JP2010092186A - Lock release system, client terminal, and lock release program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a lock release system, a client terminal, and a lock release program for improving convenience while securing safety. <P>SOLUTION: The lock release system is configured to acquire PIN lock information showing whether or not an IC card 40-1 is in a PIN lock state from the IC card 40-1 and identification information of the IC card 40-1 through a reader/writer device 50-1, transmits the acquired identification information to a server 10 when the acquired PIN lock information shows the lock state, and receives information corresponding to the transmitted identification information, that is, PIN lock release right information showing any of a plurality of PIN lock release rights from the server 10, and releases the PIN lock of the IC card 40-1 by PIN lock release processing allowed by a PIN lock release right shown by the received PIN lock release right information. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an unlock system, a client terminal, and an unlock program.

  Conventionally, a corporate network system using an IC (Integrated Circuit) card is known (see, for example, Patent Documents 1 and 2). In such a system, a user is usually authenticated by collating a PIN (Personal Identification Number) stored in advance in the IC card with a PIN input by the user who owns the IC card. Access to the system is permitted only when authenticated as a user.

  On the other hand, if the user authentication fails after exceeding a predetermined limit, the IC card PIN is locked and the IC card cannot be used. In such a system, since it is necessary to ensure the security of the system, it is common to require a procedure such as performing identity verification to the administrator in order to release the PIN lock.

Japanese Patent Laid-Open No. 2003-157412 Japanese Patent Laid-Open No. 2005-148883

  However, since procedures such as identity verification are complicated procedures for the user, the above-described system using an IC card has a problem in that it is unusable due to its high safety.

  By the way, there are various users who use the system as described above, and the authority for each user (for example, the authority of regular employees and temporary employees) is generally different. Therefore, it is not necessary to request all users uniformly for procedures such as identity verification, and there is room for improvement in improving convenience.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an unlocking system, a client terminal, and an unlocking program capable of improving convenience while ensuring safety.

  In order to solve the above-described problems and achieve the object, the unlocking system of the present invention is connected to a portable security device and a reader / writer device that reads / writes data from / to the portable security device. The unlocking system comprises a first client terminal and a server connected to the first client terminal via a network, wherein the portable security device is in a locked state. A portable security device information storage means for storing lock information indicating whether or not there exists and identification information of the portable security device in association with each other, wherein the first client terminal is connected to the portable security device; , The lock information and the information via the reader / writer device. And an information corresponding to the transmitted identification information, and when the acquired lock information indicates a lock state, the identification information acquired by the acquisition means is transmitted to the server. The first client-side communication control means that receives from the server the unlocking authority information indicating one of a plurality of unlocking authorities, and the unlocking authority indicated by the received unlocking authority information And unlocking means for unlocking the portable security device in the unlocking process permitted by the server, wherein the server stores the identification information and the unlocking authority information in association with each other. The storage means and the identification information transmitted from the first client terminal are received and corresponds to the received identification information The lock release permission information kicked reads from the server information storing unit, characterized in that it comprises a server communication control means for transmitting to the first client terminal.

  The client terminal of the present invention is a client terminal connected to a server via a network and connected to a reader / writer device that reads / writes data to / from a portable security device. Acquisition means for acquiring, via the reader / writer device, lock information indicating whether the portable security device is in a locked state and identification information of the portable security device from the security device for acquisition; When the received lock information indicates a locked state, the identification information acquired by the acquisition means is transmitted to the server, and is information corresponding to the transmitted identification information, and has a plurality of unlocking authorities. Communication control means for receiving unlocking authority information indicating any one of them from the server When, in the unlocking process allowed for unlocking privileges listed the unlocking authority information received, characterized in that it comprises a lock release means for releasing the lock of the portable security device.

  The lock release program of the present invention is a lock that is executed by a computer that is connected to a server via a network and connected to a reader / writer device that reads / writes data from / to a portable security device. A release program, which includes lock information indicating whether or not the portable security device is locked and identification information of the portable security device from the portable security device via the reader / writer device. And when the acquired lock information indicates a locked state, the identification information acquired by the acquisition means is transmitted to the server and is information corresponding to the transmitted identification information. Unlock authority information indicating one of multiple unlock authorities A communication control procedure for receiving from the server, and an unlocking procedure for unlocking the portable security device in the unlocking process permitted by the unlocking authority indicated by the received unlocking authority information. The computer is executed.

