JP2017021452A - Operator confirmation server, operator confirmation system, operator confirmation method and operator confirmation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an operator confirmation server, operator confirmation system, operator confirmation method and operator confirmation program capable of exactly grasping unauthorized use of a portable terminal device.SOLUTION: A biological information storage part 110 associates a terminal ID for identifying a portable terminal device 200 with biological information, and with date information for storage, a transmission/reception part 101 receives a terminal ID and biological information transmitted from the portable device 200, a biological information collation part 104 collates the received biological information with the latest biological information stored in the biological information storage part 110, associated with the terminal ID, and generates a user certificate being an electronic certificate corresponding to the user of the portable terminal device 200 in the case of determining that the biological information does not coincide, and the transmission/reception part 101 transmits the generated user certificate to the portable terminal device 200.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an operator confirmation server, an operator confirmation system, an operator confirmation method, and an operator confirmation program.

  In recent years, it has become possible to execute various processes from a mobile terminal device such as a smartphone or a mobile phone, and the importance of a technique for confirming an operator so as not to be used illegally by another person is increasing. As a technology for authenticating such an operator, when more detailed information is accessed or when the security check has not been completed, unauthorized use is determined by performing a security check by entering a password. Has been disclosed (see Patent Document 1).

JP 2004-110840 A

  However, in the above-mentioned publication, in order to determine whether or not the user is a legitimate user by inputting a correct password, if the password is known to others, it cannot be determined to be an unauthorized use. There was also a problem that it was difficult to prove that it was illegal use after the fact.

  The present invention has been made in view of the above, and provides an operator confirmation server, an operator confirmation system, an operator confirmation method, and an operator confirmation program capable of accurately grasping unauthorized use of a mobile terminal device. For the purpose.

  In order to solve the above-described problem, the present invention receives terminal identification information and biological information transmitted from a mobile terminal device, and receives the received biological information and the biological information associated with the received terminal identification information. When the latest biometric information stored in the storage means is collated and it is determined that the biometric information does not match, a user certificate that is an electronic certificate corresponding to the user of the mobile terminal device is generated and generated A user certificate is transmitted to the mobile terminal device.

  According to the present invention configured as described above, there is an effect that it is possible to accurately grasp unauthorized use of the mobile terminal device.

It is a block diagram which shows the structural example of the user confirmation system 10 concerning a present Example. It is explanatory drawing which shows an example of a data structure of the biometric information storage part. 4 is an explanatory diagram illustrating an example of a data configuration of a certificate information storage unit 120. FIG. 4 is a flowchart illustrating a certificate generation processing procedure executed by the server 100 and the mobile terminal device 200. 5 is a flowchart showing a biometric information collating process procedure executed by the server 100 and the mobile terminal device 200. 4 is a flowchart showing an operator confirmation processing procedure executed by the server 100.

  Embodiments of the present invention will be described below with reference to the accompanying drawings. In addition, the following description is an example of embodiment and this invention is not limited to these Examples.

  FIG. 1 is a block diagram illustrating a configuration example of a user confirmation system 10 according to the present embodiment. As shown in FIG. 1, the user confirmation system 10 connects a server 100, a mobile terminal device 200, and an information terminal device 300 through a network N so that they can communicate with each other. A part or all of the network N is wired or wireless, and is a communication network such as the Internet, an intranet, a LAN (Local Area Network), and a mobile communication network.

  The server 100 identifies an electronic certificate (hereinafter referred to as a user certificate) corresponding to user identification information (hereinafter referred to as a user ID) that identifies a user who operates the mobile terminal device 200 and the mobile terminal device 200. The server issues an electronic certificate (hereinafter referred to as a terminal certificate) corresponding to terminal identification information (hereinafter referred to as a terminal ID). The server 100 is a server that receives biometric information transmitted from the mobile terminal device 200 and generates a new user certificate if the biometric information does not match the prestored biometric information.

  The mobile terminal device 200 is an information processing device operated by a user such as a smartphone, a mobile phone, a notebook PC, or the like, and acquires the user's biometric information according to the user's operation.

  The information terminal device 300 is a PC, tablet terminal, or other information processing device operated by a person who confirms whether or not the operator of the portable terminal device 200 is a valid user.

  Next, the configuration and function of the server 100 will be described. The server 100 includes a transmission / reception unit 101, a certificate generation unit 102, a certificate authentication unit 103, a biometric information matching unit 104, an operator confirmation unit 105, a biometric information storage unit 110, and a certificate information storage unit 120.

