JP2009094871A - Portable mobile terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a portable mobile terminal which has a function of protecting stored data and attains compatibility of both the user convenience and information security. <P>SOLUTION: The portable mobile terminal 10 is provided with a first storing part for storing at least data requiring security protection; a second storing part for holding authentication strength setting data, indicating authentication strength; and a protection executing part 7 for reading data from the first storing part and outputting the data, only when the authentication of the authentication strength indicated by the authentication strength setting data stored in the second storing part is executed to find that authentication is successful, when an access request to data requiring security protection is inputted, and changing the authentication strength setting data stored in the second storing part, when a change request is inputted through authentication processing and/or when a prescribed condition is satisfied. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a portable mobile terminal, and more particularly, to a portable mobile terminal having a function of protecting data held in the portable mobile terminal.

  With respect to portable mobile terminals represented by mobile phones, usage in data systems such as e-mails and web browsers is becoming widespread from the conventional usage centered on telephone functions. As such phone book data held in the portable mobile terminal, not only phone number data frequently used by users but also data such as mail address information and addresses are stored. Furthermore, portable mobile terminals are also storing email data sent and received and data downloaded by web browsers. Thus, portable mobile terminals are becoming devices that require ensuring information security. In particular, mobile mobile terminals used for business use may also hold business-related data, which may be corporate confidential information or trade secret data, and further attention needs to be paid to information security protection. ing.

  In order to protect information security, it is desirable to perform strong authentication processing such as requiring input of a complex password or requesting double authentication. However, such strong authentication processing is There are disadvantages in terms of convenience and speed. An authentication method using biometric authentication technology such as fingerprint recognition, which is less time-consuming and more secure than inputting a personal identification number, is being developed. There is a demerit that it is necessary and is subject to cost increase and restrictions on implementation.

  To prevent others from seeing the phone book data and mail data in the portable mobile terminal, set the corresponding data as secret data or store it in a secret designated folder. Some have the function to do. Since it is necessary to input a personal identification number in order to view the secret-set data, it is possible to prevent the secret-set data from being easily seen by others. Further, there is a function that can be set to either a secret mode that requires input of a personal identification number for reference to secret data or a non-secret mode that can refer to secret data without input of the personal identification number.

  However, the secret mode setting for determining whether or not a password input is required for data reference must be set by the user each time. Therefore, in the method of entrusting the secret mode setting to the user, security may be deteriorated due to forgetting to set. For example, there is a problem that if the user loses his / her mobile phone on the go without setting the secret mode, another person can easily view the secret data. Here, there is an option that the secret mode is always set. However, in this case, although it is advantageous in terms of security, the user must enter the password every time, which is convenient for the user. Is damaged.

  In JP 2004-118456 A (Patent Document 1), the position information of the mobile mobile terminal is obtained by using the GPS (Global Positioning System) in the mobile mobile terminal, and the past position of the user It is disclosed that a user is probabilistically estimated from information history data and the authentication strength is adjusted according to the estimation result. In this case, when it is estimated with high possibility that the user is the user himself / herself, the user's convenience is prevented from being lowered by performing identity verification in the authentication procedure with reduced strength. In this method, it is necessary to construct and maintain a system such as a server in order to hold past history data of location information about the user and to enable reference to the history data. There is a problem of incurring cost increase. Further, it cannot be said that sufficient verification has been made as to whether or not the user can be estimated with high accuracy from the history data of past position information.

  WO2002 / 003215 (Patent Document 2) proposes a method for protecting data security in a terminal such as a personal computer that may be used by a plurality of people. In this method, after the predetermined user information can be transmitted by the transmission control means, it can be transmitted before the elapse of a predetermined time and / or after execution of a predetermined operation, or in response to a predetermined instruction from the user. The transmitted user information cannot be transmitted. Specifically, a plurality of authentication levels are prepared, and the authentication level is changed as a predetermined time elapses. The device described in Patent Document 2 is not based on the assumption that the terminal itself moves.

  Japanese Patent Laid-Open No. 2001-306173 (Patent Document 3) determines whether a terminal is in a place where it should originally be used based on the power consumption according to the current power saving mode of the terminal, and according to the determination result. Thus, it is disclosed that the strength of authentication required from a user is changed. When the terminal is in a place where it should be (the user's own desk in the office), for example, authentication can be performed by inputting a shorter password.

  Japanese Patent Laying-Open No. 2003-099400 (Patent Document 4) discloses that the current position of a portable mobile terminal is detected by GPS or the like, and a security level is set according to the detected position.

