JP2004285771A - Key authentication system and key authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a rational locking and unlocking mechanism, coping both within the use and the non-use of a cellular phone. <P>SOLUTION: A data server device 10 includes a means for receiving an application data, creating authentication data, storing the authentication data and transmitting the same to the cellular phot 40 and a key authentication device 50. The cellular phone 40 and the key authentication device 50 have a means for storing the authentication data transmitted from the data server device 20. The key authentication device 50 has a means for locking and unlocking in the case where the authentication data transmitted from the cellular phone 40 or authentication data transmitted from the server device 10 in case of emergency agrees with the authentication data stored in a relevant device 50. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technique for unlocking or locking an electronic lock.
[0002]
[Prior art]
As a technique for unlocking or locking a door by transmitting data from a mobile phone (hereinafter, referred to as “unlocking”), authentication data is stored in a key authentication device and a mobile phone, and in the key authentication device, There has been proposed a technology of unlocking by comparing authentication data transmitted from a mobile phone with authentication data stored in the device in advance (for example, see Patent Document 1). However, in such a method, when the mobile phone cannot be used due to a dead battery or the like, the door cannot be unlocked.
On the other hand, as a technique for unlocking a door without using a mobile phone, the key authentication device is unlocked after the server device authenticates information about the user when the user inputs a user ID from the terminal. There is a case where a door is unlocked by transmitting a command (for example, see Patent Document 2).
[0003]
[Patent Document 1]
JP-A-2002-161657
[Patent Document 2]
JP-A-2002-150425
[0004]
[Problems to be solved by the invention]
As described above, in order to construct a mechanism for unlocking and unlocking the door corresponding to both when the mobile phone can be used and when it cannot be used, the technology disclosed in Patent Document 1 which is a technology for unlocking using a mobile phone is used. By combining the technology of Patent Literature 2 which is a technology of unlocking and locking using a server device, a system can be created that supports both the case where a mobile phone is used and the case where a mobile phone is not used.
However, in the technology of Patent Literature 1, the authentication data is collated by the key authentication device, whereas in the technology of Patent Literature 2, various processes such as verification and authentication are performed by the server device, and the key authentication device Since the unlocking is performed by receiving the unlock designation from the server device, the process performed by the key authentication device and the server device differs depending on whether the mobile phone is used or not. It is necessary to construct a mechanism for collating the authentication data in both the server and the server device.
This means that the same mechanism is built in different devices, so that the development efficiency is low and many resources are required. For this reason, development costs, maintenance costs, costs for increasing the number of devices, and the like are increased, which is not rational and economical.
The present invention has been made in order to solve the above-described problems, and has as its object to provide a rational unlocking mechanism that can cope with both when a mobile phone can be used and when it cannot be used. I have.
[0005]
[Means for Solving the Problems]
In order to solve the above-described problem, the present invention provides a receiving unit for receiving application data including user identification data for identifying a user, and a method for authenticating the user from the application data received by the receiving unit. Authentication data creating means for creating the authentication data, authentication data created by the authentication data creating means, application storage means for storing the application data received by the receiving means in a storage device in association with each other, A key for unlocking or locking the portable communication terminal with the authentication data for registration including the authentication data created by the authentication data creating means and the type data indicating that the authentication data is data for registration. An authentication data transmitting unit that transmits the authentication data to the authentication device; and an unlocking request data for requesting unlocking or locking including the user identification data. Then, the authentication data corresponding to the user identification data is read from the storage device stored by the application storage means, and the emergency data including the authentication data and the type data indicating that the authentication data is data for verification is included. A server device having emergency means for transmitting authentication data to the key authentication device, a means for transmitting the application data to the server device, and receiving the registration authentication data transmitted from the server device, Portable communication terminal storage means for storing authentication data included in the authentication data, authentication data stored by the portable communication terminal storage means and type data indicating that the authentication data is data for verification. A portable communication terminal having unlocking instruction transmitting means for transmitting authentication data for collation including a password to the key authentication device; Key authentication device storage means for receiving the registered authentication data set, storing the authentication data included in the registration authentication data, and emergency unlocking for receiving the emergency authentication data transmitted from the server device Instruction receiving means, unlocking instruction receiving means for receiving the verification authentication data transmitted from the portable communication terminal, and authentication data contained in the emergency authentication data received by the emergency unlocking instruction receiving means Or unlocking means for unlocking or locking when the authentication data for verification received by the unlocking instruction receiving means and the authentication data stored by the key authentication device storage means match. And a key authentication device having the following.
