JP2012203759A - Terminal authentication system and terminal authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system making a terminal available in only an environment where a user other than him/her is around him/her.SOLUTION: A terminal to be authenticated acquires peripheral information indicating whether or not an authentication terminal exists around or whether or not an authentication user exists around by short-distance communication. When the terminal to be authenticated receives a request of prescribed information processing according to an instruction of a user, etc.(S301), the terminal to be authenticated refers to authentication condition master information, etc. to determine whether or not the authentication condition is satisfied (S302). The terminal to be authenticated executes response processing for the request of the prescribed information processing (S303) when the authentication condition is satisfied (Yes in S302), and the terminal to be authenticated executes error processing (S304) when the authentication condition is not satisfied (NO in S302). In the error processing, the terminal to be authenticated does not execute the response processing for the request of the prescribed information processing.

Description

  The present invention relates to a terminal authentication system for authenticating a terminal used by a user in order to suppress illegal acts such as information leakage.

In companies and the like, one or more PCs (personal computers), PDAs (personal digital assistants), mobile phones, tablet terminals, smartphones (hereinafter simply referred to as “terminals”) may be distributed to each employee. Many.
In recent years, fraudulent acts such as employees leaking information such as trade secrets and personal information using these terminals have become a problem.

  Patent Document 1 discloses a security management system for an information processing terminal using RFID. In paragraph 0027 of Patent Document 1, in a place where security protection of a network such as an in-house company is appropriately performed, information on the place of use is obtained from an RFID transmitter installed on a desktop or the like, and information processing terminal It describes that authentication is performed at the time of use. Further, it is described that authentication cannot be performed because information cannot be acquired from the RFID transmitter when it is taken outside the company.

JP 2009-237905 A

However, the mechanism described in Patent Document 1 is not sufficient as a deterrent against fraud. The reason will be described below.
In the mechanism described in Patent Document 1, even if each employee carries a terminal and moves to a place where there is no coworker or boss away from his / her own seat in the company, the terminal is used as long as the RFID radio wave arrives. I can do it. Also, even if you are in your office, you can use the terminal when there are no colleagues or supervisors, such as overtime hours. Usually, fraudulent acts such as leakage of information such as trade secrets and personal information are often performed in an environment where there is only one fraudulent person. Even if the mechanism described in Patent Document 1 is introduced, the terminal can be used in an environment where one person can be fraudulent, so the mechanism described in Patent Document 1 is not sufficient as a deterrent to fraud. It can be said.

  Also, the mechanism described in Patent Document 1 is inconvenient because the terminal cannot be used in a place where there is no RFID transmitter. For example, when visiting a customer with a colleague or boss, the terminal cannot be used unless an RFID transmitter is carried, which is inconvenient. It is desirable to be able to use the terminal in an environment where colleagues and bosses are together.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an authentication system or the like that allows a terminal to be used only in an environment where a user other than the user is in the vicinity.

  In order to achieve the above-described object, a first invention is a terminal authentication system including a plurality of terminals distributed to a plurality of users, and the terminal is connected to the surroundings by short-range communication. Based on the acquisition means for acquiring peripheral information indicating whether there is a terminal or whether there is another user in the vicinity, a reception means for receiving a request for predetermined information processing, and the peripheral information, A determination unit that determines whether or not an authentication condition for the predetermined information processing request is satisfied, and a response process for the predetermined information processing request when the authentication condition is satisfied as a result of the determination by the determination unit And a process executing unit that does not execute a response process in response to the predetermined information processing request when the authentication condition is not satisfied.

  A second invention is a terminal authentication system comprising a plurality of terminals distributed to a plurality of users and a server connected to the terminals via a network, wherein the terminals have their own probe information. Probe information transmitting means for transmitting a request, receiving means for receiving a request for predetermined information processing, authentication request means for transmitting authentication request information indicating an authentication request for the predetermined information processing request to the server, and the server If the authentication condition is satisfied, a response process is executed for the predetermined information processing request, and if the authentication condition is not satisfied, the predetermined condition is satisfied. Processing execution means that does not execute response processing in response to the information processing request, and the server stores the probe information received from the terminal. Means for determining whether or not the authentication condition is satisfied by referring to the probe information with respect to the authentication request information received from the terminal, and transmitting a determination result by the determination means to the terminal An authentication response means.

  A third invention is a terminal authentication method in a terminal authentication system composed of a plurality of terminals distributed for each of a plurality of users, wherein an authenticated terminal that is the terminal to be authenticated is authenticated by short-range communication. Acquiring peripheral information indicating whether or not an authentication terminal that is the terminal exists in the vicinity, or whether or not the authentication user that is the user to be authenticated is in the vicinity; and Receiving an information processing request; determining whether the authenticated terminal satisfies an authentication condition for the predetermined information processing request based on the peripheral information; and determining the authentication terminal As a result, when the authentication condition is satisfied, a response process is executed for the predetermined information processing request, and when the authentication condition is not satisfied, the response to the predetermined information processing request is performed. A step that does not perform the response process Te, a terminal authentication method comprising.