  Japanese Patent Laid-Open No. 2003-196666 (Patent Document 5) stores a user's behavior pattern in a behavior area-time zone weighting table in advance, and the terminal is used at a time and place that matches the user's behavior pattern. It discloses that the security level is lowered and the security level is raised if the behavior pattern is not met.

Note that rewriting the security level itself is disclosed in JP-A-3-246647 (Patent Document 6).
JP 2004-118456 A WO2002 / 003215 publication JP 2001-306173 A JP 2003-099400 A JP 2003-196666 A JP-A-3-246647

  In a portable mobile terminal, changing the authentication level according to the location of the terminal in order to achieve both security and maintenance of the user's convenience is disclosed in Patent Documents 1, 3, 4, 5, etc. Has been.

  However, the methods using GPS and the like described in Patent Documents 1 and 4 need to incorporate hardware for receiving GPS into a terminal and cannot be applied to places where GPS radio waves cannot be received such as inside office buildings. There is. The one described in Patent Document 1 requires a server for storing history data, and the one described in Patent Document 4 requires that a security information table and an access right setting table be set in advance for each terminal. In the device described in Patent Document 3, there is a problem that the power consumption of the terminal is not necessarily a good index for the security level. With the thing of patent document 5, it is necessary to create the table which shows an action pattern beforehand, and to store in a server, The subject that the cost for server installation is also needed in addition to the effort of table preparation There is. From the viewpoint of protecting the security of data stored in a portable mobile terminal, there are cases where you want to access data in the terminal even when the portable mobile terminal is not connected to an external network or when GPS signals cannot be received. Therefore, authentication via a server connected to an external network or authentication level change using GPS is not preferable.

  As described above, the security protection of the portable mobile terminal in the related technology is sufficient in terms of protecting the data stored in the portable mobile terminal and ensuring information security while maintaining user convenience. It is not a thing.

  An object of the present invention is to provide a portable mobile terminal having a function of protecting stored data, which is compatible with user convenience and information security.

  A portable mobile terminal according to the present invention is a portable mobile terminal that holds data that requires security protection, a first storage unit that stores at least data that requires security protection, and an authentication strength setting that indicates authentication strength. A second storage unit that holds data and authentication strength authentication indicated by the authentication strength setting data stored in the second storage unit when an access request for data that requires security protection is input Only when the authentication is successful, the data is read out from the first storage unit and output, and when a change request is input through the authentication process and / or when a predetermined condition is satisfied, A protection execution unit that changes authentication strength setting data stored in the storage unit 2.

  The present invention performs authentication of authentication strength indicated by authentication strength setting data when access to data is requested, and when a change request is input through an authentication process and / or when a predetermined condition is satisfied Further, by changing the authentication strength setting data, there is an effect that it is easy for the user of the portable mobile terminal to achieve both convenience and security.

  Next, exemplary embodiments of the present invention will be described. FIG. 1 is a block diagram illustrating a configuration of a mobile terminal device according to an exemplary embodiment. The portable mobile terminal of the present exemplary embodiment provides an environment in which convenience and information security can be easily achieved by changing the strength of authentication such as the complexity of a password according to the situation. Specifically, for example, simple authentication is performed within a certain period of time, or simple authentication is performed in an office where physical security is protected. Use authentication.

  A mobile mobile terminal 10 shown in FIG. 1 includes a user data storage unit 1 that stores user data such as telephone directory data and sent / received mail data, a setting data storage unit 2 that stores authentication strength setting data, which will be described later, and a user. Input unit 3 used for inputting a data access request and an input of a password or a personal identification number, an authentication strength holding timer 4 for measuring time, and detecting entry into and exit from a physically secure space An entry / exit detection unit 5, a display unit 6 that displays user data to the user, and a protection execution unit 7 that executes security protection for data in the user data storage unit 1 are provided. Here, when the access request for the data in the user data storage unit 1 is input from the input unit 3, the protection execution unit 7 refers to the authentication strength setting data in the setting data storage unit 2 and performs user authentication. In addition to determining whether or not data can be accessed, the authentication strength setting data itself can be changed to an appropriate function. The space in which security is physically secured is a space in which it is physically ensured that no outsider enters, and this space is hereinafter referred to as a security area. As an example of the security area, there is a living room where the individual identification and authentication of the visitor is performed when entering the security area.

  In the present exemplary embodiment, as shown in FIG. 2, the user data storage unit 1 includes a storage area for the phone book data 11, a storage area for the outgoing mail data 12, and a storage area for the incoming mail data 13. It is divided into These storage areas for each data type store normal data areas 11a, 12a, and 13a for storing data for storing data that does not require security protection, and data that is highly confidential and requires security protection. The data is further divided into protected data areas 11b, 12b, and 13b for storing data to be used. That is, highly confidential data among the phone book data 11 is stored in the protected data area 11b, and data that does not require security protection among the received mail data is stored in the normal data area 13a. Here, it is assumed that the user data storage unit 1 stores the phone book data 11, the outgoing mail data 12, and the incoming mail data 13. However, of course, other types of data, for example, the camera function of the portable mobile terminal are used. The captured image data may be stored in the user data storage unit 1.