[0006]
Also, the present invention provides a receiving means for receiving application data including user identification data for identifying a user, and an authentication for creating authentication data for authenticating the user from the application data received by the receiving means. A data creation unit, an application storage unit that associates the authentication data created by the authentication data creation unit with the application data received by the reception unit and stores the application data in a storage device, and an application storage unit that is created by the authentication data creation unit. Transmitting the authentication data for registration including the authentication data and the type data indicating that the authentication data is data for registration to the portable communication terminal and the key authentication device for unlocking or locking. Data transmission means for receiving unlocking / locking request data for requesting unlocking or locking including the user identification data; Is read from the storage device stored by the application storage means, and the emergency authentication data including the authentication data and the type data indicating that the authentication data is data for collation is used for the key authentication. Key authentication device storage means for storing authentication data included in the transmitted registration authentication data, from a server device having emergency means for transmitting to the device;
Means for transmitting the application data to the server device; portable communication terminal storage means for receiving the registration authentication data transmitted from the server device and storing authentication data included in the registration authentication data; Transmitting an unlock instruction to transmit the authentication data for verification including the authentication data stored by the portable communication terminal storage means and the type data indicating that the authentication data is data for verification to the key authentication device. Means for receiving the authentication data for verification from a portable communication terminal having means for receiving the authentication data for emergency, receiving means for receiving the authentication data for emergency from the server device, The authentication data included in the emergency authentication data received by the data receiving unit, or the verification data received by the verification authentication data receiving unit. When the authentication data included in the certificate data and the authentication data stored by the key authentication device storage unit match, a key authentication device including unlocking / unlocking unit for unlocking or locking is provided. I do.
[0007]
Further, the present invention provides an application data transmitting step in which the portable communication terminal transmits application data including user identification data for identifying a user, and the server device transmits the application data transmitted in the application data transmitting step. An application data receiving step of receiving the application data, an authentication data creating step of creating authentication data for authenticating the user from the application data received by the application data receiving step, and an authentication data creating step. An application storing step of storing the created authentication data and the application data received by the receiving means in a storage device in association with each other; an authentication data created by the authentication data creating step; and the authentication data being registered data. The authentication data for registration including the type data indicating An authentication data transmitting step for transmitting to a communication terminal and a key authentication device for unlocking or locking; and wherein the portable communication terminal and the key authentication device transmit the authentication data for registration transmitted by the authentication data transmitting step. And an authentication data storing step of storing authentication data included in the registration authentication data, and when the portable communication terminal is used, the portable communication terminal performs the authentication data storing step. While transmitting the authentication data for verification including the stored authentication data and the type data indicating that the authentication data is data for verification to the key authentication device, a communication terminal other than the portable communication terminal uses the authentication data for verification. When the server device receives the unlock request data for requesting the unlock or lock including the user identification data from the communication terminal, The authentication data corresponding to the user identification data is read from the storage device stored in the application storing step, and the emergency authentication including the authentication data and the type data indicating that the authentication data is data for verification is included. Unlocking and instructing step of transmitting data to the key authenticating apparatus, wherein the key authenticating apparatus receives the authentication data for verification transmitted in the unlocking and instructing step, or the emergency authentication data; When the authentication data included in the authentication data or the authentication data included in the emergency authentication data matches the authentication data stored in the authentication data storing step, unlocking or unlocking is performed. And a key authentication method.
[0008]
According to the above invention, the server device receives the application data transmitted from the communication terminal, creates authentication data using the application data, and stores the authentication data and the application data in the storage device in association with each other. And transmits the authentication data to the communication terminal and the key authentication device. This authentication data is received and stored by the communication terminal and the key authentication device. When receiving the authentication data transmitted from the communication terminal, the key authentication device unlocks only when the authentication data and the stored authentication data match, while receiving the authentication data from the server device, the key authentication device Unlocking is performed only when the stored authentication data matches.
[0009]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[1. Constitution]
[1.1. Overall system configuration]
FIG. 1 is a block diagram showing the overall configuration of a key authentication system 1 according to one embodiment of the present invention. As shown in FIG. 1, the key authentication system 1 includes a data server device 10, the Internet 20, a mobile phone base station 32 that controls wireless communication for mobile phones, a pager (registered trademark), a quick cast ( A pager base station 33 for controlling wireless communication for a pager such as a registered trademark, a mobile communication network 30 including a gateway server device 31 and an exchange (not shown), a mobile phone 40, a key authentication device 50, A fixed telephone 60 for transmitting and receiving voice data via a telephone network (not shown) and a voice response device (not shown) are provided. In FIG. 1, only one mobile phone 40, one key authentication device 50, and one fixed telephone 60 are shown for simplicity of the drawing, but there are actually many of them. .
