JP2009130833A - Authority transfer system, mobile terminal, id management server, authority transfer method, and authority transfer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authority transfer system capable of safely performing authority transfer, while ensuring convenience, mutually between an IC card and an IC chip mobile phone. <P>SOLUTION: The authority transfer system 1 includes an IC card 600, a mobile terminal 400 and an ID management server 100, wherein the mobile terminal communicates with the IC card, reads a first ID 610 and transmits it to the ID management server, and the ID management server receives the first ID from the mobile terminal and confirms whether the first ID received from a second transmitting and receiving means is identical to a second ID 220 stored in an ID management database 120. When both the first ID and the second ID are identical to each other, the ID management server produces a temporary ID 240 and transmits it to the mobile terminal, and the mobile terminal receives the temporary ID and stores it in an IC chip 450. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to delegation of authority between an IC card and an IC chip mobile phone, and particularly relates to delegation of authority concerning personal information.

  Currently, various services using IC cards equipped with IC chips are realized. Specifically, such as Suica (registered trademark) of East Japan Railway Company and PASMO (registered trademark) of private railway companies in the Kanto region, just by bringing the IC card close to the IC tag handling device, Those that can pay for fares and various charges other than fares are rapidly spreading. In the business scene, IC cards are used as passports and employee ID cards, and the use of opening / closing entrance gates and logging in to PCs is expanding.

  Similarly, mobile phone terminals, such as Osaifu-Keitai (registered trademark) of NTT Docomo, Inc., can be provided with a service equivalent to an IC card by mounting an IC chip. Hereinafter, a mobile phone terminal equipped with an IC chip is referred to as an IC chip mobile phone. In an IC chip mobile phone, there is a possibility that a service that is more convenient than a service realized by an IC card may be realized due to the presence of a GUI and a mobile application.

  For example, in the entrance / exit service using the personal authentication service by the IC card such as the above-mentioned pass card or employee card, by using an IC chip mobile phone, the mobile phone web can be used by using three-party communication at the time of entrance / exit. A service is conceivable in which a browser is automatically started or an e-mail is transmitted to the mobile phone to display the schedule of the authenticated individual on the day.

  Incidentally, the following technologies are related to the delegation of authority of the IC card personal authentication service. Patent Document 1 discloses a technique for delegating authority from a first card to a second card with a portable terminal to which a plurality of IC cards can be connected. Patent Document 2 discloses a technology for linking both applications in a portable terminal in which an IC card is mounted. Patent Document 3 discloses a technique for taking over the ID of a railway IC card to a new IC card.

JP 2002-335578 A JP 2004-094499 A JP 2004-310683 A

  However, when a personal authentication service using an IC card is already used by a user, if a personal authentication service using an IC chip mobile phone is used by the same user, there will be a plurality of personal authentication media. As a result, there is a problem with the strictness of personal authentication, and the risk of theft or loss increases. There are many cases where an IC card also functions as a credit card. In such a case, especially when one of the IC card and the IC chip mobile phone is stolen, the damage is increased.

  In order to solve the problem of the strictness of personal authentication, it is necessary to stop the personal authentication service of the IC card and delegate the authority of the personal authentication service (hereinafter simply referred to as authority) to the IC chip mobile phone. When delegating authority from the IC card to the IC chip mobile phone, the personal authentication service of the IC card is stopped at the authentication device or the server that manages the authentication device at the higher level, and then the IC chip. A new ID for personal authentication is given to the mobile phone.

  At that time, the user must perform some procedure, stop the personal authentication ID of the IC card, and store a new personal authentication ID in the IC chip mobile phone. However, if human work is involved in the procedures related to the suspension of the personal authentication ID of the IC card and the storage of a new personal authentication ID in the IC chip mobile phone, the wrong authority is transferred due to a work mistake or the like. There is a danger that it will be lost.

  On the other hand, when the above work is performed by a computer without involving human work, the IC card, the IC chip mobile phone, and the computer need to be connected to each other via a network or the like. However, in an environment where the IC tag handling device does not exist nearby, for example, when the user is moving, the IC card cannot be connected to the computer, so that the authority delegation process is impossible. As described above, there is no effective solution in the prior art for securing the convenience and safely delegating authority between the IC card and the IC chip mobile phone.