  Next, authentication strength setting data stored in the setting data storage unit 2 will be described. The authentication strength setting data is data indicating the strength of authentication for determining whether or not access to the protected data areas 11b, 12b, and 13b is possible. In other words, the authentication strength setting data is data indicating how much authentication is performed in order to permit access when there is an access request for data stored in the protected data areas 11b, 12b, and 13b. It is. In this exemplary embodiment, three levels of “low”, “medium”, and “high” are prepared as authentication strengths, and any of these is stored in the setting data storage unit 2 as authentication strength setting data. Shall be. Here, “low” in the authentication strength indicates that authentication non-application processing is applied. The authentication non-application process is a process that does not require an authentication procedure such as input of a personal identification number. “Medium” of the authentication strength indicates that the simple authentication process is applied. The simple authentication process is a simple authentication process that is not so strong, such as authentication by inputting a password of about 4 digits. “High” in the authentication strength indicates that the complex authentication process is applied. The complex authentication procedure is an authentication process that requires a complicated procedure with high security strength, such as authentication that requires the input of a long character string password or a one-time password.

  In this exemplary embodiment, the user may be able to change the authentication strength setting data in the setting data storage unit 2 via the protection execution unit 7, but in that case, the protection execution unit 7 It is preferable to automatically update the authentication strength to “high” when an authentication strength holding timer 4 (for example, a 3-hour timer) has elapsed since the authentication strength setting data was changed. Further, as will be described later, when it can be confirmed that the mobile mobile terminal exists in the security area, the protection execution unit 7 automatically reduces the authentication strength by changing the authentication strength setting data. It may be.

  The entry / exit detection unit 5 detects whether the portable mobile terminal is brought into a security area such as an office where only a specific employee can enter, or whether it is taken out from the security area. . When a wireless LAN is installed in the security area, radio waves from a wireless LAN base station are received, and entry / exit can be detected depending on whether the wireless LAN is in the service area or outside the area. Therefore, the entry / exit detection unit 5 is configured by a circuit that receives radio waves from the wireless LAN and discriminates the inside / outside of the service area. Alternatively, when the user enters or leaves the security area, an entry / exit detection unit is used when communication is performed between an identification card made up of a non-contact IC card and a non-contact card reader installed at the entrance / exit gate. 5 may be one that receives a signal from the communication and determines entry or exit.

  Next, the operation of security protection in the portable mobile terminal of the present exemplary embodiment will be described.

  When a request for referring to data in the user data storage unit 1 (for example, any one of the phone book data 11, the transmitted mail data 12, and the received mail 13) is input via the input unit 3, the protection execution unit 7 firstly Then, a process (FIG. 3) for determining the authentication strength is started when accessing the protected data area.

  In the process shown in FIG. 3, in step 110, the protection execution unit 7 determines whether the data requested for reference is stored in the normal data areas 11a, 12a, 13a in the user data storage unit 1, or the protection data area 11b, Whether the data is stored in 12b or 13b is determined. When the access request is for the data stored in the normal data area, the process proceeds to step 112, where the protection execution unit 7 executes the authentication non-applying process, and does not authenticate the user. The corresponding data in 1 is read and displayed on the display unit 6.

  On the other hand, if it is determined in step 110 that the access is to the protected data area, the protection execution unit 7 reads the authentication strength setting data stored in the setting data storage unit 2 in step 111 and reads the authentication strength. The setting intensity is determined according to the setting data (step 113). If it is determined in step 113 that the authentication strength is “low”, the process proceeds to step 112 described above, and authentication non-application processing is applied. If the authentication strength is determined to be “high” in step 113, the protection execution unit 7 proceeds to step 114 and executes complex authentication processing. In this case, the protection execution unit 7 requests the user to perform authentication requiring a complicated procedure such as inputting a long character string password or a one-time password, and the user data storage unit only when the authentication is successful. The corresponding data in 1 is read and displayed on the display unit 6. If it is determined in step 113 that the authentication strength is “medium”, the process proceeds to step 115 and the protection execution unit 7 applies the simple authentication process. In this case, the protection execution unit 7 requests a simple authentication procedure for requesting the user to input a PIN number of about 4 digits, and if the authentication is successful, the protection execution unit 7 retrieves the corresponding data in the user data storage unit 1. The data is read out and displayed on the display unit 6.