  In the present invention, when the portable security device is in the locked state, the client terminal transmits the identification information of the portable security device to the server, and receives the unlocking authority information corresponding to the transmitted identification information from the server. Then, the client terminal unlocks the portable security device in the unlocking process permitted by the unlocking authority indicated by the received unlocking authority information. As described above, according to the present invention, it is possible to perform the unlocking process according to the user (identification information of the portable security device), so that it is possible to improve convenience while ensuring safety. Play.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of an unlocking system, a client terminal, and an unlocking program according to the present invention will be described with reference to the accompanying drawings. In addition, this invention is not limited to each embodiment demonstrated below, A various deformation | transformation is possible.

(First embodiment)
FIG. 1 is a block diagram showing an example of the configuration of the unlocking system 1 according to the present embodiment. As shown in FIG. 1, in the lock release system 1, a server 10 and a plurality of client terminals 20-1 to 20-n (n is a natural number of 2 or more) are connected via a network 30. The plurality of client terminals 20-1 to 20-n are connected to reader / writer devices 50-1 to 50-n that read / write data from / to the IC cards 40-1 to 40-n, respectively. ing. The network 30 may be any network regardless of wireless or wired, LAN (Local Area Network) or public communication line.

  The server 10 according to the present embodiment distributes various information such as PIN lock release authority information indicating PIN lock release authority set for each user, and includes a storage unit 110, a communication control unit 120, And an authentication unit 130. The server 10 and client terminals 20-1 to 20-n described later include a control device such as a CPU (Central Processing Unit), a storage device such as a ROM (Read Only Memory) and a RAM (Random Access Memory), and an HDD (Hard). It has an external storage device such as a disk drive and CD (compact disk) drive device, a display device such as a display device, and an input / output device such as a keyboard and mouse, and has a hardware configuration using a normal computer. Yes.

  The storage unit 110 stores various information such as PIN lock release authority information set for each user (IC card identification information). FIG. 2 is an explanatory diagram illustrating an example of information stored in the storage unit 110. As shown in FIG. 2, the storage unit 110 has one of IC card identification information and a plurality of PIN lock release authorities (automatic response, application approval, offline) (application approval in the example shown in FIG. 2). Is associated with the approver information indicating the approver when performing the application approval type PIN lock release processing, and the response information used when performing the automatic response type PIN lock release processing. Is remembered.

  The automatic response type PIN lock release process and the application approval type PIN lock release process will be described later. In the following, the information shown in FIG. 2 indicates the user of the client terminal 20-1, that is, the information of the user A, and the user B indicated by the approver information of FIG. 2 indicates the user of the client terminal 20-2. It shall be shown.

  Returning to FIG. 1, the communication control unit 120 transmits and receives data to and from the client terminals 20-1 to 20-n connected via the network 30. For example, the communication control unit 120 receives the identification information of the IC card 40-1 transmitted from the client terminal 20-1. Then, the communication control unit 120 reads the PIN lock release authority information corresponding to the received identification information of the IC card 40-1 from the storage unit 110 and transmits it to the client terminal 20-1.

  When any of the client terminals 20-1 to 20-n performs an automatic response type PIN lock release process, the authentication unit 130 performs an authentication process using the answer information stored in the storage unit 110.

  Next, the hardware configuration of the IC cards 40-1 to 40-n according to the present embodiment will be described using the IC card 40-1 as an example with reference to FIG. FIG. 3 is an explanatory diagram illustrating an example of a hardware configuration of the IC card 40-1. The configuration of the IC cards 40-2 to 40-n is the same as that of the IC card 40-1.

  As shown in FIG. 3, the IC card 40-1 includes a communication I / F (Interface) 41, a CPU 42, a RAM 43, a ROM 44, and an EEPROM (Electronically Erasable and Programmable Read Only Memory) 45.

  The communication I / F 41 includes a contact terminal and the like, and mediates communication between the client terminal and the CPU 42. The CPU 42 is a central processing unit that performs overall control of the IC card 40-1, and performs processing according to a command received from the client terminal via the communication I / F 41 (for example, PIN authentication, PIN update, PIN lock, PIN lock). Cancel) and send the result as a response.

  The RAM 43 is a volatile memory used as a work area for the CPU 42 to perform processing. The ROM 44 is a nonvolatile read-only memory that mainly stores programs and data (for example, identification information of the IC card 40-1) necessary for the CPU 42 to perform processing. The EEPROM 45 is a non-volatile memory that can be rewritten at any time, and programs and data required for the CPU 42 to perform processing (for example, PIN information of the IC card 40-1 or whether the IC card 40-1 is in a locked state). PIN lock information indicating whether or not) is stored. The portable security device information storage means of the present invention is composed of a RAM 43, a ROM 44, and an EEPROM 45.