  Incidentally, since the technique of Patent Document 1 requires that a plurality of IC cards can be connected to a mobile terminal, it cannot be used for delegating authority between the IC card and the IC chip mobile phone. Since the technology of Patent Document 2 has an application on an IC card and is intended to be linked with an application on a mobile terminal, it cannot be used for delegating authority between the IC card and the IC chip mobile phone. The technology of Patent Document 3 delegates the IC card ID to a new IC card, but requires a ticket vending machine that includes an IC tag handling device and is always connected to a computer. In other words, none of Patent Documents 1 to 3 solves the above problem even if they are combined.

  An object of the present invention is to transfer authority between an IC card and an IC chip mobile phone, in which the IC tag handling device can be securely transferred even in an environment where an IC tag handling device is not nearby. A system, a portable terminal, an ID management server, an authority delegation method, and an authority delegation program are provided.

  In order to achieve the above object, an authority delegation system according to the present invention comprises an IC card, a portable terminal, and an ID management server, and is an authority delegation system for delegating the authority of an IC card personal authentication service to a portable terminal. The IC card has a first IC chip storing a first ID, and the portable terminal communicates with the first IC chip to read the first ID; A first transmission / reception unit that transmits the ID of 1 to the ID management server; and an ID writing unit that stores data received via the first transmission / reception unit in the second IC chip. A second transmission / reception means for transmitting / receiving data to / from the portable terminal; an ID management database for storing a second ID corresponding to the first ID; a first ID received from the second transmission / reception means; Same as 2 ID When the first ID and the second ID are the same as the ID confirmation means for confirming whether or not there is, a temporary ID is generated, and the temporary ID is transmitted to the portable terminal via the second transmission / reception means. And an ID creating means.

  In order to achieve the above object, a portable terminal according to the present invention includes an IC card, a portable terminal, and an ID management server, and is used in an authority delegation system that delegates the authority of the personal authentication service of the IC card to the portable terminal. A second IC chip that communicates with the first IC chip and reads the ID; a transmission / reception means for transmitting the ID to the ID management server and receiving the temporary ID from the ID management server; and the temporary ID And an ID writing means for storing in the second IC chip.

  In order to achieve the above object, an ID management server according to the present invention comprises an IC card, a portable terminal, and an ID management server, and is used in an authority delegation system that delegates the authority of the personal authentication service of the IC card to the portable terminal. An ID management server, a transmission / reception means for receiving a first ID from a mobile terminal, an ID management database for storing a second ID corresponding to the first ID, a first ID and a second ID ID confirmation means for confirming whether or not are the same, a temporary ID is generated when the first ID and the second ID are the same, and the temporary ID is carried via the second transmission / reception means And an ID creating means for transmitting to the terminal.

  In order to achieve the above object, an authority delegation method according to the present invention includes an IC card having a first IC chip storing a first ID, a portable terminal having a second IC chip, In an authority delegation system comprising an ID management server having an ID management database for storing a second ID corresponding to an ID and delegating the authority of the personal authentication service of the IC card to the portable terminal, the authority of the personal authentication service of the IC card is given ID is a method of delegating to a portable terminal, wherein the portable terminal communicates with the first IC chip to read the first ID, and the portable terminal transmits the first ID to the ID management server. The transmission step, the ID reception step in which the ID management server receives the first ID from the portable terminal, and the ID management server check whether or not the first ID and the second ID are the same. An ID confirmation step, a temporary ID generation step in which the ID management server generates a temporary ID when the first ID and the second ID are the same, and the ID management server sends the temporary ID to the second transmission / reception means. A temporary ID transmission process for transmitting to the mobile terminal via the mobile terminal, a temporary ID reception process for the mobile terminal to receive the temporary ID, and a temporary ID storage process for the mobile terminal to store the temporary ID in the second IC chip. It is characterized by having.

  In order to achieve the above object, an authority delegation program according to the present invention comprises an IC card having a first IC chip storing an ID, a portable terminal having a second IC chip, and an ID management server. In an authority delegation system for delegating the authority of an IC card personal authentication service to a mobile terminal, the computer composing the mobile terminal communicates with the first IC chip to read the ID, and the ID is transferred to the ID management server. A process of transmitting, a process of receiving a temporary ID from the ID management server, and a process of storing the temporary ID in the second IC chip are executed.