  In the portable mobile terminal of this exemplary embodiment, the user can change the authentication strength setting data. Next, processing when the user changes authentication strength setting data will be described with reference to FIG.

  When the user requests to change the authentication strength setting by a menu operation or the like via the input unit 3, the protection execution unit 7 first performs complex authentication similar to that in step 114 described above in step 120 of FIG. Perform the process. Then, it is determined whether or not the user has succeeded in this complicated authentication (step 121). If the authentication has succeeded, the protection execution unit 7 determines in step 122 that the new authentication strength (“high”, "Medium" or "Low") is stored in the setting data storage unit 2 as authentication strength setting data, thereby updating the authentication strength setting data. Subsequent to step 121, in step 122, the protection execution unit 7 activates the authentication strength holding timer 4 (for example, a three-hour timer), and ends the processing for changing the authentication strength setting. On the other hand, when it is determined in step 121 that the authentication in step 120 has failed, the protection execution unit 7 executes an error process (step 124) and ends the process. If the authentication fails, the authentication strength setting data is not updated.

  When the predetermined time elapses and the authentication strength holding timer 4 expires (time up), the protection execution unit 7 starts the authentication strength holding timer expiration processing, and the processing of step 125 in FIG. 4B is executed. In step 125, the protection execution unit 7 sets the authentication strength setting data stored in the setting data storage unit 2 to the authentication strength “high”. As a result, when a predetermined time indicated by the authentication strength holding timer 4 has elapsed since the authentication strength setting data was changed, the authentication strength is automatically updated to “high”.

  Here, the authentication strength is unconditionally reset to “high” when the authentication strength holding timer 4 expires. For example, when the number of authentication strength setting steps exceeds 3, the authentication strength is You may make it return to the authentication intensity | strength before change of intensity | strength setting data. In this case, when the authentication strength setting data is changed so that the authentication strength is lowered, the protection execution unit 7 stores the authentication strength setting data before the change in the setting data storage unit 2 as pre-change data. In addition, when the authentication strength holding timer 4 expires, it is checked whether the pre-change data is stored in the setting data storage unit 2, and if it is stored, the pre-change data is reset as authentication strength setting data. You can do it.

  Next, automatic change of the authentication strength setting data when entry into and exit from the security area can be detected will be described with reference to FIG.

  When the entry / exit detection unit 5 detects entry into the security area, the protection execution unit 7 starts the security area entry process. In the security area entry process, the protection execution unit 7 sets the authentication strength setting data stored in the setting data storage unit 2 to authentication strength “medium” in step 130 of FIG. In the same manner as described above, the authentication strength holding timer 4 is activated and the security area entry processing is terminated.

  When the portable mobile terminal leaves the security area, the entrance / exit detection unit 5 detects this, and the protection execution unit 7 starts the security area exit process. In the security area leaving process, the protection execution unit 7 sets the authentication strength setting data stored in the setting data storage unit 2 to authentication strength “high” in step 132 of FIG. That is, when the mobile mobile terminal enters the security area, the authentication strength is automatically set to “medium” and data in the mobile mobile terminal can be accessed by simple authentication processing. When the user exits the security area, the authentication strength is automatically “high”, and data can be accessed only by a complicated authentication operation. This is because personal authentication is performed when a user enters the security area, and security problems are unlikely to occur even if the authentication strength of the portable mobile terminal is reduced under such circumstances. Because. In this case as well, the data before change is stored in the setting data storage unit 2 when entry into the security area is detected, and the data before change is used as authentication strength setting data when exit from the security area is detected. You may make it reset.

  Since the authentication strength holding timer 4 is also started here, if the mobile mobile terminal continues to exist in the security area, the authentication strength is set when the authentication strength holding timer 4 expires. “High”.

  As described above, in the mobile terminal device of this exemplary embodiment, by combining the processes shown in FIGS. 3 to 5, the user succeeds in the complex authentication process and sets the authentication strength to “medium”, or By entering the security area, a simple authentication process is applied, and the data in the protected data area in the mobile mobile terminal can be accessed by a simple authentication procedure. In addition, the complicated authentication procedure is applied to the time when the authentication holding timer 4 expires or the user leaves the security area and Ai Tamba.

  As described above, in the portable mobile terminal of this exemplary embodiment, simple authentication is performed within a certain time after the strong authentication process is performed, or simple authentication is performed in an office where physical security is protected. Convenience for the user and information security are achieved by using simple authentication under certain conditions and strong authentication otherwise. Even if the authentication strength is changed to “medium” or “low” by the user operation and the authentication strength is lowered (decreased security state), the authentication strength holding timer 4 (for example, a 3-hour timer) expires. Is updated to “high” to enhance security. The same applies when the security strength is lowered after entering the security area.

