JP2023031673A - Storage device management system - Google Patents

Abstract

To provide a storage device management system capable of preventing a storage device from being unlocked without a user's intention.SOLUTION: A storage device management system 1 includes: a storage device 2 including one or more lockable and unlockable storage units 11; a portable terminal 3 of a user who uses the storage device 2; and a management server 4 on a crowd CD. The storage device management system is capable of unlocking the storage units 11 according to an unlocking request from the portable terminal 3 of the user. The management server 4 generates two or more encrypted authentication data on which two or more different encryption processes are performed on one authentication data on the basis of the unlocking request, and transmits the encrypted authentication data to the storage device 2. The storage device 2 generates two or more decrypted authentication data obtained by decrypting the received encrypted authentication data, respectively, and, when the respective decrypted authentication data agree with each other, unlocks a storage unit 11 on which the unlocking request is performed.SELECTED DRAWING: Figure 1

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a storage device management system capable of preventing a storage device from being unlocked unintentionally by a user.

2. Description of the Related Art Conventionally, lockers that can be used by prior registration of users are installed in stations, commercial facilities, and the like. A user makes a use reservation to a management server that manages a locker device to be used from a portable terminal, issues an unlocking request to the management server at the time of use, and unlocks and uses the reserved locker device.

There is also a locker device for carrying out a porter service of taking baggage and the like of travelers and delivering them to lodging places and the like (see Patent Document 1). This locker device generates encrypted information by encrypting the unlocking information, and the user sends the generated encrypted information to the porter so that the porter can unlock the locker device.

Japanese Patent Application Laid-Open No. 2021-68075

By the way, when attempting to remotely control the unlocking of a storage device such as a locker device, the storage device is unlocked by sending an unlocking instruction from the management server to the storage device after the user has been authenticated. Even when the user is not in the vicinity of the storage device, there is a problem that the storage device is unlocked if the user authentication processing is performed normally due to spoofing. In other words, the spoofing may result in unlocking of the storage device that is not intended by the user.

In addition, since authentication processing may be performed due to spoofing or erroneous operation, there is a demand for a further improvement in security level.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a storage device management system that can prevent a storage device from being unlocked unintentionally by a user.

In order to solve the above-described problems and achieve the object, the present invention provides a storage device having one or more storage units that can be locked and unlocked, a mobile terminal of a user using the storage device, and a management server on the cloud, and capable of unlocking the storage section in response to an unlocking request from the mobile terminal of the user, wherein the management server receives the unlocking request. two or more pieces of encrypted authentication data in which one piece of authentication data is encrypted in two or more different ways based on the The authentication data is decrypted to generate two or more decrypted authentication data, and if the decrypted authentication data match each other, the storage part requested to be unlocked is unlocked.

Further, according to the present invention, in the above invention, the management server transmits each generated encrypted authentication data to the storage device via a plurality of physically different routes.

Further, according to the present invention, in the above invention, one of the plurality of routes is a route via the portable terminal.

Further, according to the present invention, in the above invention, the mobile terminal can be connected to the storage device via short-range wireless communication, the storage device has the same decrypted authentication data, and The storage section requested to be unlocked is unlocked on condition that the mobile terminal requesting unlocking is connected.

Further, according to the present invention, in the above invention, the storage device is presented with a graphic code, and the mobile terminal reads the graphic code of the storage device and reads the identification information indicated by the graphic code. to the storage device, and the storage device unlocks the requested storage unit on the condition that the decrypted authentication data match and the identification information match. characterized by

Further, according to the present invention, in the above-described invention, the storage device is provided with biometric authentication means, and the storage device has the same decrypted authentication data and the authentication result of the biometric authentication means. It is characterized by unlocking the storage part requested to be unlocked on condition that the storage part is unlocked.

According to the present invention, unintended unlocking of the storage device can be prevented.

FIG. 1 is a block diagram showing the configuration of a storage device management system that is an embodiment of the present invention. FIG. 2 is a sequence diagram showing an unlocking control processing procedure by the storage device management system. FIG. 3 is a block diagram showing the configuration of the storage device management system that is Modification 1. As shown in FIG. FIG. 4 is a sequence diagram showing an unlocking control processing procedure according to Modification 1. As shown in FIG. FIG. 5 is a block diagram showing the configuration of a storage device management system that is Modification 2. As shown in FIG. FIG. 6 is a sequence diagram showing an unlocking control processing procedure according to Modification 2. As shown in FIG.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments for carrying out the present invention will be described with reference to the accompanying drawings.