  In order to achieve the above object, another authority delegation program according to the present invention includes an IC card having a first IC chip storing a first ID, a portable terminal having a second IC chip, An ID delegation system comprising an ID management server having an ID management database for storing a second ID corresponding to one ID, and delegating the authority of the personal authentication service of the IC card to the portable terminal, comprising the ID management server To the computer to receive the first ID from the portable terminal, to check whether the first ID and the second ID are the same, the first ID and the second ID, A right delegation program that executes a process of generating a temporary ID and a process of transmitting the temporary ID to the mobile terminal via the second transmission / reception means when they are the same.

  In the present invention, as described above, the portable terminal reads the ID from the IC card and transmits it to the ID management server, and the ID management server generates the temporary ID and transmits it to the portable terminal. If communication with the card is possible, it is not necessary to provide another IC tag handling device. As a result, even in an environment where an IC tag handling device is not nearby between the IC card and the IC chip mobile phone, it is possible to secure the convenience and safely transfer the authority. An excellent authority delegation system, portable terminal, ID management server, authority delegation method, and authority delegation program can be provided.

  FIG. 1 is a block diagram showing a configuration of a network 1 and an IC card 600, an IC chip mobile phone 400, and an ID management server 100 constituting the network 1 according to the embodiment of the present invention.

  In the network 1, the ID management server 100 and the IC chip mobile phone 400 are connected to each other via a public wireless communication network 700 that is a general wireless and wired network for mobile phone communication. In addition, the IC chip mobile phone 400 and the IC card 600 are connected to each other via short-range wireless communication using an IC chip (described later) built in each other.

  The ID management server 100 is a computer device that operates under program control, and manages, confirms, creates IDs, and manages mobile applications. The ID management server 100 includes a portable application management system 110, an ID management DB 120, an ID management system 130, a transmission / reception means 140, and a user interface 150.

  The mobile application management system 110 is a computer program that is executed by the ID management server 100, has a transmission / reception unit 111, and stores a mobile application 300. It has a function of receiving a mobile application transmission command received by the transmission / reception means 111 and passing the stored mobile application 300 to the transmission / reception means 111. The transmission / reception unit 111 has a function of delivering the portable application 300 to the transmission / reception unit 140 in accordance with a command received from the transmission / reception unit 140.

  The ID management DB 120 is a database and manages the ID master 200. The data structure of the ID master 200 will be described later. The ID management system 130 is a computer program executed by the ID management server 100, and includes an ID confirmation unit 131, a decryption unit 132, an ID creation unit 133, and an encryption unit 134. Each of these functions will be described later.

  The transmission / reception unit 140 receives a command and data from the outside, a function to transfer the received command and data to the transmission / reception unit 111 and the decryption unit 132, and a transmission / reception unit 111, an ID confirmation unit 131, and an encryption unit 134. The command and data are transmitted to the outside through the user interface 150.

  The user interface 150 is an interface for providing a simple operation to the user when the user accesses the ID management server 100 through the public wireless communication network 700 from the transmission / reception means 420 of the IC chip mobile phone 400, such as a web page. It is. In response to an access request from the outside, it has a function of transmitting data for operating the interface, and a function of transmitting commands and data to the outside through the transmission / reception means 140.

  FIG. 2 is a conceptual diagram showing a data structure of the ID master 200 shown in FIG. The ID master 200 stores the personal information 210, the ID 220, the availability 230, and the temporary ID 240 in a format in which each is uniquely identified.

  The personal information 210 is data for identifying the user. For example, the first name, the date of birth, and the address are applicable. The personal information 210 is information for identifying the user of ID 220 for the convenience of management, and is not particularly used in the processing described in the present embodiment. The ID 220 is an identifier uniquely assigned to each user assigned corresponding to the personal information 210. ID 220 corresponds to ID 610 built in IC card 600.

  The availability 230 is data indicating whether or not the user indicated by the ID 220 can use the authority transfer service according to the present embodiment. The availability 230 has a status of “available” and “not available” and is represented by a boolean, a number, a character, or the like. Here, the statuses “available” and “unavailable” are represented by the letters “Y” and “N”, respectively. The initial value is “Y (available)”. The temporary ID 240 is data generated by the ID creation unit 133 in one-to-one correspondence with the ID 220.