  Returning to FIG. 1, the client terminal 20-1 and the reader / writer device 50-1 are configured with respect to the configurations of the client terminals 20-1 to 20-n and the reader / writer devices 50-1 to 50-n according to the present embodiment. Take an example. The configuration of the client terminals 20-2 to 20-n is the same as that of the client terminal 20-1, and the configuration of the reader / writer devices 50-2 to 50-n is the same as that of the reader / writer device 50-1. is there.

  The client terminal 20-1 performs various processes using the IC card such as releasing the PIN lock of the IC card. The acquisition unit 210, the communication control unit 220, the storage unit 230, the lock release unit 240, And a response unit 250.

  The acquisition unit 210 acquires data from the IC card via the reader / writer device 50-1. For example, the acquisition unit 210 receives PIN lock information indicating whether or not the IC card 40-1 is in the PIN lock state and the IC card 40-1 from the IC card 40-1 via the reader / writer device 50-1. Get identification information.

  The reader / writer device 50-1 performs data read processing and write processing on the IC card to mediate communication between the IC card and the client terminal 50-1. Note that the communication method may be a contact type or a non-contact type.

  The communication control unit 220 transmits and receives data to and from the server 10 connected via the network 30. For example, when the PIN lock information of the IC card 40-1 acquired by the acquisition unit 210 indicates the PIN lock state, the communication control unit 220 uses the identification information of the IC card 40-1 acquired by the acquisition unit 210 as a server. 10 to send. Then, the communication control unit 220 receives from the server 10 PIN lock release authority information corresponding to the transmitted identification information of the IC card 40-1. Note that the communication control unit 220 receives various types of information from the server 10 at a predetermined timing such as when logging in.

  The storage unit 230 stores PIN lock release authority information received from the server 10, information acquired from the IC card, and the like. Each piece of information stored in the storage unit 230 is updated with the latest information every time the latest information is acquired from the IC card or the latest information is received from the server 10.

  The lock release unit 240 releases the PIN lock of the IC card. For example, when the PIN lock information of the IC card 40-1 indicates the PIN lock state, the PIN lock release authority (automatic response, application approval, offline) indicated by the PIN lock release authority information received by the communication control unit 220 is allowed. In the PIN lock release process, the PIN lock of the IC card 40-1 is released.

  In the present embodiment, the lock release unit 240 can execute an automatic response type PIN lock release process, an application approval type PIN lock release process, and an offline type PIN lock release process as the PIN lock release process. Whether to perform the unlocking process is determined by the PIN unlocking authority information.

  In this embodiment, first, execution of the PIN lock release process corresponding to the PIN lock release authority is allowed, “automatic response” corresponds to the automatic response type PIN lock release process, and “application approval” is the application approval type PIN. Corresponding to the unlocking process, “offline” corresponds to the offline PIN lock releasing process.

  Further, in the present embodiment, the level of the PIN lock release authority is set to be highest for “automatic response” and lowest for “offline”. When the PIN lock release authority is “automatic response”, not only the corresponding automatic response type PIN lock release process, but also the offline type PIN lock release process corresponding to “offline” having a lower authority than “automatic response”. Permissible. Similarly, when the PIN lock release authority is “application approval”, not only the corresponding application approval type PIN lock release process but also the offline type PIN lock release process corresponding to “offline” having lower authority than “application approval” Is also acceptable.

  That is, in this embodiment, when the PIN unlocking authority information indicates “automatic response”, the unlocking unit 240 can execute an automatic response type PIN unlocking process or an offline type PIN unlocking process. When the authority information indicates “application approval”, the application approval type PIN lock release process or the offline type PIN lock release process can be executed. When the PIN lock release authority information indicates “offline”, the offline type PIN lock Release processing can be executed.

  In the automatic response type PIN lock release processing, the user's answer to a predetermined question is registered in the server 10 in advance (see answer information in FIG. 2), and the user inputs the answer to this question and is registered in the server 10. If it matches the answer, the PIN is unlocked. The automatic response type PIN unlocking process is the most convenient PIN unlocking method for the user because the PIN can be unlocked without using an administrator or an approver.

  Further, in the application approval type PIN lock release processing, when an approver registered in advance in the server 10 (refer to the approver information in FIG. 2) is requested to release the PIN lock, and the application is approved by the approver, unlock. Although the application approval type PIN lock release process is via an approver, the PIN lock can be released with approval from the approver, so it is the most convenient PIN lock release method after the automatic response type PIN lock release process. is there.

  In the off-line PIN lock release process, the PIN lock is released using a PIN lock release password issued or managed by an administrator or the like. Note that the PIN unlocking password can be issued as a one-time password by a method as shown in Patent Document 1, for example. The off-line PIN lock release processing is a conventional PIN lock release method, and is not an online method such as an automatic response type PIN lock release processing and an application approval type PIN lock release processing, so it is not convenient for the user.