<Configuration of storage device management system>
FIG. 1 is a block diagram showing the configuration of a storage device management system 1 that is an embodiment of the present invention. As shown in FIG. 1, a storage device management system 1 has storage devices 2 placed in stations, convenience stores, home delivery facilities, and the like. The storage device 2 has one or more storage sections 11 that can be locked and unlocked. The storage device 2 can be connected to the cloud CD. A management server 4 and a transfer server 5 are arranged on the cloud CD. The mobile terminal 3 can be connected to the cloud CD and can be connected to the storage device 2 via short-range wireless communication.

The storage device 2 has a storage device body 10 , a communication unit 21 and a control section 22 . The storage device main body 10 has one or more storage portions 11, nine storage portions 11 here. Each storage unit 11 is a storage box having a door 12 that opens forward. Note that the storage unit 11 may be a storage box having a drawer that is pulled forward. Each storage section 11 is provided with a lock section 13 for locking and unlocking, and each lock section 13 is a lock that functions as an electronic control key. Therefore, no physical key is required for locking and unlocking the storage section 11 . Further, locking is performed by an auto-lock mechanism that automatically locks when the door 12 or the drawer is retracted. In FIG. 1, a handle 14 for opening the door 12 is provided. In addition, in FIG. 1, there are nine storage portions 11, but the number of storage portions 11 may be one. Moreover, the storage part 11 may be a storage part in which a front door of a storage device such as a vending machine can be opened and closed.

The communication unit 21 uses a communication interface for connecting to the cloud CD to the Internet using a communication method such as LTE (registered trademark), and a communication method such as Wi-Fi (registered trademark), Bluetooth (registered trademark), or NFC. and a communication interface for performing short-range wireless communication. The short-range wireless communication is preferably connected by BLE with low power consumption.

The control unit 22 is a control unit that controls the entire storage device 2 , and has an unlocking control unit 22 a that controls unlocking of the lock unit 13 of the storage unit 11 . The control unit 22 receives the encrypted authentication data "A" and the encrypted authentication data "B" sent from the management server 4 on the cloud CD, and decrypts the decrypted authentication data "A" and the decrypted authentication data. When "B" matches, the lock portion 13 of the storage portion 11 requested to be unlocked is unlocked. It should be noted that the communication unit 21 may perform the decryption of the encrypted authentication data "A" and the encrypted authentication data "B" and the match determination.

The management server 4 is a server that manages the storage device 2. Upon receiving an unlocking request from the mobile terminal 3, the authentication data generation unit 4a in the management server 4 generates the box ID of the storage unit 11 requested to be unlocked. , unit no. Encrypted authentication data "A" and encrypted authentication data "B" are generated by performing different encryption processes on the authentication data including . The management server 4 then transmits the encrypted authentication data "A" and the encrypted authentication data "B" to the storage device 2 via a plurality of physically different routes. In FIG. 1 , the encrypted authentication data “A” is sent directly to the storage device 2 and the encrypted authentication data “B” is sent to the storage device 2 via the transfer server 5 . The encryption strengths of the encrypted authentication data "A" and the encrypted authentication data "B" may be different. Further, the unlocking request from the portable terminal 3 includes the authentication fixed value 3a. The authentication fixed value 3 a is stored in advance in a software development kit or the like of the mobile terminal 3 and managed by the mobile terminal 3 .

<Storage device unlocking control processing>
FIG. 2 is a sequence diagram showing an unlocking control processing procedure by the storage device management system 1. As shown in FIG. As shown in FIG. 2, first, the mobile terminal 3 transmits to the management server 4 an unlocking request for the storage unit 11 to be unlocked (step S110). The unlocking request includes, for example, the box ID of the storage section 11 to be unlocked, the unit No., and so on. , contains a fixed value 3a for authentication.

The management server 4 creates authentication data based on the unlocking request, and further creates encrypted authentication data "A" and encrypted authentication data "B" which are subjected to different encryption processes (step S120). Then, the management server 4 directly transmits the encrypted authentication data "A" to the storage device 2 (step S130), and transmits the encrypted authentication data "B" to the storage device 2 via the transfer server 5 (step S130). step S140). As a result, the encrypted authentication data "A" and the encrypted authentication data "B" are transmitted to the storage device 2 via a plurality of physically different routes. Also, to the storage device 2, the encrypted authentication data "A" and the encrypted authentication data "B" are sent from different directions (routes).