[0010]
[1.2. Configuration of data server device]
Next, the configuration of the data server device 10 will be described in detail.
The data server device 10 has a function of a normal WWW (World Wide Web) server device, and performs communication according to HTTP (Hypertext Transfer Protocol).
FIG. 2 is a block diagram illustrating a configuration of the data server device 10. As shown in FIG. 1, the data server device 10 includes a CPU (Central Processing Unit) 101 that executes a program, and a ROM (Read Only Memory) that stores a program that is read and executed by the CPU 101 when the data server device 10 starts up. ) 102, a RAM (Random Access Memory) 103 for temporarily storing data used by the CPU 101, a hard disk device 104 for storing various data, a communication interface 105 for relaying communication between the Internet 20 and the CPU 101, and Is provided.
[0011]
The hard disk device 104 has a key authentication system database (DB) 1041 shown in FIG.
The key authentication system DB 1041 includes data indicating a user ID, a mobile phone number, a password, and a pager number included in application data for applying for use of the key authentication system received from the mobile phone 40, Authentication data created based on the data is stored.
[0012]
Various programs are stored in the hard disk device 104.
Specifically, the hard disk device 104 stores an authentication data creation program.
The authentication data creation program is for causing the data server device 10 to realize the functions described below.
(1) A function of detecting that application data has been transmitted from the mobile phone 40.
(2) A function for calculating a hash value by substituting data included in the application data into a hash function, and using data representing the calculated hash value (hereinafter, referred to as “authentication data”) for calculating the data. A function for storing in the key authentication system DB 1041 as personal management data in association with the applied application data.
Here, the hash value is a calculated value of a fixed length calculated by substituting arbitrary data into a hash function. A hash function is a kind of one-way function.
The “one-way function” means that y = f (x) can be calculated at high speed, but there is no inverse function of f that obtains x from y, and it takes enormous calculation time to obtain x. What we seek is a function that is virtually impossible.
(3) When unlock request data for requesting unlocking is received from the fixed telephone 60 via the telephone network, the user ID and password entered by the user included in the unlock request data Is extracted from the key authentication system DB 1041, and an electronic mail (hereinafter, referred to as “mail”) for instructing unlocking including the authentication data included in the personal management data is stored. ), And send an e-mail to a pager represented by a pager number included in the personal management data.
[0013]
The hard disk device 104 stores an application program to be executed by the mobile phone 40 and an authentication data transmission program.
The application program causes the CPU 401 of the mobile phone 40 to display a key authentication system application screen 405a shown in FIG. 6, transmit application data input from the screen 405a to the data server device 10, and thereafter, This is a program for detecting reception of an e-mail when the e-mail is transmitted to the mobile phone 40 and storing the authentication data included in the e-mail in the own device 40.
The authentication data transmission program is a program for causing the CPU 401 to transmit the authentication data stored in the mobile phone 40 to the key authentication device 50 to unlock the door.
These programs are described in the Java (registered trademark) language, and the mobile phone 40 can download these programs from the data server device 10.
[0014]
The data server device 10 is connected to a voice response device (not shown) via a communication line. Further, the voice response device is connected to a fixed telephone 60 such as a public telephone via a telephone line network (not shown). The fixed telephone 60 or the voice response device is used when the user cannot use the mobile phone 40, such as when the battery of the mobile phone 40 owned by the user has run out or when the user has lost the mobile phone 40. Is done.
The voice response device has a call from the fixed telephone 60 and, when the call is connected, gives guidance from the fixed telephone 60 to the user to input data such as a user ID for identifying the user. Further, the voice response device transfers the data input by the user to the data server device 10.
[0015]
[1.3. Configuration of Key Authentication Device]
Next, the configuration of the key authentication device 50 will be described in detail.
FIG. 4 is a block diagram illustrating a hardware configuration of the key authentication device 50. The key authentication device 50 can be attached to a member for unlocking a door provided in a general home or a building.
As shown in the figure, the key authentication device 50 includes a control device 51 and an electronic lock 52.
The control device 51 includes a CPU 511 that controls each unit of the control device 51, a storage device 512, a pager 513 that is a wireless receiving device, an interface 514 for transmitting data from the control device 51 to the electronic lock 52, and wireless communication. And an IrDA (Infrared Data Association) communication unit 515, which are connected by a bus 516.
[0016]
The storage device 512 stores various programs and various data.
Specifically, the storage device 512 monitors the data transmitted to the IrDA communication unit 515 and the mail transmitted to the pager 513, and when the pager 513 receives the mail, the data is included in the mail. By confirming the contents of the stored data, the mail is a mail for registering the authentication data in the storage device 512, or is transmitted from the data server device 10 in an emergency such as when the battery of the mobile phone 40 is exhausted. A monitoring program for determining whether the received mail is for instructing unlocking is stored.