  A fourth invention is a terminal authentication method in a terminal authentication system comprising a plurality of terminals distributed for each of a plurality of users and a server connected to the terminals via a network, wherein the terminals are Transmitting own probe information; storing the probe information received by the server from the terminal; and receiving a request for predetermined information processing by an authenticated terminal that is the terminal to be authenticated. The authenticated terminal transmits authentication request information indicating an authentication request for the predetermined information processing request to the server; and the server receives the authentication request information received from the authenticated terminal. Determining whether or not the authentication condition is satisfied by referring to the probe information; and Transmitting to the terminal, and when the authentication target terminal receives the determination result from the server and satisfies the authentication condition, executes a response process to the predetermined information processing request, and the authentication condition A step of not executing response processing in response to the predetermined information processing request when the above information is not satisfied.

  According to the present invention, it is possible to provide an authentication system or the like that allows a terminal to be used only in an environment where a user other than the user is in the vicinity.

The figure which shows the outline | summary of the terminal authentication system 1 in 1st Embodiment. Hardware configuration diagram of terminal 2 The figure which shows an example of the terminal master information 3 The figure which shows an example of the authentication condition master information 4 The figure which shows an example of the periphery information 5a Flow chart showing a first example of peripheral information acquisition processing The flowchart which shows the 2nd example of peripheral information acquisition processing The flowchart which shows the authentication condition determination process in 1st Embodiment The figure which shows an example of the periphery information 5b The figure which shows the outline | summary of the terminal authentication system 11 in 2nd Embodiment. Hardware configuration diagram of terminal 6 Hardware configuration diagram of server 7 The figure which shows an example of the probe information 9 Flow chart showing probe information acquisition processing The flowchart which shows the authentication condition determination process in 2nd Embodiment

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
<First Embodiment>
Initially, the terminal authentication system 1 in 1st Embodiment is demonstrated, referring FIGS.

  FIG. 1 is a diagram showing an outline of a terminal authentication system 1 according to the first embodiment. As shown in FIG. 1, in the terminal authentication system 1, a plurality of users A to C carry or use terminals 2 A to 2 C, respectively. Each of the terminals 2A to 2C performs near field communication with other terminals. Each terminal 2A to 2C functions as an “authenticated terminal” (a terminal that authenticates whether or not it can execute a response process in response to a predetermined information processing request from another device or a user). , “Authentication terminal” (terminal that authenticates whether another terminal can execute a response process for a predetermined information processing request).

In the following, in order to make the description easy to understand, the terminal 2A is described as “authenticated terminal”, and the terminals 2B and 2C are described as “authenticating terminals”. Further, the terminals 2A to 2C are collectively referred to as “terminal 2”.
The terminal authentication system 1 includes a plurality of terminals 2 distributed for each user.

FIG. 2 is a hardware configuration diagram of the terminal 2. Note that the hardware configuration in FIG. 2 is an example, and various configurations can be adopted depending on the application and purpose.
The terminal 2 is connected to a control unit 21, a storage unit 22, an input unit 23, a display unit 24, a network communication unit 25, a peripheral device I / F unit 26, a short-range communication unit 27, and the like via a bus 28.

  The control unit 21 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), and the like. The CPU calls a program stored in the storage unit 22, a recording medium, etc. to a work memory area on the RAM, executes it, controls the drive of each device connected via the bus 28, and realizes the processing performed by the terminal 2 To do. The RAM is a volatile memory, and temporarily stores a program, data, and the like loaded from the storage unit 22, a recording medium, and the like, and includes a work area used by the control unit 21 to perform various processes.

The storage unit 22 is a ROM (Read Only Memory), a flash memory, an HDD (hard disk drive), or the like, and stores a program executed by the control unit 21, data necessary for program execution, and the like. With respect to the program, a control program corresponding to a basic input / output system (BIOS), a boot loader, and an operating system (OS), and an application program for causing the control unit 21 to execute processing to be described later are stored. Each of these program codes is read by the control unit 21 as necessary, transferred to the RAM, read by the CPU, and executed as various means.
The storage unit 22 may be an external storage device (USB memory, external hard disk, etc.) connected via a USB (Universal Serial Bus) or the like.

The input unit 23 inputs data and includes, for example, a keyboard, a pointing device such as a mouse, and an input device such as a numeric keypad. An operation instruction, an operation instruction, data input, and the like can be performed on the terminal 2 via the input unit 23.
The display unit 24 includes a display device such as a liquid crystal panel, and a logic circuit (video adapter or the like) for realizing the video function of the terminal 2 in cooperation with the display device. In addition, the display part 24 and the input part 23 may be comprised integrally as a touch panel.