  FIG. 2 is an explanatory diagram illustrating an example of a data configuration of the biological information storage unit 110. The biological information storage unit 110 stores biological information transmitted from the portable terminal device 200 and information related to the biological information. Specifically, the biometric information storage unit 110 stores a terminal ID, biometric information, position information, and date / time information in association with each other.

  FIG. 3 is an explanatory diagram illustrating an example of a data configuration of the certificate information storage unit 120. The certificate information storage unit 120 stores information related to the user certificate and the terminal certificate. Specifically, the certificate information storage unit 120 includes a user ID, user certificate information, user certificate issuance date / time, terminal ID, terminal certificate information, and terminal certificate issuance date / time. Store in association with each other. Here, the user certificate information is information included in the user certificate and information used when authenticating the user certificate. For example, the serial number of the user certificate. The terminal certificate information is information included in the terminal certificate and information used when authenticating the terminal certificate. For example, the serial number of the terminal certificate.

  The transmission / reception unit 101 transmits / receives data to / from the mobile terminal device 200 or the information terminal device 400. Specifically, the transmission / reception unit 101 receives the user ID and the terminal ID transmitted from the mobile terminal device 200, and transmits the user certificate and the terminal certificate to the mobile terminal device 200. In addition, the transmission / reception unit 101 receives biological information transmitted from the mobile terminal device 200 and information related to the biological information.

  The certificate generation unit 102 generates a user certificate corresponding to the user ID transmitted from the portable terminal device 200, and the biological information transmitted from the portable terminal device 200 is stored in the biological information storage unit 110. If it does not match, a new user certificate is generated. Further, the certificate generation unit 102 generates a terminal certificate corresponding to the terminal ID transmitted from the mobile terminal device 200.

  The certificate authentication unit 103 authenticates the user certificate and the terminal certificate. Specifically, the certificate authentication unit 103 collates the terminal certificate information included in the user certificate transmitted from the mobile terminal device 200 with the user certificate information stored in the certificate storage unit 120, Authenticate the user certificate. The certificate authentication unit 103 verifies the terminal certificate by comparing the terminal certificate information included in the terminal certificate transmitted from the mobile terminal device 200 with the terminal certificate information stored in the certificate storage unit 120.

  The biometric information matching unit 104 matches biometric information transmitted from the mobile terminal device 200. Specifically, the biometric information collating unit 104 collates the biometric information transmitted from the mobile terminal device 200 with the latest biometric information stored in the biometric information storage unit 110 and determines whether or not they match. .

  The operator confirmation unit 105 confirms whether or not the operation of the mobile terminal device 200 is an operation by a valid user (owner or the like) of the mobile terminal device 200. Specifically, the operator confirmation unit 105 determines whether the operation of the mobile terminal device 200 is based on whether the user certificate issuance date / time associated with the user ID matches the terminal certificate issuance date / time. It is determined whether the operation is performed by 200 authorized users.

  Next, the configuration and function of the mobile terminal device 200 will be described. The mobile terminal device 200 includes a transmission / reception unit 201, an operation display unit 202, a biometric information acquisition unit 203, and a certificate storage unit 210.

  The certificate storage unit 210 stores a user certificate corresponding to the user ID of the user who operates the mobile terminal device 200 and a terminal certificate corresponding to the terminal ID of the mobile terminal device 200 generated by the server 100. To do.

  The transmission / reception unit 201 transmits a user ID and a terminal ID to the server 100 and receives a user certificate and a terminal certificate. The transmission / reception unit 201 adds position information and date / time information to the biological information acquired by the biological information acquisition unit 202 and transmits the information to the server 100. Communication between the mobile terminal device 200 and the server 100 can be performed by SSL (Secure Socket Layer) encrypted communication using an electronic certificate.

  The operation display unit 202 includes an input unit and a display unit. For example, in the case of a smartphone, the operation display unit 202 includes a liquid crystal display or an organic EL panel that is a display unit and a touch sensor that is an input unit, like a touch panel.

  The biological information acquisition unit 203 acquires the operator's biological information from an operation on the mobile terminal device 200. For example, the biometric information acquisition unit 203 reads a fingerprint using a touch sensor when the operator performs an operation such as a tap or swipe on the operation display unit 202.

  A certificate generation process executed by the user confirmation system 10 configured as described above will be described. FIG. 4 is a flowchart showing a certificate generation processing procedure executed by the server 100 and the mobile terminal device 200.