  Returning to FIG. 1, in the ID management system 130, the ID confirmation unit 131 receives the ID 610 of the IC card 600 from the decryption unit 132 and collates it with the ID 220 in the ID master 200. If ID 220 and ID 610 do not match as a result of the collation, data indicating that the data is not applicable is transmitted to the transmission / reception means 140.

  If the ID 220 and the ID 610 match, the presence of the temporary ID 240 is confirmed, and if it does not exist, the ID creation means 133 is instructed to create the temporary ID 240. And the status of availability 230 is changed according to each case. Furthermore, a temporary ID deletion command can be passed to the transmission / reception means 140.

  The decryption unit 132 receives data from the transmission / reception unit 140, decrypts the received data, and passes it to the ID confirmation unit 131. As the decryption method, a method corresponding to the encryption method used in the encryption unit 540 described later is used.

  The ID creation unit 133 can generate a temporary ID 240 corresponding to the ID 220, write the temporary ID 240 to the ID master 200, and pass it to the encryption unit 134. The encryption unit 134 encrypts the received data and passes it to the transmission / reception unit 140. The encryption method is a known method such as a common key method or a public key encryption method.

  The portable application 300 is a computer program stored in the portable application management system 110, and has an ID writing means 310, a decrypting means 320, an ID erasing means 330, and an encrypting means 340. The portable application 300 is sent to the IC chip portable telephone 400 by the transmission / reception means 140 via the public wireless communication network 700 and operates as the portable application 500 there.

  The functions of the ID writing unit 310, the decrypting unit 320, the ID erasing unit 330, and the encrypting unit 340 are the ID writing unit 510, the decrypting unit 520, the ID erasing unit 530, and the encrypting unit 540 in the portable application 500, respectively. Since the IC chip mobile phone 400 operates, these functions will be described later.

  The IC chip mobile phone 400 is a mobile phone equipped with an IC chip, for example, a mobile phone equipped with a mobile FeliCa (registered trademark), and includes a user interface 410, transmission / reception means 420, a storage area 430, an IC chip 440, and an IC chip. And a data transmission / reception function 450.

  The user interface 410 is an interface for the user to operate the IC chip mobile phone 400 to execute each function. This includes a mobile phone menu screen, a mobile phone web browser, and the like, and includes functions of the mobile phone menu screen and mobile phone web browser.

  The transmission / reception means 420 transmits / receives data and programs to / from the outside through the public wireless communication network 700 by a general data transmission / reception method in a mobile phone. The storage area 430 is an area where data and programs can be stored in the IC chip mobile phone 400. A portable application 500 is stored here. The storage area 430 stores the mobile application 300 transmitted from the mobile application management system 110 as the mobile application 500.

  The IC chip 440 has a function of receiving a command of the IC chip data transmission / reception function 450 and reading data in another IC chip and a function of passing the read data in the other IC chip to the IC chip data transmission / reception function 450.

  The IC chip data transmission / reception function 450 is a function that is normally installed in an IC chip mobile phone. The IC chip data transmission / reception function 450 instructs the IC chip 440 to read data in another IC chip, and the data read by the IC chip 440 is read. The data is transmitted to the encryption unit 540. Further, it receives a command from the portable application 500 or receives data from the ID writing means 510 and writes it to the IC chip 440. Then, the temporary ID 240 deletion command is received from the ID deleting unit 530 and the temporary ID 240 written in the IC chip 440 is deleted.

  The portable application 500 is a portable application 300 in which the portable application 300 is stored in the storage area 430, and includes an ID writing unit 510, a decrypting unit 520, an ID deleting unit 530, and an encrypting unit 540. At the same time, the portable application 500 also has a menu screen for the user to operate, a function for displaying information received from the transmission / reception means 420, and a function for instructing the IC chip data transmission / reception function 450.

  The ID writing unit 510 passes the data received from the decryption unit 520 to the IC chip data transmission / reception function 450. Decryption means 520 decrypts the data passed from transmission / reception means 420 and passes it to ID writing means 510. As a decryption method, a method corresponding to the encryption method used in the encryption unit 134 is used.