The storage device 512 stores the authentication data included in the mail received from the pager 513 or the authentication data included in the unlock instruction data for instructing unlocking received from the IrDA communication unit 515. When the authentication data is matched with the authentication data stored in the storage device 512 and the authentication data matches, the authentication for transmitting the unlock permission data for unlocking the door to the electronic lock 52 via the interface 514 is performed. A program is stored.
When the mail received from the pager 513 is a mail for registering authentication data at the time of a new application, the storage device 512 stores the authentication data included in the mail in the storage device 512. An authentication data registration program is stored.
The storage device 512 stores the authentication data transmitted from the data server device 10.
[0017]
The pager 513 has a function of a wireless receiving device such as a general pager or quick cast. That is, the pager 513 has a function of receiving text data and mail transmitted to a pager number for identifying the pager 513.
Although the pager 513 is attached to the key authentication device 50 in advance, a commercially available pager or quick cast can be purchased and attached.
[0018]
The electronic lock 52 includes an electronic lock driving unit 521 and an unlocking mechanism 522.
The unlocking mechanism 522 is connected to a member for unlocking the door and the electronic lock driving unit 521. The unlocking mechanism 522 unlocks the door by driving a member for unlocking the door in the direction of unlocking the door in conjunction with the electronic lock driving unit 521.
The electronic lock driving unit 521 is connected to the interface 514 of the control device 51, and receives unlock permission data for unlocking from the interface 514. The electronic lock driving unit 521 includes a member such as a solenoid driven by a change in current. When the electronic lock driving unit 521 receives the unlock permission data from the control device 51, a current flows through the solenoid. Thereby, a magnetic force is generated, and the electronic lock driving unit 521 is driven. The unlocking mechanism 522 is driven in conjunction with the movement of the driven electronic lock driving unit 521, and the door is unlocked.
[0019]
[1.4. Configuration of Mobile Phone]
Next, the configuration of the mobile phone 40 will be described with reference to FIG.
The mobile phone 40 includes a CPU 401 for controlling each unit, a wireless communication unit 402 for performing wireless communication, an operation unit 403 for giving various commands to the CPU 401 by operating various keys, and a call process for making a call. Unit 404, a display unit 405 for displaying various screens, a storage unit 406 for storing various programs and data, an IrDA communication unit 407 for performing IrDA communication which is a standard for infrared communication, and a bus connecting these. 409, and has the functions of a normal computer.
[0020]
The storage unit 406 includes a ROM (Read Only Memory) 406 a and a nonvolatile memory 408.
The non-volatile memory 408 stores an application program described in Java language downloaded from a server device such as the data server device 10. The non-volatile memory 408 has a scratch pad 408a which is an area allocated to write data in an application program described in the Java language.
The ROM 406a stores an operating system for the mobile phone 40, software such as a WWW browser, and software for constructing a Java execution environment. The software for constructing the Java execution environment includes an original Java extension library that is uniquely formulated for a mobile phone by a communication carrier. The original Java extension library includes, for example, a scratchpad API (Application Program Interface), an OBEX (Object Exchange Protocol) client API, and an API for performing HTTP communication. The scratch pad API is an API for supporting writing and reading of data to and from the scratch pad. The OBEX client API is an API for supporting transmission and reception of data from the IrDA communication unit 407.
When executing a program described in the Java programming language, the CPU 401 writes and reads data to and from the scratch pad 408a using the scratch pad API, and uses the OBEX client API to write data from the IrDA communication unit 407. And transmits an HTTP request according to HTTP to the Internet 20 via the Internet 20, receives an HTTP response to the message, and communicates with various server devices.
[0021]
[2. motion]
Next, the operation of the present embodiment in the above configuration will be described.
[0022]
As a premise, it is assumed that the user who owns the mobile phone 40 has purchased the key authentication device 50 and attached it to the door of the house. It is also assumed that the pager number of the pager 513 incorporated in the key authentication device 50 has been notified to the key authentication device 50 at the time of purchase.
It is assumed that the application program and the authentication program are downloaded from the data server device 10 to the mobile phone 40 and stored in the nonvolatile memory 408.
Further, it is assumed that the CPU 511 of the key authentication device 50 constantly monitors the transmission of data such as mail by activating the monitoring program.
[0023]
[2.1. When registering authentication data]
First, an operation when a user registers authentication data in order to use the key authentication system 1 will be described with reference to FIG.
First, the user operates the operation unit 403 of the mobile phone 40 to give an instruction to start the application program.