The network communication unit 25 has a communication control device, a communication port, and the like, and is a communication interface that mediates communication between the terminal 2 and the network, and performs communication control with other terminals 2 and computers via the network. The network may be wired or wireless.
The peripheral device I / F (interface) unit 26 is a port for connecting a peripheral device to the terminal 2, and the terminal 2 transmits and receives data to and from the peripheral device via the peripheral device I / F unit 26. The peripheral device I / F unit 26 is configured by USB, IEEE1394, RS-232C, or the like, and usually has a plurality of peripheral devices I / F. The connection form with the peripheral device may be wired or wireless.

The short-range communication unit 27 is a short-range communication means using, for example, infrared communication and / or Bluetooth (registered trademark).
In the case of infrared communication, the short-range communication unit 27 includes an infrared light emitting element and a light receiving element (transmission / reception unit), and control means for controlling them. Then, the short-range communication unit 27 performs short-range communication with other terminals 2 using infrared rays. In the case of infrared communication, the communication distance is about 30 cm to 1 m.
In the case of Bluetooth, the short-range communication unit 27 includes a device that transmits and receives a predetermined radio wave and a control unit. The short-range communication unit 27 performs short-range communication with other terminals 2 in accordance with the Bluetooth standard. In the case of Bluetooth, the communication distance is approximately several meters to several tens of meters.
The bus 28 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  The short-range communication between the terminals 2 described above may be realized by infrared communication and / or Bluetooth by the short-range communication unit 27, or a cable is connected to the peripheral device I / F (interface) unit 26 of both terminals 2. You may implement | achieve by connecting. In the present invention, the “short-range communication” is not particularly limited as long as it is a communication form that can be connected only when an authentication terminal exists around the authenticated terminal.

By the way, since it is necessary for both users to be aware of the infrared transmission / reception unit, the infrared communication is troublesome when the terminal 2 is always used in a company or the like. Therefore, for example, near field communication may be performed by Bluetooth in the case of in-house, and near field communication may be performed by infrared communication in the case of outside the company. The reason for using infrared communication outside the company is that it is considered an environment in which fraudulent acts are easily performed, and therefore fraudulent acts can be suppressed by making the user aware of the authentication work.
Whether the terminal 2 is internal or external may be determined based on position information when the terminal 2 has position information acquisition means, for example, a GPS (Global Positioning System function or a position specifying function using WiFi radio waves). The determination may be made based on the network environment of the terminal 2, for example, a network type such as a wired LAN (Local Area Network) connection, a WiFi connection, or a mobile phone network, an IP address assigned to the terminal 2, and the like.

  In addition, for example, in the case of conscious short-range communication such as infrared communication or cable connection, and in the case of unconscious short-range communication performed without the user's awareness such as Bluetooth, The frequency of authentication may be changed. For example, in the case of conscious short-range communication, the authenticated terminal acquires peripheral information every 30 minutes, and in the case of unconscious short-range communication, the authenticated terminal acquires peripheral information every 5 minutes. Anyway. For example, in the case of conscious short-range communication, the user of the authentication terminal may explicitly specify the authentication frequency when performing communication for the first time.

FIG. 3 is a diagram illustrating an example of the terminal master information 3. The terminal master information 3 shows an example of part or all of the data items that the terminal 2 stores in advance in the storage unit 22 or the like. The terminal master information 3 includes data items such as a terminal ID 31, a user ID 32, and a title 33.
The terminal ID 31 is data that uniquely identifies the terminal 2. The user ID 32 is data that uniquely identifies the user. The authority 33 is data indicating the authority of the user.
For example, in the first record, the terminal ID 31 is “terminal 2A”, the user ID 32 is “user A”, and the title 33 is “general”.

FIG. 4 is a diagram illustrating an example of the authentication condition master information 4. The authentication condition master information 4 shows an example of some or all of the data items that the terminal 2 stores in advance in the storage unit 22 or the like. The authentication condition master information 4 includes data items such as information processing contents 41 and authentication conditions 42, for example.
The information processing content 41 is data indicating predetermined information processing requested by the terminal 2 in accordance with an instruction from a user or the like. The authentication condition 42 is data indicating a condition for determining whether or not a response process may be executed for a predetermined information processing request.
For example, in the first record, the information processing content 41 is “local file operation” and the authentication condition 42 is “none”. Further, for example, in the second record, the information processing content 41 is “external network connection” and the authentication condition 42 is “one or more general or responsible users exist in the vicinity”. Further, for example, in the third record, the information processing content 41 is “external storage medium operation”, and the authentication condition 42 is “one or more responsible users exist in the vicinity”.