The storage device 2 that has received the encrypted authentication data "A" and the encrypted authentication data "B" decrypts them to generate the decrypted authentication data "A" and the decrypted authentication data "B" (step S150). . Then, the storage device 2 determines whether or not the decrypted authentication data "A" and the decrypted authentication data "B" match (step S160). If the decrypted authentication data "A" and the decrypted authentication data "B" do not match (step S160: No), this process is terminated. On the other hand, if the decrypted authentication data "A" and the decrypted authentication data "B" match (step S160: Yes), an authentication completion notification is sent to the management server 4 (step S170), and then Unit No. is determined by the unlocking control section 22a. Then, the storage unit 11 corresponding to the box ID is unlocked (step S180), and this processing ends.

When the storage section 11 is unlocked, the front door of the storage section 11 can be opened, and is locked by closing the front door. The management server 4 is also notified of these locking/unlocking information.

In this embodiment, two encrypted authentication data "A" and encrypted authentication data "B" are generated by the management server 4 on the cloud CD, and encrypted authentication is performed by performing different encryption processing on the same content. Since the data "A" and "B" are transmitted to the storage device 2 from two different routes, the security level can be improved. Moreover, since the encrypted authentication data is generated on the cloud, the security level is improved in this respect as well, and the load can be reduced.

<Modification 1>
In the above-described embodiment, the encrypted authentication data "B" is transmitted to the storage device 2 via the transfer server 5, but in the present modified example 1, the encrypted authentication data "B" is transmitted via the portable terminal 3. is transmitted to the storage device 2. FIG. 3 is a block diagram showing the configuration of the storage device management system 1 that is Modification 1. As shown in FIG. As shown in FIG. 3 , the management server 4 transmits encrypted authentication data “B” to the mobile terminal 3 , and the mobile terminal 3 transmits encrypted authentication data “B” to the storage device 2 . Since the mobile terminal 3 is located near the storage device 2, it transmits the encrypted authentication data "B" to the storage device 2 using short-range wireless communication. In Modification 1, the storage device 2 uses the connection of the portable terminal 3 by short-range wireless communication as a weighted condition for unlocking, but this weighted condition may be removed.

<Storage device unlocking control processing>
FIG. 4 is a sequence diagram showing an unlocking control processing procedure according to Modification 1. As shown in FIG. In FIG. 4, the difference from the unlocking control processing procedure shown in FIG. The terminal 3 transmits the received encrypted authentication data "B" to the storage device 2 (step S142). Further, after the process of step S160, the weighting condition for unlocking is added. That is, when the decrypted authentication data "A" and the decrypted authentication data "B" match (step S160: Yes), the storage device 2 establishes short-range wireless communication with the portable terminal 3. (step S161), and it is determined whether or not the mobile terminal 3 is connected (step S162). The authentication fixed value 3a is used for connection with the portable terminal. If it is not connected to the mobile terminal 3 (step S162: No), this process is terminated, and if it is connected to the mobile terminal 3 (step S162: Yes), the management server 4 sends the authentication completion is notified (step S170). After that, the unit No. is changed by the unlock control section 22a. Then, the storage unit 11 corresponding to the box ID is unlocked (step S180), and this processing ends. Other processing is the same as in the embodiment.

In Modification 1, as in the embodiment, the encrypted authentication data "A" and "B" are transmitted to the storage device 2 from two different routes, respectively, so that the security level can be improved. . Moreover, since the encrypted authentication data is generated on the cloud, the security level is improved in this respect as well, and the load can be reduced.

Furthermore, in Modification 1, by setting the connection of the mobile terminal 3 by short-range wireless communication as a weighting condition for unlocking, it is possible to confirm that the mobile terminal 3 is in the vicinity of the storage device 2, and the presence of the user can be confirmed. It is possible to prevent unintended unlocking of the storage section 11 in this state.

<Modification 2>
In Modification 1 above, the establishment of communication using short-range wireless communication is set as an important factor for unlocking to confirm that the portable terminal 3 is in the vicinity of the storage device 2 . It is confirmed that the portable terminal 3 is in the vicinity of the storage device 2 by reading the graphic code such as the QR code (registered trademark) presented to the storage device 2 and transmitting the identification information of the read graphic code to the storage device 2. I am trying to

FIG. 5 is a block diagram showing the configuration of a storage device management system 1 as Modification 2. As shown in FIG. As shown in FIG. 5, a graphic code DD is presented on the front surface of the storage device 2 . This graphical code DD may be pasted or may be a liquid crystal display that is periodically changed. The portable terminal 3 reads the graphic code DD presented in the storage device 2, transmits the read identification information to the storage device 2, and unlocks the lock if the identification information matches in the same manner as the addition condition according to the modification 1. is an additional factor.