As a result, the CPU 401 of the mobile phone 40 reads out the application program from the nonvolatile memory 408 and executes the application program, thereby displaying the key authentication system application screen 405a shown in FIG.
Next, the user inputs “01” in the text box corresponding to the user ID, “123” in the text box corresponding to the password, and “090-1234” in the text box corresponding to the mobile phone number on the key authentication system application screen 405a. After inputting "5678" and "03-1234-5678" in the text box corresponding to the pager number, the "send" button is pressed.
Accordingly, the CPU 401 transmits an HTTP request (hereinafter, referred to as “application data D10”) including the data input from the screen to the data server device 10.
[0024]
CPU 101 of data server device 10 detects that the application data has been transmitted. Thus, the CPU 101 reads out the authentication data creation program from the hard disk device 104 and executes the program, thereby creating authentication data. Specifically, the CPU 101 calculates a hash value by substituting data representing the user ID, password, mobile phone number, and pager number contained in the received application data into a hash function. The data represented by the calculated hash value is hereinafter referred to as “authentication data”.
Then, the CPU 101 stores the received user ID, password, mobile phone number, pager number, and created authentication data in the key authentication system DB 1041.
Next, CPU 101 creates a mail for transmitting the authentication data to mobile phone 40 and key authentication device 50.
Specifically, the CPU 101 determines the created authentication data, the mail type data indicating that the mail is for registering the authentication data, and the telephone number of the mobile phone 40 for identifying the transmission destination of the mail. A short mail (registered trademark) D11 containing “090-1234-5678” is created.
The CPU 101 also includes the authentication data, mail type data indicating that the mail is for registering the authentication data, and a pager number “03-1234-5678” of the pager 513 for identifying the transmission destination. A mail D12 is created.
Then, the CPU 101 transmits these mails D11 and D12.
[0025]
The short mail D11 transmitted from the data server device 10 is transmitted to the mobile phone 40 via the mail server device for short mail (not shown) and the mobile phone base station 32. In addition, the mail D12 transmitted from the data server device 10 is transmitted to the pager 513 of the key authentication device 50 via the not-shown pager mail server device and the pager base station 33.
[0026]
The mobile phone 40 receives the short mail D11. The CPU 401 detects the reception of the short mail D11 and stores the authentication data included in the received mail D11 in the scratch pad 408a.
[0027]
On the other hand, when pager 513 receives mail D12, CPU 511 detects the reception of mail D12. Then, CPU 511 determines whether the mail is a mail for registering authentication data or a mail transmitted for unlocking in an emergency. Since the mail includes mail type data indicating that the mail is for registering the authentication data as a destination, the CPU 511 stores the authentication data included in the mail D12 in the storage device 512. .
[0028]
[2.2. When unlocked]
Next, an operation of unlocking a locked door will be described with reference to FIG.
As a premise, the authentication data is as described in 2.1. It is assumed that the authentication data is stored in the mobile phone 40 and the key authentication device 50 in the process at the time of registration of the authentication data, and that these authentication data match.
[0029]
First, the user operates the operation unit 403 of the mobile phone 40 to give an instruction to transmit authentication data while holding the mobile phone 40 over the key authentication device 50 installed on the door.
Accordingly, the CPU 401 of the mobile phone 40 reads out the authentication data transmission program from the nonvolatile memory 408 and executes the same, thereby reading out the authentication data from the scratch pad 408a and transmitting the unlock instruction data D20 including the authentication data to the mobile phone 40. It is transmitted from the IrDA communication unit 407 of the telephone 40.
[0030]
The IrDA communication unit 515 of the key authentication device 50 receives the unlock instruction data D20 from the mobile phone 40. As a result, the CPU 511 reads out the authentication program from the storage device 512 and executes it. The authentication data included in the received unlock instruction data D20 is compared with the authentication data stored in the storage device 512.
As a result of the comparison, if the received authentication data does not match the authentication data stored in the storage device 512, the CPU 511 ends the process.
Here, since the received authentication data matches the authentication data stored in the storage device 512, the CPU 511 sends the unlock permission data for unlocking to the electronic lock 52 via the interface 514. Send.
The electronic lock driving unit 521 is driven by receiving unlock permission data. The unlocking mechanism 522 is driven in conjunction with the electronic lock driving unit 521. Thus, the member for unlocking the door is driven in the direction of unlocking the door in conjunction with the electronic lock driving unit 521, and the door is unlocked.
[0031]
[2.3. emergency]
Next, the operation of unlocking the door key when the user cannot use the mobile phone 40 (hereinafter, referred to as “emergency”) due to a battery exhaustion of the mobile phone 40 will be described with reference to FIG. explain.