FIG. 5 is a diagram illustrating an example of the peripheral information 5. In addition, in order to distinguish with FIG. 9 mentioned later, it describes as "peripheral information 5a" in FIG. The peripheral information 5a shows an example of part or all of the data items stored in the RAM or the like during processing by the terminal 2. The peripheral information 5a includes data items such as a peripheral terminal ID 51, a peripheral user ID 52, and a final acquisition date 53, for example.
The peripheral terminal ID 51 is data indicating the terminal ID of the terminal 2 existing in the periphery acquired by the terminal 2. The peripheral user ID 52 is data indicating the user ID of a user in the periphery acquired by the terminal 2. The last acquisition date and time 53 is data indicating the last date and time when the terminal 2 acquired the terminal ID and the user ID.

  For example, the following five authentication policies can be realized by the terminal authentication system 1 in the first embodiment.

"First authentication policy"
[Distribution] Distribute only one terminal 2 to each user.
[Authentication Condition] The authentication condition master information 4 is defined by the number of terminals 2 present in the vicinity (one or a plurality of terminals may be used).
[Storage Contents] Each terminal 2 stores its own terminal ID indicating its own terminal 2 in advance.
[Transmission contents] The authentication terminal transmits its own terminal ID to the authenticated terminal.
[Determination Content] The authenticated terminal determines the number of terminals 2 existing in the vicinity based on the number of terminal IDs 31 received from the authentication terminals existing in the vicinity. In the first authentication policy, since only one terminal 2 is distributed to each user, the number of terminals 2 existing in the vicinity = the number of users in the vicinity.

"Second authentication policy"
[Distribution] One or a plurality of terminals 2 are distributed to each user.
[Authentication Condition] The authentication condition master information 4 is defined by the number of users in the vicinity (one person or a plurality of persons).
[Storage Contents] Each terminal 2 stores its own user ID indicating its own user in advance.
[Transmission contents] The authentication terminal transmits its own user ID to the authenticated terminal.
[Content of Determination] The authenticated terminal specifies the user ID 32 received from the authentication terminal existing in the vicinity as the peripheral user ID 52. And the to-be-authenticated terminal checks whether or not the peripheral user ID 52 and the own user ID are different, and determines the number of users in the vicinity.

"Third authentication policy"
[Distribution] One or a plurality of terminals 2 are distributed to each user.
[Authentication Condition] The authentication condition master information 4 is defined by the number of users in the vicinity (one person or a plurality of persons).
[Storage Contents] Each terminal 2 stores its own terminal ID indicating its own terminal 2 in advance. Each terminal 2 stores in advance terminal master information 3 in which at least a terminal ID 31 and a user ID 32 are associated with each other.
[Transmission contents] The authentication terminal transmits its own terminal ID to the authenticated terminal.
[Decision Contents] The authenticated terminal receives the terminal ID 31 from an authentication terminal existing in the vicinity. Further, the authenticated terminal refers to the terminal master information 3 to identify the user ID 32 corresponding to the acquired terminal ID 31 as the peripheral user ID 52. And the to-be-authenticated terminal checks whether or not the peripheral user ID 52 and the own user ID are different, and determines the number of users in the vicinity.

"Fourth authentication policy"
[Distribution] One or a plurality of terminals 2 are distributed to each user.
[Authentication Condition] The authentication condition master information 4 is defined by the number of users who have predetermined authority information in the vicinity (one or a plurality of users).
[Storage Contents] Each terminal 2 stores its own user ID indicating its own user in advance. Each terminal 2 stores in advance the terminal master information 3 in which at least the user ID 32 and the authority 33 are associated with each other.
[Transmission contents] The authentication terminal transmits its own user ID to the authenticated terminal.
[Content of Determination] The authenticated terminal specifies the user ID 32 received from the authentication terminal existing in the vicinity as the peripheral user ID 52. The authenticated terminal confirms whether or not the peripheral user ID 52 is a user having predetermined authority information by referring to the terminal master information 3, and determines the number of users having predetermined authority information in the vicinity. .

"Fifth authentication policy"
[Distribution] One or a plurality of terminals 2 are distributed to each user.
[Authentication Condition] The authentication condition is defined by the number of users who have predetermined authority information in the vicinity (one or a plurality of users).
[Storage Contents] Each terminal 2 stores its own terminal ID indicating its own terminal 2 in advance. Each terminal 2 stores in advance terminal master information 3 in which a terminal ID 31, a user ID 32, and an authority 33 are associated.
[Transmission contents] The authentication terminal transmits its own terminal ID to the authenticated terminal.
[Decision Contents] The authenticated terminal receives the terminal ID 31 from an authentication terminal existing in the vicinity. Further, the authenticated terminal refers to the terminal master information 3 to identify the user ID 32 corresponding to the acquired terminal ID 31 as the peripheral user ID 52. The authenticated terminal confirms whether or not the peripheral user ID 52 is a user having predetermined authority information by referring to the terminal master information 3, and determines the number of users having predetermined authority information in the vicinity. .