  The ID erasure unit 530 passes the temporary ID 240 erasure command received from the transmission / reception unit 420 to the IC chip data transmission / reception function 450. The encryption unit 540 has a function of receiving data, encrypting it, and passing it to the transmission / reception unit 420. The encryption method is a known method such as a common key method or a public key encryption method.

  The IC card 600 is a commonly used IC card such as Suica (registered trademark), PASMO (registered trademark), or FeliCa (registered trademark), and has an IC chip 620 mounted thereon. An ID 610 is written in the IC chip 620. ID 610 corresponds to ID 220 described above.

  FIG. 3 is a flowchart showing an operation when delegating authority from the IC card 600 to the IC chip mobile phone 400 in the network 1 shown in FIG.

  A user who intends to use the authority transfer service first downloads the mobile application 300 to the storage area 430 of the IC chip mobile phone 400. The user accesses the ID management server 100 using the user interface 410 of the IC chip mobile phone 400. Here, as a method of accessing the ID management server 100 from the user interface 410, the URL of the ID management server 100 is designated and connected. You may make it access by methods other than this.

  The user interface 410 passes an access request to the URL of the ID management server 100 designated by the user to the transmission / reception means 420. The transmission / reception means 420 passes an access request to the user interface 150 through the public wireless communication network 700. The user interface 150 receives the access request and passes the web page data to the transmission / reception means 420. The transmission / reception means 420 passes the received web page data to the user interface 410. The user interface 410 displays the received web page data.

  The user downloads the mobile application 300 from the displayed web page. The user interface 410 passes a download command for the portable application 300 executed by the user to the transmission / reception means 420. The transmission / reception means 420 passes the received download command of the portable application 300 to the transmission / reception means 140. The transmission / reception means 140 passes the received download command of the portable application 300 to the transmission / reception means 111 (step S1).

  The transmission / reception unit 111 passes the portable application 300 to the transmission / reception unit 140. The transmission / reception unit 140 passes the portable application 300 to the transmission / reception unit 420 via the public wireless communication network 700. The transmission / reception means 420 stores the portable application 300 in the storage area 430. Thereafter, the portable application 300 is stored and operated as the portable application 500 in the storage area 430 (step S2).

  The user causes the IC chip mobile phone 400 to execute the mobile application 500. The user operates the portable application 500 and sends a command to start the authority transfer service to the IC chip data transmission / reception function 450. The IC chip data transmission / reception function 450 executes the received authority delegation service start command, and instructs the IC chip 440 to read data from another IC chip (step S3). At the same time, the user brings the IC card 600 loaded with the IC chip to be read close to the IC chip mobile phone 400.

  The IC chip 440 reads the ID 610 in the IC chip 620 (step S4) and passes it to the IC chip data transmission / reception function 450. The IC chip data transmission / reception function 450 passes the received ID 610 to the encryption unit 540. The encryption unit 540 encrypts the received ID 610 and passes it to the transmission / reception unit 420. The transmission / reception means 420 passes the encrypted ID 610 to the transmission / reception means 140 (step S5).

  The transmission / reception means 140 receives the encrypted ID 610 and passes it to the decryption means 132. The decryption unit 132 receives the encrypted ID 610, decrypts it, and passes it to the ID confirmation unit 131. The ID confirmation unit 131 collates the ID 220 in the ID master 200 with the received ID 610 (step S6).

  FIG. 4 is a flowchart showing the contents determined by the ID confirmation unit 131 when collating ID 220 and ID 610 shown in step S6 of FIG. When starting, the ID confirmation unit 131 determines whether or not the ID 220 and the ID 610 are the same (steps S21 to S22). If they are not the same, the process proceeds to step S24, a reply “data not applicable” is sent to the transmission / reception means 140, and the process proceeds to step S8 in FIG.

  If it is determined in step S22 that they are the same, it is confirmed whether or not a temporary ID 240 corresponding to the ID 220 exists (step S23). If the temporary ID 240 does not exist, the ID creation unit 133 is instructed to create the temporary ID 240 and the status of the availability 230 corresponding to the ID 220 is changed to the “unusable” state (step S25). Thereafter, the process proceeds to step S7 in FIG.

  When the temporary ID 240 exists in step S23, the temporary ID 240 deletion command is passed to the transmission / reception means 140, and the status of the availability 230 is changed to the “available” state. (Step S26). Thereafter, the process proceeds to step S12 in FIG.