  For example, when the user A of the client terminal 20-1 is registered as an approver of the application approval type PIN lock release process, the response unit 250 approves an application from a user of another client terminal based on the operation of the user A. Alternatively, a denial response process is performed.

  Next, an example of the entire flow of the PIN unlocking process executed in the unlocking system 1 according to the present embodiment will be described with reference to FIGS.

  FIG. 4 is a flowchart illustrating an example of a procedure for determining a PIN lock release process to be executed by the client terminal 20-1.

  First, the acquisition unit 210 acquires the PIN lock information and identification information of the IC card 40-1 from the IC card 40-1 via the reader / writer device 50-1 (step S100).

  Next, when the acquired PIN lock information of the IC card 40-1 indicates the PIN lock state (Yes in step S102), the communication control unit 220 identifies the IC card 40-1 acquired by the acquisition unit 210. Information is transmitted to the server 10 (step S104).

  When the PIN lock information does not indicate the PIN lock state (No in step S102), the subsequent processing (processing after step S104) is not performed. However, in order to be able to change the PIN even if the PIN is not locked, the subsequent processing may be continued according to the judgment of the user.

  Next, when receiving the PIN lock release authority information corresponding to the transmitted identification information of the IC card 40-1 from the server 10 (Yes in step S106), the communication control unit 220 receives the received PIN lock release authority information. Thus, the PIN unlocking authority information stored in the storage unit 230 is updated (step S108).

  Next, the unlocking unit 240 reads the PIN unlocking authority information stored in the storage unit 230 (step S110), and when the read PIN unlocking authority information indicates “automatic response” (in step S112). Yes), an automatic response type PIN lock release process is performed (step S114). Details of the automatic response type PIN lock release processing will be described later.

  Further, when the read PIN lock release authority information indicates “application approval” (No in step S112, Yes in step S116), the lock release unit 240 performs an application approval type PIN lock release process (step S118). . The details of the application approval type PIN lock release process will be described later.

  Further, when the read PIN lock release authority information indicates “offline” (No in step S112, No in step S116), the lock release unit 240 performs an offline PIN lock release process (step S120). Also, in step S106, when the communication control unit 220 does not receive the PIN unlocking authority information from the server 10 (No in step S106), the unlocking unit 240 performs an offline PIN unlocking process ( Step S120). Details of the offline PIN lock release process will be described later.

  FIG. 5 is a sequence showing an example of a detailed procedure of the automatic response type PIN lock release processing shown in step S114 of FIG.

  First, the lock release unit 240 of the client terminal 20-1 receives an instruction from the server 10 (step S200), displays an answer input screen on the display device of the client terminal 20-1, and the user A of the client terminal 20-1 To input an answer to the question (step S202).

  FIG. 6 is a diagram illustrating an example of an answer input screen. In the answer input screen 410 shown in FIG. 6, the question content is displayed on the screen, and the user A inputs an answer to this question in the answer column. When the user A inputs an answer and clicks the OK button 411 (step S204), the communication control unit 220 of the client terminal 20-1 transmits the answer and the identification information of the IC card 40-1 to the server 10. (Step S206). The question is not limited to a fixed sentence, but may be freely changed by setting on the server side.

  When the user A clicks the cancel button 412, the lock release unit 240 cancels the answer input and closes the answer input screen 410. When the user A clicks the offline button 413, the lock release unit 240 cancels the answer input and switches from the automatic response type PIN lock release process to the offline type PIN lock release process.

  Next, when the communication control unit 120 of the server 10 receives the reply and the identification information of the IC card 40-1 from the client terminal 20-1, the authentication unit 130 of the server 10 receives the identification information of the IC card 40-1. Is read from the storage unit 110, and it is authenticated whether or not it matches the received answer (step S208). For authentication, a limit may be set on the number of times.

  If the authentication is successful, the lock release unit 240 of the client terminal 20-1 receives an instruction from the server 10 (step S210), and displays the PIN reset screen on the display device of the client terminal 20-1. Then, the user A is made to input a new PIN (step S212).

  FIG. 7 is a diagram illustrating an example of a PIN reset screen. When the user A inputs a new PIN and a confirmation PIN and clicks the OK button 421 on the PIN reset screen 420 shown in FIG. 7 (step S214), the lock release unit 240 releases the PIN lock ( Step S216).

  Specifically, the lock release unit 240 updates the PIN information stored in the IC card 40-1 with a new PIN for the IC card 40-1, or is stored in the IC card 40-1. A command for updating the existing PIN lock information from the PIN lock state to the PIN lock release state is transmitted to cause the IC card 40-1 to perform these processes.