  It is obvious that the processing contents of the terminal authentication system 1 for the fifth authentication policy can be easily applied to the processing contents for the other authentication policies. Therefore, hereinafter, the process of the terminal authentication system 1 will be described using the fifth authentication policy as an example. In addition, as an example of near field communication, the process of the terminal authentication system 1 will be described using Bluetooth as an example.

  FIG. 6 is a flowchart illustrating a first example of the peripheral information acquisition process. In the first example, the authenticated terminal executes a search process in pairing (a process for specifying a connection partner in Bluetooth).

The control unit 21 of the terminal 2A (authenticated terminal) starts searching for peripheral terminals when the OS is activated and a program related to peripheral terminal information acquisition processing is executed (S101). The control unit 21 of the terminals 2B and 2C (authentication terminal) responds to the search for the terminal 2A (S102).
Next, the control unit 21 of the terminal 2A requests the terminals 2B and 2C to transmit a terminal ID (S103). The control unit 21 of the terminals 2B and 2C transmits its own terminal ID (= own terminal ID) to the terminal 2A (S104).
Next, the control unit 21 of the terminal 2A updates the peripheral information 5 stored in its own RAM or the like based on the received terminal ID (S105).
Then, the control unit 21 of the terminal 2A waits for a predetermined time (= time corresponding to the above-described authentication frequency) (S106), and repeats the processing from S101.

  FIG. 7 is a flowchart illustrating a second example of the peripheral information acquisition process. In the second example, the authentication terminal executes search processing in pairing.

When the OS is started and the program related to the peripheral terminal information acquisition process is executed, the control unit 21 of the terminals 2B and 2C (authentication terminal) starts searching for peripheral terminals (S201). The control unit 21 of the terminal 2A (authenticated terminal) responds to the search for the terminals 2B and 2C (S202).
Next, the control unit 21 of the terminals 2B and 2C transmits its own terminal ID (= own terminal ID) to the terminal 2A (S203).
Next, the control unit 21 of the terminal 2A updates the peripheral information 5 stored in its own RAM or the like based on the received terminal ID (S204), and transmits an update completion notification to the terminals 2B and 2C (S205). ).
Then, the control units 21 of the terminals 2B and 2C wait for a predetermined time (= time corresponding to the above-described authentication frequency) (S206), and repeat the processing from S201.

  The terminal authentication system 1 may execute only one of the processes in FIGS. 6 and 7 described above, or may execute both. However, when the frequency of authentication is changed according to the communication mode of short-distance communication, it is necessary for the authenticated terminal to time a predetermined time, so the processing shown in FIG. The search process in is executed.

FIG. 8 is a flowchart showing authentication condition determination processing in the first embodiment.
When the control unit 21 of the terminal 2A (authenticated terminal) receives a predetermined information processing request in response to an instruction from a user or the like (S301), the authentication unit 42 refers to the authentication condition master information 4 or the like and satisfies the authentication condition 42 It is determined whether or not (S302).
If the authentication condition is satisfied (Yes in S302), the control unit 21 of the terminal 2A executes a response process for a predetermined information processing request (S303). If the authentication condition is not satisfied (No in S302), an error occurs. The process is executed (S304). In the error process, the control unit 21 of the terminal 2A does not execute a response process for a predetermined information processing request, and displays, for example, a notification that authentication has not been received on the display unit 24 or the like.

FIG. 9 is a diagram illustrating an example of the peripheral information 5b.
Hereinafter, the specific processing content of S302 in the authentication condition determination processing of FIG. 8 will be described, comparing FIG. 5 and FIG.

In the peripheral information 5a of FIG. 5, the peripheral terminal ID 51 is only “terminal 2C”.
First, consider a case where the user of the terminal 2A makes a request for “external network connection” and the control unit 21 of the terminal 2A receives the request. Referring to the terminal master information 3, the user ID 32 corresponding to the terminal ID 31 of “terminal 2C” is “user C”, and the authority 33 of “user C” is “general”. Referring to the authentication condition master information 4 in FIG. 4, the authentication condition 42 corresponding to “external network connection” is “one or more general or responsible users exist in the vicinity”. Therefore, the control unit 21 of the terminal 2A is different from its own user “User A” and has “User C” having “General” authority in the vicinity. judge.
Next, consider a case where the user of the terminal 2A makes a request for “operating external storage medium” and the control unit 21 of the terminal 2A receives the request. Referring to the authentication condition master information 4 in FIG. 4, the authentication condition 42 corresponding to “external storage medium operation” is “one or more responsible users exist in the vicinity”. Accordingly, the control unit 21 of the terminal 2A determines that the authentication condition is not satisfied because there is no user having the authority of “responsible person” in the vicinity.