  4, when instructed to create the temporary ID 240 in step S25 of FIG. 4, returning to FIG. 3, the ID creating means 133 generates the temporary ID 240 corresponding to the ID 220 and links the ID 220 to the ID master 200. At the same time, the temporary ID 240 is passed to the encryption unit 134. The encryption unit 134 encrypts the received temporary ID 240 and passes it to the transmission / reception unit 140. The transmission / reception means 140 passes the encrypted temporary ID 240 to the transmission / reception means 420 (step S7).

  The transmission / reception means 420 receives the encrypted temporary ID 240 and passes it to the decryption means 520. The decryption means 520 decrypts the encrypted temporary ID 240 and passes it to the IC chip data transmission / reception function 450. The IC chip data transmission / reception function 450 writes the temporary ID 240 to the IC chip 440. Thereby, authority transfer from the IC card 600 to the IC chip mobile phone 400 is performed.

  Since the temporary ID 240 written in the IC chip mobile phone 400 is recognized as the same as the ID 220 in the ID management server 100, it can be used without any problem. On the other hand, only the ID 610 that is the same as the ID 220 is recorded in the IC card 600, but this is recognized as the status “unusable” in the ID management server 100. Can not.

  FIG. 5 shows an attempt to transfer authority from the IC card 600 to the IC chip mobile phone 400 in the network 1 shown in FIG. 1, but when it is determined in step S22 in FIG. 4 that the ID 220 and the ID 610 are not the same. It is a flowchart which shows operation | movement. Steps S1 to S6 are the same as those in FIG. Also in FIG. 4, the process up to step S22 is the same, and thus the description will be started from the operation after proceeding to step S24.

  The transmission / reception means 140 that has received the data “data does not apply” transmits the data to the transmission / reception means 420. The transmission / reception means 420 transmits the data to the portable application 500. In response to receiving the data, the portable application 500 displays a message to the user that “IC card 600 is an IC card not applicable to use” (step S8).

  FIG. 6 is a flowchart showing an operation when the authority transferred from the IC card 600 to the IC chip mobile phone 400 is returned to the IC card 600 again in the network 1 shown in FIG.

  A user who wants to return the authority to the IC card 600 again uses the user interface 410 of the IC chip mobile phone 400 to specify the URL of the ID management server 100 and connect. The user interface 410 passes an access request to the URL of the ID management server 100 designated by the user to the transmission / reception means 420. The transmission / reception means 420 passes an access request to the user interface 150 through the public wireless communication network 700.

  The user interface 150 receives the access request and passes the web page data to the transmission / reception means 420. The transmission / reception means 420 passes the received web page data to the user interface 410. The user interface 410 displays the received web page data. The user commands an operation of returning authority from the displayed web page (step S11).

  Subsequently, the user executes the mobile application 500. Subsequent operations are the same as steps S3 to S5 described in FIG. 3 and FIG. However, “authority delegation service start command” is read as “authority delegation service release command”. Also in FIG. 4, since the process up to step S23 is the same, the description starts from the operation after proceeding to step S26.

  Upon receiving the temporary ID 240 deletion command, the transmission / reception unit 140 transmits the command to the transmission / reception unit 420. The transmission / reception unit 420 transmits the command to the ID deletion unit 530. The ID erasing unit 530 transmits the command to the IC chip data transmission / reception function 450. In response to receiving the command, the IC chip data transmission / reception function 450 deletes the temporary ID 240 in the IC chip 440 (step S12).

  If temporary ID 240 written in IC chip mobile phone 400 is erased, IC chip mobile phone 400 cannot be used as IC card 600. On the other hand, the ID 220 that is the same as the ID 610 recorded on the IC card 600 is recognized as the status “Available” in the ID management server 100, so that the IC card 600 can be used without any problem.

  According to the above configuration, since there is no human input or confirmation of ID 220, the risk of erroneous delegation of authority due to a work mistake or the like is avoided, and the personal authentication service realized by the IC card 600 is safely performed. It is possible to delegate authority to the IC chip mobile phone 400.