  When the user A clicks the cancel button 422, the lock release unit 240 cancels the input of a new PIN or the like and closes the PIN reset screen 420.

  FIG. 8 is a sequence showing an example of a detailed procedure of the application approval type PIN lock release process shown in step S118 of FIG.

  First, the lock release unit 240 of the client terminal 20-1 receives an instruction from the server 10 (step S300), displays an application screen on the display device of the client terminal 20-1, and causes the user A of the client terminal 20-1 to A request is made to cancel the PIN lock (step S302).

  FIG. 9 is a diagram illustrating an example of an application screen. When the user A clicks the application button 431 on the application screen 430 illustrated in FIG. 9, the communication control unit 220 of the client terminal 20-1 transmits the PIN lock release application information and the identification information of the IC card 40-1 to the server 10. (Step S304).

  Note that when the user A clicks the close button 432, the lock release unit 240 closes the application screen 430. When the user A clicks the offline button 433, the lock release unit 240 switches from the application approval type PIN lock release process to the offline type PIN lock release process.

  Next, the communication control unit 120 of the server 10 receives the PIN lock release application information and the identification information of the IC card 40-1 from the client terminal 20-1. Then, the communication control unit 120 of the server 10 reads approver information corresponding to the received identification information of the IC card 40-1 from the storage unit 110, and the read approver information indicates the user B (FIG. 2). The received PIN lock release application information is transmitted to the client terminal 20-2 to which the user B is logged in (step S306).

  Next, when the communication control unit 220 of the client terminal 20-2 receives the PIN lock release application information from the server 10, the communication control unit 220 transmits a response indicating that the PIN lock release application information has been received to the server 10 (step S308). When receiving the response from the client terminal 20-2, the communication control unit 120 of the server 10 instructs the client terminal 20-1 to display an approval waiting screen (step S310).

  Then, the lock release unit 240 of the client terminal 20-1 displays an approval waiting screen on the display device of the client terminal 20-1 in accordance with an instruction from the server 10 (step S312).

  FIG. 10 is a diagram illustrating an example of an approval waiting screen. When the user A clicks the update button 441 on the approval waiting screen 440 shown in FIG. 10, the communication control unit 220 of the client terminal 20-1 inquires of the server 10 about the application status (step S314).

  However, at this time, the server 10 has not received the PIN lock release response information indicating the processing result of the response process for approving or rejecting the application based on the PIN lock release application information from the client terminal 20-2. The communication control unit 120 replies to the client terminal 20-1 that the application has not yet been approved (step S316).

  Note that when the user A clicks the close button 442, the lock release unit 240 closes the approval waiting screen 440. When the user A clicks the offline button 443, the lock release unit 240 switches from the application approval type PIN lock release process to the offline type PIN lock release process.

  On the other hand, when the user B of the client terminal 20-2 notices an application from the user A and the user B performs an operation to approve or reject the application, the response unit 250 of the client terminal 20-2 receives the received PIN lock. A response process for approving or denying the application based on the cancellation application information is performed (step S318).

  If the application is approved, the communication control unit 220 of the client terminal 20-2 transmits PIN lock release response information indicating the result of the response process to the server 10 (step S320). In the case of being rejected, a result indicating that the cancellation application is rejected is transmitted to the server 10. The server 10 receives the denial response process and returns to the application screen again.

  Here, on the approval waiting screen shown in FIG. 10, the user A clicks the update button 441 again to inquire the application status to the server 10 (step S322). At this time, since the server 10 has received the PIN lock release response information from the client terminal 20-2, if this PIN lock release response information indicates application approval, the server 10-1 receives the PIN re-release response information. The display of the setting screen is instructed (step S324).

  The subsequent processing from the PIN reset screen display to PIN lock release (step S326 to step S330) is the same as the processing from step S212 to step S216 in the sequence shown in FIG. To do.

  FIG. 11 is a flowchart showing an example of a detailed procedure of the offline PIN lock release process shown in step S120 of FIG.

  First, the lock release unit 240 of the client terminal 20-1 displays a password input screen on the display device of the client terminal 20-1, and allows the user A of the client terminal 20-1 to input a password for PIN lock release (Step S1). S400).

  FIG. 12 is a diagram illustrating an example of a password input screen when the automatic approval type PIN lock release screen or the application approval type PIN lock release screen is switched to the offline approval type screen. When the user A clicks the password creation button 451 for application on the password input screen 450 shown in FIG. 12, the password is displayed. User A uses this password to contact the administrator using E-Mail or the like, and obtains a password for cancellation. In the present embodiment, it is preferable to use a one-time password. By using a one-time password, it becomes possible to generate a character string that is different from the password for cancellation, and thus higher security can be ensured.