On the other hand, in the peripheral information 5b of FIG. 9, the peripheral terminal ID 51 is “terminal 2B” and “terminal 2C”.
Consider a case where the user of the terminal 2A makes a request for “operating an external storage medium” and the control unit 21 of the terminal 2A receives the request. Referring to the terminal master information 3, the user ID 32 corresponding to the terminal ID 31 of “terminal 2B” is “user B”, and the authority 33 of “user B” is “responsible person”. Referring to the authentication condition master information 4 in FIG. 4, the authentication condition 42 corresponding to “external storage medium operation” is “one or more responsible users exist in the vicinity”. Accordingly, the control unit 21 of the terminal 2A is different from its own user “User B” and has “User B” who has the authority of “Responsible” in the vicinity, and therefore satisfies the authentication condition. Is determined.

As described above, in the terminal authentication system 1 according to the first embodiment, the authenticated terminal indicates whether the authentication terminal exists in the vicinity or whether the authenticated user is in the vicinity by short-range communication. Get peripheral information 3. Next, when receiving a predetermined information processing request, the authenticated terminal determines whether or not an authentication condition for the predetermined information processing request is satisfied based on the peripheral information 3. Next, if the authentication result satisfies the authentication condition, the authenticated terminal executes response processing for the predetermined information processing request, and if the authentication condition is not satisfied, the authenticated terminal responds to the predetermined information processing request. Response processing is not executed.
Thus, the terminal 2 can be used only in an environment where users other than the user are in the vicinity.

<Second Embodiment>
Next, the terminal authentication system 11 in the second embodiment will be described with reference to FIGS. The first to fifth authentication policies exemplified in the first embodiment can also be applied to the second embodiment. Therefore, hereinafter, the process of the terminal authentication system 11 in the second embodiment will be described by taking the fifth authentication policy as an example.

FIG. 10 is a diagram illustrating an outline of the terminal authentication system 11 according to the second embodiment.
As shown in FIG. 10, in the terminal authentication system 11, a plurality of users A to C carry or use the terminals 6A to 6C, respectively. Each of the terminals 6A to 6C performs near field communication with other terminals. Each terminal 6A to 6C functions as an “authenticated terminal” and also functions as an “authentication terminal”.

In the following, for ease of explanation, the terminal 6A is described as “authenticated terminal”, and the terminals 6B and 6C are described as “authenticating terminals”. The terminals 6A to 6C are collectively referred to as “terminal 6”.
The terminal authentication system 11 includes a plurality of terminals 6 distributed for a plurality of users and a server 7 connected via a network 8.

FIG. 11 is a hardware configuration diagram of the terminal 6. Note that the hardware configuration in FIG. 6 is merely an example, and various configurations can be adopted depending on the application and purpose.
The terminal 6 is connected to a control unit 61, a storage unit 62, an input unit 63, a display unit 64, a network communication unit 65, a GPS processing unit 66, an illuminance sensor unit 67, a microphone 68, and the like via a bus 69.
The control unit 61, storage unit 62, input unit 63, display unit 64, network communication unit 65, and bus 69 are the control unit 21, storage unit 22, input unit 23, display unit 24, network of the terminal 2 shown in FIG. The communication unit 25 and the bus 28 are the same.

The GPS processing unit 66 specifies the current position of the terminal 6 using GPS.
The illuminance sensor unit 67 detects the brightness around the terminal 6.
The microphone 68 detects sound (noise) around the terminal 6.

  In the second embodiment, in addition to the determination based on the position information between the authenticated terminal and the authentication terminal, a determination based on the brightness or sound difference between the authenticated terminal and the authentication terminal may be added. For example, even if the location information of the authenticated terminal matches the location information of the authenticated terminal, if the difference between the brightness around the authenticated terminal and the brightness around the authenticated terminal is greater than or equal to a threshold value, authentication is performed around the authenticated terminal. You may make it determine with a terminal not existing. As a result, it is possible to compensate for the insufficient accuracy of the position information. Even if the terminal ID or the user ID is illegally acquired, an accurate determination can be made.

FIG. 12 is a hardware configuration diagram of the server 7. Note that the hardware configuration in FIG. 12 is an example, and various configurations can be adopted depending on the application and purpose.
The server 7 is connected to a control unit 71, a storage unit 72, an input unit 73, a display unit 74, a network communication unit 75, and the like via a bus 76.
The control unit 71, storage unit 72, input unit 73, display unit 74, and network communication unit 75 are the control unit 21, storage unit 22, input unit 23, display unit 24, and network communication unit of the terminal 2 shown in FIG. 25.

