上記所定の時間が経過したと判定されたときに、上記第2識別情報を上記認証装置に送信することを特徴とする請求項1~4の何れか1項に記載の位置情報を用いた認証システム。 The authentication management server further includes an elapsed time determination unit that determines whether or not a predetermined time has elapsed after performing the authentication when the authentication by the first authentication processing unit is successful,
The second identification information transmission unit, when the authentication by the first authentication processing unit is successful, when the elapsed time determination unit determines that the predetermined time has elapsed, 5. The authentication system using position information according to claim 1, wherein the authentication information is transmitted to a device. - 固定の場所に設置された情報発信装置から発信される情報に基づいて、認証管理サーバと協働して認証を行う認証装置であって、
上記情報発信装置から発信された、上記固定の場所を表す位置情報および第1識別情報を含む第1認証情報を受信し、当該第1認証情報を上記認証管理サーバに送信する第1認証情報送受信部と、
上記認証管理サーバにおいて実行される上記第1認証情報を用いた第1認証処理で認証に成功した場合に、上記認証管理サーバから送信される第2識別情報を受信する第2識別情報受信部と、
上記情報発信装置から発信された上記第1認証情報のうちの上記第1識別情報と、上第2記識別情報受信部により受信された上記第2識別情報とを照合して第2認証処理を行う第2認証処理部とを備えたことを特徴とする認証装置。 An authentication device that performs authentication in cooperation with an authentication management server based on information transmitted from an information transmission device installed in a fixed place,
1st authentication information transmission / reception which receives the 1st authentication information containing the positional information and the 1st identification information which represent the said fixed place transmitted from the said information transmission apparatus, and transmits the said 1st authentication information to the said authentication management server And
A second identification information receiving unit for receiving second identification information transmitted from the authentication management server when authentication is successful in the first authentication process using the first authentication information executed in the authentication management server; ,
The first authentication information of the first authentication information transmitted from the information transmitting device is collated with the second identification information received by the second identification information receiving unit to perform a second authentication process. An authentication apparatus comprising: a second authentication processing unit for performing. - 固定の場所に設置された情報発信装置から発信される情報に基づいて、認証装置と協働して認証を行う認証管理サーバであって、
上記情報発信装置から上記認証装置に対して発信された、上記固定の場所を表す位置情報および第1識別情報を含む第1認証情報を上記認証装置から受信する第1認証情報受信部と、
認証を許可する場所を表す位置情報および上記第1識別情報を含む第2認証情報を記憶する第2認証情報記憶部と、
上記第1認証情報受信部により受信された上記第1認証情報と上記第2認証情報記憶部に記憶されている上記第2認証情報とを照合して認証を行う第1認証処理部と、
上記第1認証処理部による認証が成功した場合、上記認証装置において上記第1識別情報との照合により第2認証処理を行うための情報として、上記第2識別情報を上記認証装置に送信する第2識別情報送信部とを備えたことを特徴とする認証管理サーバ。 An authentication management server that performs authentication in cooperation with an authentication device based on information transmitted from an information transmission device installed in a fixed place,
A first authentication information receiving unit that receives, from the authentication device, first authentication information that is transmitted from the information transmission device to the authentication device and includes position information representing the fixed location and first identification information;
A second authentication information storage unit that stores position information indicating a place where authentication is permitted and second authentication information including the first identification information;
A first authentication processing unit that performs authentication by comparing the first authentication information received by the first authentication information receiving unit with the second authentication information stored in the second authentication information storage unit;
When the authentication by the first authentication processing unit is successful, the authentication device transmits the second identification information to the authentication device as information for performing the second authentication processing by collating with the first identification information. 2. An authentication management server comprising an identification information transmission unit.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2016/060157 WO2017168573A1 (en) | 2016-03-29 | 2016-03-29 | Authentication system using position information, authentication device and authentication management server |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2016/060157 WO2017168573A1 (en) | 2016-03-29 | 2016-03-29 | Authentication system using position information, authentication device and authentication management server |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2017168573A1 true WO2017168573A1 (en) | 2017-10-05 |
Family
ID=59963720
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2016/060157 WO2017168573A1 (en) | 2016-03-29 | 2016-03-29 | Authentication system using position information, authentication device and authentication management server |
Country Status (1)
Country | Link |
---|---|
WO (1) | WO2017168573A1 (en) |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2006027867A1 (en) * | 2004-09-10 | 2006-03-16 | Yamato System Development Co., Ltd. | Package delivery box, management server, package delivery system, and package delivery method |
JP2006273471A (en) * | 2005-03-28 | 2006-10-12 | Nec Corp | Article transportation management system, method, terminal, and program |
US20130015950A1 (en) * | 2010-02-04 | 2013-01-17 | Aciss International B.V. | Container, system and method for goods transport |
-
2016
- 2016-03-29 WO PCT/JP2016/060157 patent/WO2017168573A1/en active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2006027867A1 (en) * | 2004-09-10 | 2006-03-16 | Yamato System Development Co., Ltd. | Package delivery box, management server, package delivery system, and package delivery method |
JP2006273471A (en) * | 2005-03-28 | 2006-10-12 | Nec Corp | Article transportation management system, method, terminal, and program |
US20130015950A1 (en) * | 2010-02-04 | 2013-01-17 | Aciss International B.V. | Container, system and method for goods transport |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8947200B2 (en) | Method of distributing stand-alone locks | |
US10635801B2 (en) | Systems and methods for securing access to storage and retrieval systems | |
EP2689383B1 (en) | Systems and methods for electronically signing for a delivered package | |
US8793496B2 (en) | Systems, methods, and computer program products for secure optimistic mechanisms for constrained devices | |
US11238679B2 (en) | Automated physical package delivery with end-to-end package security | |
US10618497B2 (en) | Unlocking control system and unlocking control method | |
US20230082024A1 (en) | Methods and apparatus for accessing secured physcial assets | |
US20240169306A1 (en) | System and method for safe delivery of a package | |
US20180165640A1 (en) | System and method for delivering packages to customers | |
JP2006350682A (en) | Document management system | |
US20170249793A1 (en) | Unattended physical delivery access method and control system | |
JP7056370B2 (en) | Authentication information issuing device and delivery system | |
KR20220123239A (en) | Reusable secure shipping package | |
JP6387284B2 (en) | Authentication system, authentication device and authentication management server using position information | |
JP4088642B2 (en) | Transportation management method, transportation management server, storage box, transportation vehicle, and transportation management system | |
JP6408891B2 (en) | Authentication system using position information, authentication device, authentication management server, and portable authentication device | |
WO2018111717A1 (en) | System and method for delivering packages to customers | |
WO2017168573A1 (en) | Authentication system using position information, authentication device and authentication management server | |
JP2007308873A (en) | System for managing entry into room | |
KR100748085B1 (en) | Home delivery service method and system based on mobile system | |
KR20200045158A (en) | Unmanned Delivery System | |
US20180300678A1 (en) | Unattended physical delivery access method and control system | |
US11551180B2 (en) | System and method for screening deliveries to trade shows | |
EP4120210A1 (en) | Method and system for delivering items | |
US20160321647A1 (en) | Electronic locking devices, systems, and methods |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16896793 Country of ref document: EP Kind code of ref document: A1 |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 16896793 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: JP |