  Subsequently, when the user A inputs the PIN unlock password obtained from the administrator and clicks the cancel button 452 (step S402), the unlock unit 240 confirms the validity of the PIN unlock password. A check is made (step S404).

  For example, the unlocking unit 240 matches the data generated by the check data stored in the storage unit 230 of the client terminal 20-1 and the input application password with the input PIN unlocking password. The validity of the PIN unlocking password is checked by confirming whether or not to do so.

  When the user A clicks the close button 453, the lock release unit 240 cancels the password input and closes the password input screen 450.

  If the lock release unit 240 confirms that the PIN lock release password is a valid password as a result of the check (Yes in step S404), the PIN release screen is displayed on the display device of the client terminal 20-1. Is displayed, and the user A is made to input a new PIN (step S406). On the other hand, if it is confirmed as a result of the check that the PIN unlocking password is not a valid password (No in step S404), the subsequent processing (processing after step S406) is not performed.

  The subsequent processes from PIN input to PIN lock release (steps S408 to S410) are the same as the processes from step S214 to step S216 of the sequence shown in FIG.

  As described above, in the present embodiment, when the client terminal 20-1 is, for example, when the IC card 40-1 is in the PIN lock state, the identification information of the IC card 40-1 is transmitted to the server 10, and the transmitted identification information is transmitted. PIN lock release authority information corresponding to is received from the server 10. Then, the client terminal 20-1 releases the PIN lock of the IC card 40-1 in a PIN lock release process permitted by the PIN lock release authority indicated by the received PIN lock release authority information. Therefore, since the PIN lock release processing according to the user (identification information of the IC card 40-1) can be performed, the convenience can be improved while ensuring safety.

  For example, in an organization that has introduced the lock release system 1 according to the present embodiment, an automatic response authority is granted to a regular employee, an application approval authority is granted to a temporary employee, and an offline authority is granted to a part-time job employee. For example, convenience can be emphasized for regular employees, and safety can be emphasized for part-time workers.

  Further, in this embodiment, when the user has the automatic response authority and the application approval authority, the offline PIN lock release processing can be executed, so that the PIN lock cannot be released when a failure occurs in the network or the like. It is also possible to prevent the situation from occurring.

  Moreover, in this Embodiment, since the approver of an application approval type | mold PIN lock cancellation | release process can be set with approver information, the person suitable for users, such as a department manager, can be set to an approver.

  In the present embodiment, the case where the communication control unit 220 does not receive the PIN unlocking authority information from the server 10 has been described as an example in which the unlocking unit 240 performs an offline PIN unlocking process. However, the present invention is not limited to this. For example, when the communication control unit 220 has not received the PIN unlocking authority information from the server 10, the unlocking unit 240 reads the PIN unlocking authority information stored in the storage unit 230 and reads the read PIN. You may make it perform PIN lock release processing according to lock release authority information.

(Second Embodiment)
Next, an unlocking system according to a second embodiment will be described. The lock release system according to the present embodiment is the first implementation in that PIN lock release is performed using PIN lock release authority information for a user (IC card identification information) or PIN lock release authority information for a terminal. It is different from the form. Therefore, in the present embodiment, differences from the first embodiment will be mainly described, and description of contents already described in the first embodiment will be omitted.

  FIG. 13 is a block diagram showing an example of the configuration of the unlocking system 1001 according to the present embodiment. In the server 1010, the configurations of the storage unit 1110 and the communication control unit 1120 are different from those of the server 10 according to the first embodiment. In the client terminals 1020-1 to 1020-n, the communication control unit 1220, the storage unit 1230, And the structure of the lock release part 1240 is different from the client terminals 20-1 to 20-n according to the first embodiment. In addition, about the component which attached | subjected the name and code | symbol similar to 1st Embodiment, it shall have the same function as 1st Embodiment, The description is abbreviate | omitted.

  FIG. 14 is an explanatory diagram illustrating an example of information stored in the storage unit 1110 of the server 1010. As shown in FIG. 14, the storage unit 1110 includes IC card identification information, user PIN unlocking authority information, terminal PIN unlocking authority information, user PIN unlocking authority information, and terminal PIN information. Priority information indicating which of the priorities of the PIN lock release authority information is higher, response information, and approver information are stored in association with each other.

  Returning to FIG. 13, for example, when the communication control unit 1120 of the server 1010 receives the identification information of the IC card 40-1 from the client terminal 1020-1, the communication control unit 1120 corresponds to the identification information of the IC card 40-1. PIN lock release authority information, terminal PIN lock release authority information, and priority information are read from the storage unit 1110 and transmitted to the client terminal 1020-1.