  First, when the portable terminal device 200 is turned on, the portable terminal device 200 is activated (step S401). As a result, the initial setting program operates. The operation display unit 202 receives an input of a user ID (step S402). The transmission / reception unit 101 acquires a terminal ID from a storage unit (not shown) (step S403). The transmission / reception unit 101 transmits the user ID and the terminal ID to the server 100 (step S404).

  The transmission / reception unit 101 of the server 100 receives the user ID and the terminal ID, and the certificate generation unit 102 generates a user certificate corresponding to the user ID and a terminal certificate corresponding to the terminal ID (step S406). ). The transmission / reception unit 101 transmits the user certificate and the terminal certificate to the mobile terminal device 200 (step S407). The certificate generation unit 102 associates the user ID, user certificate information, user certificate issuance date / time information, terminal ID, terminal certificate information, and terminal certificate issuance date / time information in the certificate information storage unit 120. Store (step S408).

  The transmission / reception unit 201 of the portable terminal device 200 receives the user certificate and the terminal certificate and stores them in the certificate storage unit 210 (step S409). The biometric information acquisition unit 203 acquires biometric information (step S410). The biometric information acquisition unit 203 adds position information and date / time information to the biometric information (step S411). The transmission / reception unit 201 transmits the terminal ID, biometric information, position information, and date / time information to the server 100 (step S412). At this time, the encrypted information is transmitted using SSL encrypted communication.

  The transmission / reception unit 101 of the server 100 receives the terminal ID, the biological information, the position information, and the date / time information, and stores the terminal ID, the biological information, the position information, and the date / time information in the biological information storage unit 110 in association with each other (step S413). .

  Next, the biometric information matching process executed by the operator confirmation system 10 will be described. FIG. 5 is a flowchart showing a biometric information matching processing procedure executed by the server 100 and the mobile terminal device 200.

  The mobile terminal device 200 is activated by turning on the power or returning from sleep (step S501). The biometric information acquisition unit 203 acquires biometric information (step S502). The biometric information acquisition unit 203 adds position information and date / time information to the biometric information (step S503). The transmission / reception unit 201 acquires a terminal certificate from the certificate storage unit 210 (step S504), and transmits the terminal certificate to the server 100 (step S505).

  The transmission / reception unit 101 of the server 100 receives the terminal certificate, and the certificate authentication unit 103 authenticates the terminal certificate (step S506). Specifically, authentication is performed based on whether the terminal certificate information included in the received terminal certificate matches the terminal certificate information stored in the certificate information storage unit 120. The transmission / reception unit 101 transmits the authentication result to the mobile terminal device 200 (step S507).

  When the transmission / reception unit 201 of the mobile terminal device 200 receives the authentication result and determines that the terminal certificate is authenticated based on the received authentication result (step S508: Yes), the transmission / reception unit 201 receives the terminal ID, the biological information, The position information and date / time information are transmitted to the server 100 (step S509). At this time, the encrypted information is transmitted using SSL encrypted communication. If it is determined that the terminal certificate has not been authenticated (step S508: No), the process ends.

  The transmission / reception unit 101 of the server 100 receives the terminal ID, biometric information, position information, and date / time information (step S510). The biometric information matching unit 104 determines whether the biometric information matches the biometric information stored in the biometric information storage unit 110 (step S511). Specifically, the latest biometric information associated with the terminal ID is acquired from the biometric information storage unit 110, and it is determined whether the acquired biometric information matches the biometric information received from the mobile terminal device 200. To do. When it is determined that the biological information matches the biological information stored in the biological information storage unit 110 (step S511: Yes), that is, when it is determined that the operator has not changed, the process proceeds to step S516.

  If it is determined that the biometric information does not match the biometric information stored in the biometric information storage unit 110 (step S511: No), that is, if it is determined that the operator has changed, the certificate generation unit 102 is. A new user certificate is generated (step S512). The transmission / reception unit 101 transmits the user certificate to the mobile terminal device 200 (step S513). The transmission / reception unit 201 of the mobile terminal device 200 receives the user certificate and stores it in the certificate storage unit 210 (step S514).

  The certificate generation unit 102 of the server 100 stores the user ID, user certificate information, and issue date / time in the certificate information storage unit 120 (step S515). For example, it is stored as indicated by 31 in FIG. The transmission / reception unit 101 stores the terminal ID, biometric information, position information, and date / time information in the biometric information storage unit 110 (step S516).