As a premise, it is assumed that the telephone number for dialing from the fixed telephone 60 in an emergency is notified to the user when the key authentication device 50 is purchased.
Further, the values represented by the user ID, the password, the mobile phone number, and the pager number that the user inputs from the fixed telephone 60 are as described in 2.1. It is assumed that the value of the application data stored in the key authentication system DB 1041 is the same as the value input from the key authentication system application screen 405a when registering the authentication data.
The authentication data included in the mail transmitted to the pager 513 of the key authentication device 50 is the same as the authentication data stored in the storage device 512 of the key authentication device 50.
[0032]
First, the user dials a telephone number for emergency unlocking from a fixed telephone 60 such as a push-type public telephone. Thereby, the fixed telephone 60 makes a call to a voice response device (not shown) and connects the call with the voice response device. The voice response device transmits guidance for inputting data to fixed telephone 60. In accordance with the guidance from the voice response device, the user can make the user ID “01”, the password “123”, the mobile phone number “090-1234-5678”, and the pager number “03-1234-5678” (hereinafter “emergency collation”). Data "). The voice response device transmits to the data server device 10 emergency unlocking request data D30 for requesting unlocking including the data for emergency collation.
[0033]
The data server device 10 receives the emergency unlock request data D30.
The CPU 101 of the data server device 10 searches the key authentication system DB 1041 for personal management data having the same value as the emergency collation data included in the emergency unlock request data D30.
If there is no personal management data having the same value as the urgent collation data in key authentication system DB 1041, CPU 101 ends the process.
On the other hand, here, since there is personal management data having the same value as the emergency collation data input to the key authentication system DB 1041, the CPU 101 reads the personal management data. Then, the CPU 101 creates a mail for transmitting the read authentication data of the personal management data to the pager 513 of the key authentication device 50.
Specifically, the CPU 101 creates a mail D31 including authentication data of the read personal management data, a pager number, and mail type data indicating that the mail is for issuing an unlock instruction in an emergency. .
Then, the CPU 101 transmits the created mail D31.
[0034]
The mail D31 transmitted by the data server device 10 is transmitted to the pager 513 of the key authentication device 50 via a not-shown pager mail server device.
The CPU 511 detects that the mail D31 has been received by the pager 513. Then, the CPU 511 determines whether the mail D31 is a mail for registering authentication data or a mail transmitted for giving an unlock instruction in an emergency. Since the mail includes mail type data indicating that the mail is for instructing unlocking, the CPU 511 determines that the received mail is mail for instructing unlocking. Thus, the CPU 511 reads the authentication program from the storage device 512 and executes the authentication program, thereby collating the authentication data included in the received mail with the authentication data stored in the storage device 512.
As a result of the comparison, if the received authentication data does not match the authentication data stored in the storage device 512, the CPU 511 ends the process.
Here, since the received authentication data matches the authentication data stored in the storage device 512, the CPU 511 sends the unlock permission data for unlocking to the electronic lock 52 via the interface 514. Send.
The electronic lock driving unit 521 is driven by receiving unlock permission data. The unlocking mechanism 522 is driven in conjunction with the electronic lock driving unit 521. Thus, the member for unlocking the door is driven in the direction of unlocking the door in conjunction with the electronic lock driving unit 521, and the door is unlocked.
[0035]
As described above, the key authentication device 50 can receive the authentication data from the mobile phone 40 and unlock the door. Therefore, if the user carries the mobile phone 40, it is not possible to carry the key. This is unnecessary, and there is no need to worry about loss or theft of the key.
Also, when the mobile phone 40 cannot be used due to battery exhaustion or the like (emergency), the data server device 10 inputs the key for emergency verification from the fixed telephone 60 such as a public telephone by inputting the urgent collation data for user authentication. An e-mail containing the authentication data can be transmitted to the authentication device 50. The key authentication device 50 performs the unlocking process of the door after performing the verification of the authentication data, as in the case where the authentication data is transmitted from the mobile phone 40, using the authentication data included in the mail. Can be.
That is, according to the present invention, when the mobile phone 40 can be used, the authentication data is transmitted from the mobile phone 40 to the key authentication device 50, and when the mobile phone 40 cannot be used, the authentication data is transmitted from the data server device 10 to the key authentication device. Since the data is transmitted to the key authentication device 50, the key authentication device 50 checks the authentication data and then performs the unlocking process in any case. Therefore, it is not necessary to provide the data server device 10 with a function of collating the authentication data, and the data server device 10 only needs to perform processing of transmitting the authentication data to the key authentication device 50 in an emergency.