  The communication control unit 1220 of the client terminal 1020-1 sends the user PIN unlocking authority information, the terminal PIN unlocking authority information, and the priority information corresponding to the transmitted identification information of the IC card 40-1 to the server. 1010.

  The storage unit 1230 stores the PIN lock release authority information for the user, the PIN lock release authority information for the terminal received from the server 1010, the priority information, the information acquired from the IC card, and the like.

  The unlocking unit 1240 is PIN unlocking authority information indicated by the priority information received by the communication control unit 1220, and the PIN unlocking authority (automatic response, application approval, offline) indicated by the PIN unlocking authority information. The PIN lock of the IC card 40-1 is released by an allowable PIN lock release process.

  FIG. 15 is a flowchart illustrating an example of a procedure for determining a PIN lock release process to be executed by the client terminal 1020-1.

  First, from acquisition of the PIN lock information and identification information of the IC card 40-1 to transmission to the server 10 (steps S100 to S104), processing similar to that of the first embodiment is performed.

  Next, the communication control unit 1220 receives the PIN unlocking authority information for the user, the PIN unlocking authority information for the terminal, and the priority information corresponding to the transmitted identification information of the IC card 40-1 from the server 1010. In this case (Yes in step S1106), the user's PIN unlocking authority information, terminal PIN unlocking authority information, and priority information stored in the storage unit 1230 are updated with each received information ( Step S1108).

  Next, the unlocking unit 1240 reads the priority information stored in the storage unit 1230. If the read priority information indicates the PIN unlocking authority information for the user (Yes in step S1109), the unlocking unit 1240 stores the priority information. The user's PIN lock release authority information stored in the unit 1230 is read (step S1110).

  On the other hand, when the read priority information does not indicate the PIN unlocking authority information for the user (when indicating the PIN unlocking authority information for the terminal) (No in step S1109), the unlocking unit 1240 stores the storage unit. The PIN unlocking authority information for the terminal stored in 1230 is read (step S1111).

  Thereafter, the same processing as in the first embodiment is performed from step S112 to step S120.

  As described above, in the present embodiment, the priority information is used to perform the PIN unlocking process permitted by the PIN unlocking authority information for the user or the PIN unlocking authority information for the terminal. Release the PIN lock. Accordingly, it is possible to perform PIN lock release processing according to not only the user authority but also the terminal to be used.

It is a block diagram which shows an example of a structure of the lock release system 1 concerning 1st Embodiment. It is explanatory drawing which shows an example of the information memorize | stored in the memory | storage part 110 of the server 10 concerning 1st Embodiment. It is explanatory drawing which shows an example of the hardware constitutions of IC card 40-1 concerning 1st Embodiment. It is a flowchart which shows an example of the procedure which determines the PIN lock cancellation | release process performed with the client terminal 20-1 concerning 1st Embodiment. It is a sequence which shows an example of the detailed procedure of an automatic response type PIN lock cancellation | release process shown to step S114 of FIG. It is a figure which shows an example of the reply input screen concerning 1st Embodiment. It is a figure which shows an example of the PIN reset screen concerning 1st Embodiment. It is a sequence which shows an example of the detailed procedure of the application approval type | formula PIN lock cancellation | release process shown to step S118 of FIG. It is a figure which shows an example of the application screen concerning 1st Embodiment. It is a figure which shows an example of the approval waiting screen concerning 1st Embodiment. 5 is a flowchart showing an example of a detailed procedure of offline PIN lock release processing shown in step S120 of FIG. 4. It is a figure which shows an example of the password input screen concerning 1st Embodiment. It is a block diagram which shows an example of a structure of the lock release system 1001 concerning 2nd Embodiment. It is explanatory drawing which shows an example of the information memorize | stored in the memory | storage part 1110 of the server 1010 concerning 2nd Embodiment. It is a flowchart which shows an example of the procedure which determines the PIN lock cancellation | release process performed with the client terminal 1020-1 concerning 2nd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1,1001 Unlock system 10, 1010 Server 20-1-20-n, 1020-1-1020-n Client terminal 30 Network 40-1-40-n IC card 41 Communication I / F
42 CPU
43 RAM
44 ROM
45 EEPROM
50-1 to 50-n reader / writer device 110, 1110 storage unit 120, 1120 communication control unit 130 authentication unit 210 acquisition unit 220, 1220 communication control unit 230, 1230 storage unit 240, 1240 lock release unit 250 response unit 410 answer Input screen 411, 421 OK button 412, 422 Cancel button 413, 433, 443 Offline button 420 PIN reset screen 430 Application screen 431 Application button 432, 442, 453 Close button 440 Approval wait screen 441 Update button 450 Password input screen 451 Create Button 452 Release button