  At that time, it is only necessary to be able to communicate between the IC card 600 and the IC chip mobile phone 400, so there is no need to interpose an IC tag handling device. Therefore, as long as the user possesses only the IC card and the IC chip mobile phone and the IC chip mobile phone can communicate with the ID management server 100, the authority can be transferred regardless of the place and time. As a result, the authority of the personal authentication service realized by the IC card 600 can be safely transferred to the IC chip mobile phone 400 while ensuring convenience.

  Note that the IC card 600 is not particularly limited to a card type as long as the IC chip is incorporated. In addition to the mobile phone, the IC chip mobile phone 400 may be, for example, a PDA, a smart phone, or a notebook PC as long as it has an IC chip and can communicate with other computers.

  Further, in the mobile application management system 110, the number, frequency, ID 220, and the like of the IC chip mobile phone 400 downloading the mobile application 300 can be recorded. As a result, it is possible to grasp a history in which the user has delegated authority from the IC card 600 to the IC chip mobile phone 400, so that it is possible to obtain business-use information for the service provider. However, instead of downloading the mobile application 300 from the mobile application management system 110 each time authority is delegated, the mobile application 500 may be held on the IC chip mobile phone 400 side.

  Although the present invention has been described with the specific embodiments shown in the drawings, the present invention is not limited to the embodiments shown in the drawings, and is known so far as long as the effects of the present invention are achieved. It goes without saying that any configuration can be adopted.

  The present invention can be applied to a system having user authentication using an IC chip.

It is a block diagram which shows the structure which concerns on the network which concerns on embodiment of this invention, and IC card, IC chip mobile phone, and ID management server which comprise this network. It is a conceptual diagram which shows the data structure of the ID master shown in FIG. 2 is a flowchart showing an operation when delegating authority from an IC card to an IC chip mobile phone in the network shown in FIG. It is a flowchart which shows the content which an ID confirmation means judges when collating ID shown to FIG.3 S6. FIG. 5 is a flowchart showing an operation when it is determined in the network shown in FIG. 1 that the authority is transferred from the IC card to the IC chip mobile phone, but in step S22 of FIG. 3 is a flowchart showing an operation when the authority transferred from the IC card to the IC chip mobile phone is returned to the IC card again in the network 1 shown in FIG.

Explanation of symbols

100 ID management server 110 Mobile application management system (application management means)
111 Transmission / reception means 120 ID management DB
130 ID management system 131 ID confirmation unit 132 decryption unit (first decryption unit)
133 ID creation means 134 Encryption means (second encryption means)
140 Transmission / reception means (second transmission / reception means)
200 ID master 220 ID (second ID)
230 Availability 240 Temporary ID
400 IC chip mobile phone (mobile terminal)
420 Transmission / reception means (first transmission / reception means)
430 Storage area 440 IC chip (second IC chip)
450 IC chip data transmission / reception function 500 Mobile application (application)
510 ID writing means 520 decoding means (second decoding means)
530 ID deleting means 540 encryption means (first encryption means)
600 IC card 610 ID (first ID)
620 IC chip (first IC chip)

Claims (15)