<Storage device unlocking control processing>
FIG. 6 is a sequence diagram showing an unlocking control processing procedure according to Modification 2. As shown in FIG. In FIG. 6, the difference from the unlocking control processing procedure shown in FIG. to the storage device 2 (step S164). Then, the storage device 2 determines whether or not the received identification information matches (step S165). If the identification information does not match (step S165: No), this process is terminated. On the other hand, if the identification information matches (step S165: Yes), an authentication completion notification is sent to the management server 4 (step S170), and then the unlock control section 22a controls the unit No. Then, the storage unit 11 corresponding to the box ID is unlocked (step S180), and this processing ends. Other processes are the same as in the first modification.

As a result, in Modification 2, as in Modification 1, it is possible to confirm that the portable terminal 3 is in the vicinity of the storage device 2 by using the graphic code DD as an additional factor for unlocking, and that the user is absent. Unintentional unlocking of the storage section 11 can be prevented in this state.

The reading timing of the graphic code DD in step S163 may be read before the transmission of the identification information in step S164. It may be immediately after receiving "B" (step S141).

<Modification 3>
Further, in the above modified example 2, the graphic code DD is used to confirm that the person (portable terminal 3) is in the vicinity of the storage device 2. The personal identification may be performed in front of the storage device 2 by providing it. Then, the storage device 2 unlocks the storage unit 11 requested to be unlocked on condition that the decrypted authentication data match and the biometric authentication results match. Biometric authentication means include fingerprint authentication, finger vein authentication, face authentication, voice authentication, retina authentication, and the like. The biometric authentication process may be performed by the storage device 2 or may be performed by the management server 4 .

It should be noted that the unlocking requirements in Modifications 1 to 3 above may be combined as appropriate. For example, the unlocking factor according to Modification 1 may be added to the unlocking factor according to Modification 2, or the unlocking factor according to Modification 1 may be added to the unlocking factor according to Modification 3. may be added, or all the unlocking factors of modified examples 1 to 3 may be added.

In addition, each configuration illustrated in the above embodiment is a functional schematic, and does not necessarily need to be physically configured as illustrated. In other words, the form of dispersion/integration of each device and component is not limited to the illustrated one, and all or part of them can be functionally or physically distributed/integrated in arbitrary units according to various usage conditions. can be configured

1 storage device management system 2 storage device 3 portable terminal 3a fixed value for authentication 4 management server 4a authentication data generation unit 5 transfer server 10 storage device body 11 storage unit 12 door 13 lock unit 14 handle 21 communication unit 22 control unit 22a unlocking Control part CD cloud

Claims (6)

A storage device having one or more storage units that can be locked and unlocked, a mobile terminal of a user who uses the storage device, and a management server on the cloud, A storage device management system capable of unlocking the storage unit according to an unlocking request,
The management server generates two or more pieces of encrypted authentication data in which one piece of authentication data is encrypted in two or more different ways based on the unlocking request, and transmits the encrypted authentication data to the storage device;
The storage device generates two or more pieces of decrypted authentication data by decrypting each of the received encrypted authentication data, and unlocks the storage unit requested to be unlocked when the decrypted authentication data match. A storage device management system characterized by: 2. The storage device management system according to claim 1, wherein said management server transmits each generated encrypted authentication data to said storage device via a plurality of physically different routes. 3. The storage device management system according to claim 2, wherein one of the plurality of routes is a route via the portable terminal. The mobile terminal is connectable to the storage device via short-range wireless communication,
The storage device unlocks the storage section requested to be unlocked on condition that each decrypted authentication data matches and the mobile terminal requesting the unlocking is connected. The storage device management system according to any one of claims 1 to 3. A graphic code is presented in the storage device,
The mobile terminal reads the graphic code of the storage device and transmits identification information indicated by the graphic code to the storage device,
The storage device unlocks the storage section requested to be unlocked on condition that the decrypted authentication data match and the identification information match. 5. The storage device management system according to any one of 4. The storage device is provided with biometric authentication means,
The storage device unlocks the storage unit requested to be unlocked on condition that each decrypted authentication data matches and the authentication result of the biometric authentication means matches. The storage device management system according to any one of claims 1 to 5.

Images