As described above, in the entire key authentication system 1, a rational key authentication mechanism can be constructed without giving duplicate functions to different devices, so that the development efficiency is high, and the storage device, CPU, and the like to be used are also improved. Resources can be minimized.
[0036]
[3. Modification]
Although the embodiment of the present invention has been described above, this embodiment is merely an example, and various modifications can be made without departing from the spirit of the present invention. For example, the following modifications can be considered.
[0037]
(1) In the above embodiment, only the case where the door is unlocked has been described, but the unlocking mechanism of the present invention can be applied to the case where the door is locked.
(2) In the above embodiment, it has been described that the mail is transmitted from the data server device 10 to the pager 513 of the key authentication device 50. However, the present invention is not limited to the mail, and the normal character information may be transmitted. Is also good. In the above embodiment, the short mail is transmitted from the data server device 10 to the mobile phone 40. However, the short mail is not limited to the short mail, but may be sent to a mail address for identifying the mobile phone 40. An email may be transmitted.
[0038]
(3) In the above embodiment, the key authentication device 50 uses the pager 513 as a means for receiving a mail, but the present invention is not limited to this. The pager 513 may be replaced with a mobile phone, or another wireless transmission / reception device may be used.
(4) An emergency password is stored in advance in the key authentication device 50 in addition to the normal password, and in an emergency, the user inputs an emergency password from the fixed telephone 60 in addition to checking the authentication data. By doing so, the emergency passwords may be compared with each other. As a result, the accuracy of authentication is further increased, and security can be improved.
[0039]
(5) The security may be enhanced by periodically changing the password and updating the authentication data.
Specifically, the user inputs a conventional user ID, a mobile phone number, a pager number, and a new password from the mobile phone 40, and issues a transmission instruction. As a result, the CPU 401 of the mobile phone 40 transmits an HTTP request (hereinafter, referred to as “update data”) including the data input from the screen to the data server device 10. The data server device 10 receives the update data and creates the update authentication data based on the update data, similarly to the operation at the time of the authentication data registration described in the above embodiment. Then, the data server device 10 updates the key authentication system DB 1041 of the own device 10 and transmits an e-mail including the update authentication data to the mobile phone 40 and the key authentication device 50.
The mobile phone 40 receives the mail, and the CPU 401 updates the authentication data stored in the scratchpad 408a with the update authentication data included in the received mail. When the pager 513 of the key authentication device 50 receives the mail, the CPU 511 of the control device 51 performs the authentication data stored in the storage device 512 with the update authentication data included in the mail.
[0040]
(6) In the above embodiment, when unlocking, the user operates the mobile phone 40 to start a program for transmitting the authentication data, so that the mobile phone 40 transmits the authentication data to the key authentication device 50. Although transmission was performed, it is not limited to this. For example, the key authentication device 50 always transmits data for starting the authentication data transmission program of the mobile phone 40 by infrared communication, and when the user holds the mobile phone 40 over the door, The authentication data may be transmitted to the key authentication device 50 by activating the authentication data transmission program.
(7) In the above embodiment, when data such as authentication data was collated, if the data did not match, the process was terminated. However, data such as an error message is transmitted to the mobile phone 40. You may make it.
(8) The database configuration, data to be input by the user, data on which authentication data is created, a hash function to be used, and a communication protocol may be appropriately optimized.
[0041]
【The invention's effect】
As described above, according to the present invention, a key authentication system capable of unlocking or locking by performing verification of authentication data with a key authentication device even when a mobile phone can be used or not. Can be constructed.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration of a key authentication system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a data server device according to the embodiment.
FIG. 3 is a diagram schematically illustrating a data configuration of a key authentication system DB according to the embodiment.
FIG. 4 is a block diagram showing a configuration of a key authentication device according to the embodiment.
FIG. 5 is a block diagram showing a configuration of the mobile phone according to the embodiment.
FIG. 6 is a sequence chart for explaining operations at the time of authentication data registration and at the time of normal unlocking according to the embodiment.
FIG. 7 is a sequence chart for explaining an emergency operation according to the embodiment;
FIG. 8 is a view showing a key authentication system application screen according to the embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Key authentication system, 10 ... Data server device, 20 ... Internet, 30 ... Mobile communication network, 40 ... Mobile telephone, 50 ... Key authentication device, 60 ... Fixed telephone.