An authority delegation system that consists of an IC card, a portable terminal, and an ID management server, and delegates authority of the personal authentication service of the IC card to the portable terminal,
The IC card has a first IC chip storing a first ID,
The mobile terminal is
A second IC chip that communicates with the first IC chip and reads the first ID;
First transmitting / receiving means for transmitting the first ID to the ID management server;
ID writing means for storing data received via the first transmission / reception means in the second IC chip,
The ID management server is
Second transmitting / receiving means for transmitting / receiving data to / from the portable terminal;
An ID management database for storing a second ID corresponding to the first ID;
ID confirmation means for confirming whether or not the first ID and the second ID received from the second transmission / reception means are the same;
ID creation means for generating a temporary ID when the first ID and the second ID are the same, and transmitting the temporary ID to the portable terminal via the second transmission / reception means. An authority delegation system characterized by   The ID writing unit stores the temporary ID in the second IC chip when the portable terminal receives the temporary ID via the first transmission / reception unit. The authority delegation system described.   The authority delegation system according to claim 2, wherein the ID management database sets the second ID to be unavailable at the same time as the ID management server transmits the temporary ID to the portable terminal. The portable terminal has a first encryption means for encrypting the first ID when transmitting the first ID to the ID management server;
The authority delegation system according to claim 2, wherein the ID management server includes a first decryption unit that decrypts the encrypted first ID. The ID management server has a second encryption means for encrypting the temporary ID when transmitting the temporary ID to the mobile terminal;
5. The authority delegation system according to claim 4, wherein the portable terminal has a second decryption means for decrypting the encrypted temporary ID. When the first ID and the second ID are the same and the temporary ID already exists, the ID confirmation unit cancels the temporary ID via the second transmission / reception unit in the portable terminal. Send instructions,
3. The authority according to claim 2, wherein the portable terminal has ID erasure means for erasing the temporary ID stored in the second IC chip when the temporary ID cancellation command is received. Delegation system.   The authority delegation system according to claim 6, wherein the ID management database sets the second ID to be usable at the same time as the ID management server transmits the temporary ID release command to the mobile terminal. . The ID management server has application management means for transmitting an application to the mobile terminal via the second transmission / reception means,
The said portable terminal controls reading / writing of said 1st ID and said temporary ID by the said application received from the said ID management server, The any one of Claims 1 thru | or 7 characterized by the above-mentioned. Authority delegation system. An IC card, a mobile terminal, and an ID management server, the mobile terminal used in an authority delegation system for delegating the authority of the personal authentication service of the IC card to the mobile terminal,
A second IC chip that communicates with the first IC chip and reads the ID;
Transmitting / receiving means for transmitting the ID to the ID management server and receiving a temporary ID from the ID management server;
An ID writing means for storing the temporary ID in the second IC chip. An ID management server comprising an IC card, a portable terminal, and an ID management server, and used for an authority delegation system for delegating the authority of the personal authentication service of the IC card to the portable terminal,
A transmission / reception means for receiving the first ID from the portable terminal;
An ID management database for storing a second ID corresponding to the first ID;
ID confirmation means for confirming whether or not the first ID and the second ID are the same;
ID creation means for generating a temporary ID when the first ID and the second ID are the same, and transmitting the temporary ID to the portable terminal via the second transmission / reception means. An ID management server characterized by   11. The ID management server according to claim 10, wherein the ID management database sets the second ID to be unavailable at the same time as transmitting the temporary ID to the portable terminal. An IC card having a first IC chip storing a first ID, a portable terminal having a second IC chip, and an ID management database for storing a second ID corresponding to the first ID A right delegation system for delegating the authority of the personal authentication service of the IC card to the portable terminal, the method of delegating the authority of the personal authentication service of the IC card to the portable terminal, comprising:
An ID reading step in which the portable terminal reads the first ID by communicating with the first IC chip;
An ID transmission step in which the portable terminal transmits the first ID to the ID management server;
An ID receiving step in which the ID management server receives the first ID from the mobile terminal;
An ID confirmation step in which the ID management server confirms whether or not the first ID and the second ID are the same;
A temporary ID generation step in which the ID management server generates a temporary ID when the first ID and the second ID are the same;
A temporary ID transmission step in which the ID management server transmits the temporary ID to the portable terminal via the second transmission / reception means;
A temporary ID receiving step in which the portable terminal receives the temporary ID;
An authority delegation method comprising: a temporary ID storage step in which the portable terminal stores the temporary ID in the second IC chip.   13. The authority delegation method according to claim 12, further comprising an ID unusable step in which the ID management server sets the second ID to be unusable in the ID management database simultaneously with the temporary ID transmission step. . An IC card having a first IC chip storing an ID, a portable terminal having a second IC chip, and an ID management server, and delegating authority of the personal authentication service of the IC card to the portable terminal In the authority delegation system, the computer constituting the portable terminal is
Processing to communicate with the first IC chip and read the ID;
Processing for transmitting the ID to the ID management server;
Receiving a temporary ID from the ID management server;
An authority delegation program that causes the temporary ID to be stored in the second IC chip. An IC card having a first IC chip storing a first ID, a portable terminal having a second IC chip, and an ID management database for storing a second ID corresponding to the first ID An authority management system that delegates the authority of the personal authentication service of the IC card to the mobile terminal, the computer constituting the ID management server,
A process of receiving the first ID from the mobile terminal;
Processing for confirming whether or not the first ID and the second ID are the same;
A process of generating a temporary ID when the first ID and the second ID are the same;
An authority delegation program that causes the temporary ID to be transmitted to the portable terminal via the second transmission / reception means.

Images