  Thus, after authenticating the portable terminal device 200 with the terminal certificate, the biometric information acquired by the operation of the portable terminal device 200 is different from the biometric information stored in the biometric information storage unit 110 of the server 100. A valid user certificate. As a result, when and where the operator of the mobile terminal device 200 is changed can be recorded. Further, since the biometric information when the user certificate is issued is stored in the biometric information storage unit 110, it is possible to know who operated after the fact.

  In the embodiment described above, a fingerprint is used as the biometric information, but an operator's voice or voiceprint may be acquired as the biometric information. In that case, the biometric information acquisition unit 203 acquires sound from a microphone used for telephone or voice input.

  Next, an operator confirmation process executed by the operator confirmation system 10 will be described. FIG. 6 is a flowchart showing an operator confirmation processing procedure executed by the server 100.

  The transmission / reception unit 101 of the server 100 receives the user ID from the mobile terminal device 200 or the information terminal device 300 (step S601). The operator confirmation unit 105 acquires a terminal ID corresponding to the user ID from the certificate information storage unit 120 (step S602). The operator confirmation unit 105 acquires the terminal certificate issuance date and time corresponding to the terminal ID from the certificate information storage unit 120 (step S603). The operator confirmation unit 105 obtains the latest user certificate issuance date corresponding to the user ID from the certificate information storage unit 120 (step S604).

  The operator confirmation unit 105 determines whether or not the terminal certificate issuance date / time and the user certificate issuance date / time match (step S605). If it is determined that the terminal certificate issuance date / time does not match the user certificate issuance date / time (step S605: No), that is, if it is determined that a new user certificate has been issued, it is determined that there is an operator change ( Step S606). If it is determined that the terminal certificate issuance date / time and the user certificate issuance date / time match (step S605: Yes), that is, if it is determined that a new user certificate has not been issued, it is determined that there is no change in the operator. (Step S607). The transmission / reception unit 101 transmits the determination result to the mobile terminal device 200 or the information terminal device 300 (step S608).

  For example, in FIG. 3, the user ID 'UID *** 62' has a terminal certificate issuance date and time of '2015.7.1 10:23:46' (32 in FIG. 3), and the most recent user certificate issuance Since the date and time is '2015.7.28 21:38:38' (31 in FIG. 3), the terminal certificate issuance date and user certificate issuance date do not match, and it is determined that there is an operator change. Note that the time lag that occurs in the system is taken into account in determining whether the terminal certificate issuance date and time and the user certificate issuance date and time match.

  Thus, by determining whether or not a new user certificate has been issued for the user ID of the user to be checked, the mobile terminal device 200 used by the user is a legitimate user. It is possible to know the possibility that other users operated. Note that the operator confirmation process may accept confirmation from a person other than the user, such as a credit company or an EC site that accepts an operation from the portable terminal device 200, in addition to the user of the portable terminal device 200 itself.

  In the above-described embodiment, only the presence / absence of the operator change is determined, but the user certificate issuance date / time information stored in the certificate information storage unit 120 and the biometric information and position information stored in the biometric information storage unit 110 are determined. By associating the date and time information, it is possible to know when and where the operator of which biological information has operated the mobile terminal device 200.

  The biometric information acquisition unit 203 may be a device independent of the mobile terminal device 200. As long as an individual can be identified, a measuring device that measures, for example, heart rate, electrocardiogram, blood pressure, body temperature, respiratory rate, number of steps, brain waves, and the like may be used. When biometric information is acquired by an independent measuring device, the mobile terminal device 200 is connected to the mobile terminal device 200 by a short-range wireless communication method such as Bluetooth (registered trademark), WiFi (WIreless FIdelity) (registered trademark), NFC (Near Field Communication), or the like. Send and receive data between them.

  The hardware configuration of the server 100, the portable terminal device 200, and the information terminal device 300 according to the above-described embodiments includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and an HDD (Hard Disk Drive). ) And the like, and the above-described configuration and functions are realized by the CPU reading and operating the program stored in the ROM, RAM, HDD, or the like.

  Programs operating on the server 100, the mobile terminal device 200, and the information terminal device 300 are stored on a computer connected to the network N such as the Internet, and can be provided or installed by downloading via the network N The file may be recorded in a computer-readable recording medium such as a CD-ROM, a DVD, a USB memory, an SD card, or the like in a format or executable file. Further, the program for realizing the functions and processes described above may be provided in a usage form such as API (Application Programming Interface), SaaS (Software as a Service), or cloud computing.