Claims (3)

Receiving means for receiving application data including user identification data for identifying a user;
Authentication data creating means for creating authentication data for authenticating the user from the application data received by the receiving means,
Application data storage means for storing the authentication data created by the authentication data creation means and the application data received by the reception means in a storage device in association with each other;
A method for unlocking or locking the authentication data for registration including the authentication data created by the authentication data creation means and the type data indicating that the authentication data is registration data with the portable communication terminal. Authentication data transmitting means for transmitting to the key authentication device;
Receiving unlocking request data for requesting unlocking or locking including the user identification data, reading out authentication data corresponding to the user identification data from a storage device stored by the application storage means, A server device having emergency means for transmitting emergency authentication data to the key authentication device, the emergency data including the type data indicating that the authentication data is data for verification,
Means for transmitting the application data to the server device;
Portable communication terminal storage means for receiving the registration authentication data transmitted from the server device and storing authentication data included in the registration authentication data,
Unlocking instruction transmission means for transmitting to the key authentication device collation authentication data including authentication data stored by the portable communication terminal storage means and type data indicating that the authentication data is collation data. A portable communication terminal having
Key authentication device storage means for receiving the registration authentication data transmitted from the server device and storing authentication data included in the registration authentication data,
Emergency unlocking instruction receiving means for receiving the emergency authentication data transmitted from the server device,
Unlocking instruction receiving means for receiving the verification authentication data transmitted from the portable communication terminal,
The authentication data included in the emergency authentication data received by the emergency unlocking instruction receiving unit, or the verification authentication data received by the unlocking instruction receiving unit, and the authentication data stored in the key authentication device storing unit. A key authentication system comprising: a key authentication device having unlocking means for unlocking or locking when the authentication data matches. Receiving means for receiving application data including user identification data for identifying a user; authentication data creating means for creating authentication data for authenticating the user from the application data received by the receiving means; An application storage unit for storing the authentication data created by the authentication data creation unit and the application data received by the reception unit in a storage device in association with each other; an authentication data created by the authentication data creation unit; Authentication data transmission means for transmitting registration authentication data including type data indicating that the data is data for registration to a portable communication terminal and a key authentication device for unlocking or locking; Receiving unlocking request data for requesting unlocking or locking including user identification data, and performing authentication corresponding to the user identification data Data is read from the storage device stored by the application storage means, and emergency authentication data including the authentication data and type data indicating that the authentication data is data for verification is transmitted to the key authentication device. Key authentication device storage means for storing authentication data included in the transmitted registration authentication data from a server device having an emergency means for performing
Means for transmitting the application data to the server device; portable communication terminal storage means for receiving the registration authentication data transmitted from the server device and storing authentication data included in the registration authentication data; Transmitting an unlock instruction to transmit the authentication data for verification including the authentication data stored by the portable communication terminal storage means and the type data indicating that the authentication data is data for verification to the key authentication device. From a portable communication terminal having means, for verification authentication data receiving means for receiving the verification authentication data,
Emergency authentication data receiving means for receiving the emergency authentication data from the server device,
Authentication data included in the emergency authentication data received by the emergency authentication data receiving unit, or authentication data included in the verification authentication data received by the verification authentication data receiving unit, and the key authentication A key authentication device comprising: unlocking means for unlocking or locking when the authentication data stored in the device storage means matches. An application data transmitting step in which the portable communication terminal transmits application data including user identification data for identifying the user;
An application data receiving step in which the server device receives the application data transmitted in the application data transmitting step;
An authentication data creating step of creating authentication data for authenticating the user from the application data received by the application data receiving step,
An application storage step of storing the authentication data created in the authentication data creation step and the application data received by the receiving means in a storage device in association with each other;
The authentication data for registration, which includes the authentication data created in the authentication data creation step and the type data indicating that the authentication data is data for registration, is used for unlocking or locking with the portable communication terminal. An authentication data transmitting step for transmitting to the key authentication device;
An authentication data storing step of receiving the registration authentication data transmitted in the authentication data transmitting step, and storing the authentication data included in the registration authentication data; When the portable communication terminal is used, the portable communication terminal includes authentication data stored in the authentication data storage step and type data indicating that the authentication data is data for verification. While transmitting authentication data for verification to the key authentication device,
When a communication terminal other than the portable communication terminal is used, the server device receives unlocking / locking request data for requesting unlocking / locking including the user identification data from the communication terminal, The authentication data corresponding to the user identification data is read from the storage device stored in the application storing step, and the emergency authentication data including the authentication data and the type data indicating that the authentication data is data for verification is included. Unlocking instruction to transmit to the key authentication device,
The key authentication device receives the verification authentication data transmitted in the unlocking instruction step, or the emergency authentication data, and the authentication data included in the verification authentication data, or the emergency authentication data A key unlocking step of unlocking or locking when the authentication data contained in the authentication data and the authentication data stored in the authentication data storing step match.

Images