Claims (6)

A portable security device, a first client terminal connected to a reader / writer device that reads / writes data from / to the portable security device, and the first client terminal connected via a network An unlocking system comprising a server,
The portable security device is:
Portable security device information storage means for storing lock information indicating whether or not the portable security device is locked and identification information of the portable security device in association with each other;
The first client terminal is
Obtaining means for obtaining the lock information and the identification information from the portable security device via the reader / writer device;
When the acquired lock information indicates a lock state, the identification information acquired by the acquisition means is transmitted to the server, and is information corresponding to the transmitted identification information, and includes a plurality of unlocking authorities. A first client-side communication control means for receiving, from the server, unlock authority information indicating any one of
Unlocking means for unlocking the portable security device in the unlocking process allowed by the unlocking authority indicated by the received unlocking authority information, and
The server
Server information storage means for storing the identification information and the unlocking authority information in association with each other;
The identification information transmitted from the first client terminal is received, and the unlocking authority information associated with the received identification information is read from the server information storage means and transmitted to the first client terminal. And a server-side communication control means.   The unlocking means includes a unlocking process corresponding to the unlocking authority indicated by the unlocking authority information received by the first client side communication control means, and a predetermined unlocking with a lower authority level than the unlocking authority. The unlocking system according to claim 1, wherein the portable security device is unlocked by any one of unlocking processes corresponding to authority. The unlocking authority information includes first unlocking authority information set according to the identification information, and second unlocking authority information set according to the first client terminal,
The server information storage means further stores priority information indicating which of the first unlocking authority information and the second unlocking authority information has higher priority in association with the identification information,
The server side communication control means reads the priority information from the server information storage means and further transmits it to the first client terminal,
The first client side communication control means further receives the priority information from the server,
The unlocking means is the unlocking authority information indicated by the received priority information, and unlocks the portable security device in an unlocking process according to the unlocking authority indicated by the unlocking authority information. The lock release system according to claim 1, wherein the lock release system is released. A plurality of client terminals including a second client terminal connected to the server via a network;
At least one of the unlocking processes that can be executed by the unlocking means is an application approval type unlocking process that requires an application by the user of the first client terminal and an approval by the user of the second client terminal,
The second client terminal is
An unlock response indicating a processing result of a response process of receiving an unlock request information indicating an unlock request via the server and approving or denying the request based on the unlock request information from the first client terminal. Second client side communication control means for transmitting information to the first client terminal via the server;
Response means for performing the response process, wherein the server information storage means identifies approver information indicating a user of the second client terminal having a response authority to an application by a user of the first client terminal. Store it in association with the information,
The server-side communication control means receives the unlock request information from the first client terminal, and transmits the received unlock request information to the second client terminal based on the approver information, Receiving the unlock response information from the second client terminal, and transmitting the received unlock response information to the first client terminal,
The first client side communication control means transmits the lock release application information to the server when the lock release means releases the lock of the portable security device in the application approval type lock release process, Receiving the unlock response information from the server;
The unlocking means releases the lock of the portable security device when the unlock response information received by the first client side communication control means indicates approval. 4. The unlocking system according to any one of 3. A client terminal connected to a server via a network and connected to a reader / writer device that reads / writes data to / from a portable security device,
Acquisition means for acquiring from the portable security device lock information indicating whether or not the portable security device is locked and identification information of the portable security device via the reader / writer device; ,
When the acquired lock information indicates a lock state, the identification information acquired by the acquisition means is transmitted to the server, and is information corresponding to the transmitted identification information, and includes a plurality of unlocking authorities. Communication control means for receiving unlocking authority information indicating any of the above from the server;
A client terminal comprising: an unlocking unit that unlocks the portable security device in an unlocking process permitted by an unlocking authority indicated by the received unlocking authority information. An unlocking program for causing a computer connected to a reader / writer device to read / write data to / from a portable security device while being connected to a server via a network,
An acquisition procedure for acquiring, from the portable security device, lock information indicating whether or not the portable security device is in a locked state and identification information of the portable security device via the reader / writer device; ,
When the acquired lock information indicates a lock state, the identification information acquired by the acquisition means is transmitted to the server, and is information corresponding to the transmitted identification information, and includes a plurality of unlocking authorities. A communication control procedure for receiving unlocking authority information indicating any of the above from the server;
An unlocking procedure for causing the computer to execute an unlocking procedure for unlocking the portable security device in an unlocking process permitted by an unlocking authority indicated by the received unlocking authority information. program.

Images