  Note that the present invention is not limited to the above-described embodiments as they are, and does not necessarily have to be physically configured as illustrated. In addition, the present invention is configured to functionally or physically divide, integrate, replace, modify, or delete all or a part of the constituent elements described in the embodiments in arbitrary units according to various loads or usage conditions. Can be configured.

DESCRIPTION OF SYMBOLS N ... Network, 10 ... Operator confirmation system, 100 ... Server, 101 ... Transmission / reception part, 102 ... Certificate generation part, 103 ... Certificate authentication part, 104 ... Biometric information collation part, 105 ... Operator confirmation part, 110 ... Biometric information storage unit, 120 ... Certificate information storage unit, 200 ... Mobile terminal device, 201 ... Transmission / reception unit, 202 ... Operation display unit, 203 ... Biometric information acquisition unit, 210 ... Certificate storage unit, 300 ... Information terminal device

Claims (6)

In the operator confirmation server connected to the mobile terminal device via the network,
Biometric information storage means for storing terminal identification information for identifying the portable terminal device, biometric information, and date / time information in association with each other
Receiving means for receiving the terminal identification information and biometric information transmitted from the portable terminal device;
Biometric information collating means for collating the biometric information received by the receiving means with the latest biometric information stored in the biometric information storage means, which is associated with the terminal identification information;
A certificate generation unit that generates a user certificate that is an electronic certificate corresponding to a user of the mobile terminal device when the biometric information collating unit determines that the biometric information does not match;
Transmitting means for transmitting the user certificate generated by the certificate generating means to the portable terminal device;
An operator confirmation server comprising: The receiving means receives a terminal certificate, which is an electronic certificate corresponding to the mobile terminal device, from the mobile terminal device,
Certificate authenticating means for authenticating the terminal certificate received by the receiving means,
The operator confirmation server according to claim 1, wherein the receiving unit receives the terminal identification information and the biological information from the portable terminal device when the terminal certificate is authenticated. Certificate information storage means for storing user identification information for identifying a user of the portable terminal device, user certificate issuance date / time information, the terminal identification information, and terminal certificate issuance date / time information in association with each other. With
The receiving means receives the user identification information;
The most recent user certificate issuance date / time information associated with the user identification information matches the terminal certificate issuance date / time information associated with the terminal identification information corresponding to the user identification information. The operator confirmation server according to claim 1, further comprising: an operator confirmation unit that determines whether or not the operator of the portable terminal device has changed depending on whether or not to perform the operation. . In an operator confirmation system that connects a mobile terminal device and a server via a network,
The portable terminal device
Biometric information acquisition means for acquiring biometric information of the operator;
First transmission means for transmitting the biometric information acquired by the biometric information acquisition means and terminal identification information for identifying the mobile terminal device to the server;
The server
Biometric information storage means for storing the terminal identification information, biometric information, and date / time information in association with each other;
First receiving means for receiving the biological information and the terminal identification information from the portable terminal device;
Biometric information collating means for collating the biometric information received by the first receiving means with the most recent biometric information stored in the biometric information storing means associated with the terminal identification information;
A certificate generation unit that generates a user certificate that is an electronic certificate corresponding to a user of the mobile terminal device when the biometric information collating unit determines that the biometric information does not match;
Second transmission means for transmitting the user certificate generated by the certificate generation means to the portable terminal device,
The portable terminal device
Second receiving means for receiving the user certificate from the server and storing the received user certificate in a certificate storage unit;
An operator confirmation system comprising: An operator confirmation method executed by an operator confirmation server connected to a mobile terminal device via a network,
Biometric information storage means for storing terminal identification information for identifying the portable terminal device, biometric information, and date / time information in association with each other,
A receiving step of receiving the terminal identification information and biometric information transmitted from the mobile terminal device;
A biometric information collating step for collating the biometric information received in the receiving step with the most recent biometric information stored in the biometric information storage unit associated with the terminal identification information;
A certificate generation step of generating a user certificate, which is an electronic certificate corresponding to the user of the mobile terminal device, when the biometric information is determined not to match in the biometric information matching step;
A transmission step of transmitting the user certificate generated by the certificate generation step to the mobile terminal device;
The operator confirmation method characterized by including this.   An operator confirmation program for causing a computer to execute the operator confirmation method according to claim 5.

Images