  As described above, in this exemplary embodiment, the authentication strength can be set on the safe side that the authentication strength is “high” (security is high) unless the user consciously performs the update operation, and is lost or stolen. In such cases, the risk of information leakage can be reduced.

  It should be noted that by adjusting the timer value of the authentication strength holding timer 4, the user can determine the balance between safety and convenience.

  In the above description, the authentication strength setting has been described as three levels of “high”, “medium”, and “low”, but it is also possible to set two or more levels. Further, although the authentication strength is changed to “high” when the authentication strength holding timer expires, it may be changed to another set value such as “medium”.

  In addition, although the example of the contactless card and the wireless LAN has been described as the method for detecting entry into and exit from the security area, various various methods such as position detection using a GPS (Global Positioning System) signal are conceivable. . Moreover, although the example of PIN code and password input was described as the authentication method, another authentication method such as biometric authentication may be used.

  The portable mobile terminal of the present exemplary embodiment described above can also be realized by causing a portable computer to read a computer program for realizing it and executing the program. Specifically, a computer memory or an external storage device is used as the user data storage unit 1 and the setting data storage unit 2, a human-machine interface part in the computer is used as the input unit 3 and the display unit 6, and a wireless LAN The network interface portion is used as the entry / exit detection unit 5, and the computer CPU functions as the authentication strength holding timer 4 and the protection execution unit 7 by executing a program. A program that causes a computer to function as the above-described portable mobile terminal is read into a portable computer using a recording medium such as a memory card, an external interface such as a USB, and further via a network. The category of the present invention includes a program for causing a computer to function as the portable mobile terminal described above.

It is a block diagram which shows the structure of the portable mobile terminal of example embodiment of this invention. It is a figure which shows the storage structure of the data in a user data storage part. It is a flowchart explaining the process which determines the authentication strength at the time of access to the data stored in the user data storage part. It is a flowchart explaining the process which sets authentication strength setting data manually. It is a flowchart explaining the process which changes authentication intensity | strength setting data automatically, when entering into a security area and leaving a room are detectable.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 User data storage part 2 Setting data storage part 3 Input part 4 Authentication strength maintenance timer 5 Entrance / exit detection part 6 Display part 7 Protection execution part 10 Portable mobile terminal 11 Phonebook data 12 Transmission mail data 13 Reception mail data 11a, 12a, 13a Normal data area 12b, 13b, 14b Protected data area

Claims (7)

A portable mobile device that holds data that requires security protection,
A first storage unit for storing at least data that requires security protection;
A second storage for holding authentication strength setting data indicating the authentication strength;
When an access request for data requiring security protection is input, authentication at the authentication strength indicated by the authentication strength setting data stored in the second storage unit is executed and the authentication is successful. Only when the data is read out from the first storage unit and output, and when a change request is input through an authentication process and / or when a predetermined condition is satisfied, the data is stored in the second storage unit. A protection execution unit for changing the authentication strength setting data being
A portable mobile terminal. A timer for measuring a predetermined time;
The portable mobile terminal according to claim 1, wherein the protection execution unit starts the timer simultaneously with the change of the authentication strength setting data, and re-changes the authentication strength setting data when the timer expires.   The portable mobile terminal according to claim 1 or 2, wherein the protection execution unit re-changes the authentication strength setting data when the predetermined condition is not satisfied.   When the authentication strength setting data is changed, the authentication strength setting data is updated so that the authentication strength is lower than before the change, and when the authentication strength setting data is changed again, the authentication strength is higher than before the change. The mobile mobile terminal according to claim 2 or 3, wherein the authentication strength setting data is updated as described above.   In the change of the authentication strength setting data, the authentication strength setting data is updated so that the authentication strength is lower than before the change, and the pre-change data indicating the authentication strength before the change is stored in the second storage unit. And storing the authentication strength setting data in the re-change of the authentication strength setting data by reading the pre-change data from the second storage unit and reading the pre-change data. 3. The mobile mobile terminal according to 3. The first storage unit includes a protected data area for storing data that requires the security protection, and a normal data area for storing data that does not require security protection,
When the access request to the data is input, the protection execution unit determines whether the access request is an access request for the data stored in the normal data area or an access request for the data stored in the protected data area. The mobile mobile terminal according to claim 1, wherein the mobile mobile terminal is determined.   The portable mobile terminal according to any one of claims 1 to 6, wherein the predetermined condition is that the portable mobile terminal is present in a space in which security is physically secured.

Images