FIG. 13 is a diagram illustrating an example of the probe information 9. The probe information 9 indicates an example of part or all of the data items that the terminal 2 transmits to the server 7 and that the server 7 stores in the storage unit 72 and the like. The probe information 9 includes data items such as a terminal ID 91, an acquisition date 92, a latitude 93, a longitude 94, an illuminance 95, and a noise 96, for example.
The terminal ID 91 is data for uniquely identifying the terminal 6 that is the transmission subject of the probe information 9. The acquisition date and time 92 is data indicating the date and time when the server 7 receives the probe information 9. The latitude 93 and the longitude 94 are data for specifying the position of the terminal 6 that is the transmission subject of the probe information 9. The illuminance 95 is data indicating the brightness around the terminal 6 that is the transmission subject of the probe information 9. The noise 96 is data indicating the magnitude of noise around the terminal 6 that is the transmission subject of the probe information 9.
For example, in the first record, the terminal ID 91 is “terminal 6A”, the acquisition date and time 92 is “18:30:30”, the latitude 93 is “N35.xxx”, the longitude 94 is “E139.xxx”, and the illuminance 95 is “90 lux” and noise 96 is “30 dB”.

FIG. 14 is a flowchart showing probe information acquisition processing.
When the OS is activated and the program related to the probe information acquisition process is executed, the control unit 61 of the terminal 6 transmits the probe information 9 to the server 7 (S401).
When receiving the probe information 9, the control unit 71 of the server 7 stores the probe information 9 in the storage unit 72 (S402), and notifies the terminal 6 that the storage is completed (S403).
Then, the control unit 61 of the terminal 6 waits for a predetermined time (= the time according to the authentication frequency described in the first embodiment) (S404), and repeats the processing from S401.

  FIG. 15 is a flowchart illustrating authentication condition determination processing according to the second embodiment. As a premise of the process shown in FIG. 15, the server 7 stores the terminal master information 3 in FIG. 3 and the authentication condition master information 4 in FIG. 4 in the storage unit 72 or the like in advance.

When the control unit 61 of the terminal 6A (authenticated terminal) accepts a request for predetermined information processing in response to an instruction from a user or the like (S501), it indicates authentication request information (authentication request for the predetermined information processing request). Information) is transmitted to the server 7 (S502).
When receiving the authentication request information, the control unit 71 of the server 7 refers to the authentication condition master information 4 and the like, determines whether or not the authentication condition is satisfied (S503), and transmits the determination result to the terminal 6A (S504).
When the authentication condition is satisfied (Yes in S505), the control unit 61 of the terminal 6A executes a response process for a predetermined information processing request (S506), and when the authentication condition is not satisfied (No in S505), an error occurs. Processing is executed (S507). In the error process, the control unit 61 of the terminal 6A does not execute a response process for a predetermined information processing request, and displays, for example, a notification that the authentication has not been received on the display unit 24 or the like.

  Hereinafter, the specific processing contents of S503 in the authentication condition determination processing of FIG. 15 will be described with reference to FIGS.

In the probe information 9 of FIG. 13, the terminal ID 91 is “terminal 6A”, “terminal 6B”, and “terminal 6C”. With reference to the latitude 93 and longitude 94 of the three records, the position information is consistent.
First, consider a case where the user of the terminal 6A makes a request for “external network connection” and the control unit 61 of the terminal 6A receives the request. Referring to the terminal master information 3, the user ID 32 corresponding to the terminal ID 31 of “terminal 6C” is “user C”, and the authority 33 of “user C” is “general”. Referring to the authentication condition master information 4 in FIG. 4, the authentication condition 42 corresponding to “external network connection” is “one or more general or responsible users exist in the vicinity”. Therefore, the control unit 71 of the server 7 is a user different from “user A” who is the user of the authenticated terminal (terminal 6A), and “user C” having “general” authority exists in the vicinity. It is determined that the authentication condition is satisfied.
Next, consider a case where the user of the terminal 6A requests “external storage medium operation” and the control unit 61 of the terminal 6A receives the request. Referring to the terminal master information 3, the user ID 32 corresponding to the terminal ID 31 of “terminal B” is “user B”, and the authority 33 of “user B” is “responsible person”. Referring to the authentication condition master information 4 in FIG. 4, the authentication condition 42 corresponding to “external storage medium operation” is “one or more responsible users exist in the vicinity”. Therefore, the control unit 71 of the server 7 is different from “user B” who is the user of the authenticated terminal (terminal 6A), and “user B” having the authority of “responsible person” exists in the vicinity. Therefore, it is determined that the authentication condition is satisfied.

On the other hand, when the control unit 17 of the server 7 makes a determination based on the illuminance 95 and the noise 96 in addition to the determination based on the latitude 93 and the longitude 94, the results are different.
When the illuminance 95 and the noise 96 of the three records are referred to in the probe information 9 in FIG. 13, the terminal 6A and the terminal 6C match, but the terminal 6A and the terminal 6B do not match.
Consider a case where the user of the terminal 6A makes a request for “operating an external storage medium” and the control unit 61 of the terminal 6A receives the request. Referring to the probe information 9 in FIG. 13, the terminal 6A and the terminal 6B determine that the authentication condition is not satisfied because the illuminance 95 and the noise 96 do not match.
In such a case, for example, the user B of the terminal 6B moves to a quiet place such as a private room, and after the user A of the terminal 6A confirms that the user B has moved to the private room, the trade secret is stored in the external storage device. Or personal information may be stored. Such a fraudulent act can be prevented by the server 7 making a determination based on the illuminance 95 and the noise 96.

As described above, in the terminal authentication system 11 in the second embodiment, the terminal 6 transmits its own probe information 9. The server 7 stores probe information 9 received from the terminal 6. Upon receiving a request for predetermined information processing, the authenticated terminal transmits authentication request information indicating a request for authentication for the predetermined information processing request to the server 7. The server 7 determines whether or not the authentication condition is satisfied by referring to the probe information 9 for the authentication request information received from the authenticated terminal, and transmits the determination result to the authenticated terminal. The authenticated terminal receives the determination result from the server 7 and executes a response process for the predetermined information processing request when the authentication condition is satisfied, and the predetermined information processing request when the authentication condition is not satisfied. Response processing is not executed for.
Thus, the terminal 2 can be used only in an environment where users other than the user are in the vicinity.

  The preferred embodiments of the terminal authentication system and the like according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

1, 11 ... Terminal authentication system 2, 6 ... Terminal 3 ... Terminal master information 4 ... Authentication condition master information 5 ... Peripheral information 7 ... Server 8 ... Network 9 ... ... probe information

Claims (4)

A terminal authentication system composed of a plurality of terminals distributed to a plurality of users,
The terminal
By short-range communication, acquisition means for acquiring peripheral information indicating whether there is another terminal in the vicinity, or whether there is another user in the vicinity;
Receiving means for receiving a request for predetermined information processing;
Determination means for determining whether or not an authentication condition for the predetermined information processing request is satisfied based on the peripheral information;
As a result of the determination by the determination means, if the authentication condition is satisfied, a response process is executed for the predetermined information processing request, and if the authentication condition is not satisfied, the predetermined information processing request is performed. Processing execution means that does not execute response processing,
A terminal authentication system comprising: A terminal authentication system composed of a plurality of terminals distributed to a plurality of users and a server connected to the terminal via a network,
The terminal
Probe information transmitting means for transmitting own probe information;
Receiving means for receiving a request for predetermined information processing;
Authentication request means for sending authentication request information indicating a request for authentication to the predetermined information processing request to the server;
When the authentication condition determination result for the authentication request information is received from the server, and when the authentication condition is satisfied, a response process is executed for the predetermined information processing request, and when the authentication condition is not satisfied Processing execution means for not executing response processing in response to the predetermined information processing request;
Comprising
The server
Storage means for storing the probe information received from the terminal;
A determination unit that determines whether or not the authentication condition is satisfied by referring to the probe information with respect to the authentication request information received from the terminal;
An authentication response means for transmitting a determination result by the determination means to the terminal;
A terminal authentication system comprising: A terminal authentication method in a terminal authentication system composed of a plurality of terminals distributed to a plurality of users,
Whether the authenticated terminal as the terminal to be authenticated is in the vicinity of the authentication terminal as the terminal to be authenticated by near field communication, or whether the authenticated user as the user to be authenticated is in the vicinity Obtaining peripheral information indicating
The authenticated terminal accepting a request for predetermined information processing;
Determining whether the authenticated terminal satisfies an authentication condition for the predetermined information processing request based on the peripheral information; and
If the authenticated terminal satisfies the authentication condition as a result of the determination, a response process is executed for the predetermined information processing request, and if the authentication condition is not satisfied, the predetermined information processing request is executed. A step that does not perform response processing for
A terminal authentication method including: A terminal authentication method in a terminal authentication system comprising a plurality of terminals distributed to a plurality of users and a server connected to the terminal via a network,
The terminal transmitting its own probe information;
Storing the probe information received by the server from the terminal;
An authenticated terminal, which is the terminal to be authenticated, accepts a request for predetermined information processing;
The authenticated terminal transmitting authentication request information indicating an authentication request to the predetermined information processing request to the server;
Determining whether the server satisfies the authentication condition by referring to the probe information for the authentication request information received from the authenticated terminal;
The server transmitting a determination result to the authenticated terminal;
The authenticated terminal receives the determination result from the server, executes a response process for the predetermined information processing request if the authentication condition is satisfied, and if the authentication condition is not satisfied, A step of not executing response processing for a predetermined information processing request;
A terminal authentication method including:

Images