JP2018098553A - Information processing system, communication device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate key information without using a secrete key.SOLUTION: In an information processing system including a communication device, a verification device, and a key information generation device, the key information generation device includes a key information generation unit for generating key information by using the public key of the communication device, and the information sharing with the verification device, the communication device includes a reception unit for receiving the key information generated by the key information generation unit, and a transmission unit for transmitting the key information received by the reception unit to the verification device, and the verification device includes a verification unit for verifying the key information received from the communication device, based on the information sharing with the key information generation device.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing system, a communication device, and a program.

  Conventionally, a lock device capable of electrically locking and unlocking a door has been developed. For example, Patent Document 1 discloses a technique in which when a user terminal transmits key information to a lock device, the lock device verifies the key information, and when the key information is successfully verified, the lock device performs unlock control. ing. In Patent Document 1, key information is generated using a secret key of the owner terminal and a public key of the user terminal, and the lock lock device verifies the key information using the public key of the owner terminal.

Japanese Patent Laid-Open No. 2006-111704

  However, in the technique described in Patent Document 1, since the key information is generated using the secret key of the owner terminal, the key information generation entity is limited to the owner terminal having the secret key. For this reason, a load for generating the key information is generated on the owner side every time the issue of the key information is requested.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a new and improved information processing system capable of generating key information without using a secret key. It is to provide a communication device and a program.

  In order to solve the above problems, according to an aspect of the present invention, an information processing system comprising a communication device, a verification device, and a key information generation device, wherein the key information generation device is the communication device. A key information generating unit that generates key information using the public key of the key and shared information shared with the verification device, and the communication device receives the key information generated by the key information generating unit. And a transmitter that transmits the key information received by the receiver to the verification device, wherein the verification device uses the key information received from the communication device as the key information generation device. There is provided an information processing system including a verification unit that performs verification based on the shared information that is shared. According to such a configuration, it is possible for the verification device to verify whether the key information transmitted from the communication device is the key information generated by the key information generation unit based on the shared information.

  The reception unit receives a random number from the verification device after the verification of the key information by the verification unit is successful, and the communication device generates a response information using the random number and the secret key of the communication device The information processing apparatus may further include a generation unit, and the verification unit may verify the response information using response information received from the communication device and a public key of the communication device extracted from the key information.

  The verification device may further include a process execution unit that executes a process requested by the communication device based on the successful verification by the verification unit.

  The process execution unit may execute locking or unlocking of the door.

  In order to solve the above problem, according to another aspect of the present invention, there is provided a communication device that communicates with a key information generation device and a verification device, from the key information generation device to a public key of the communication device and A receiving unit that receives key information generated using shared information shared by the key information generation device and the verification device; and a transmission unit that transmits the key information received by the reception unit to the verification device; A communication device is provided.

  In order to solve the above problem, according to another aspect of the present invention, there is provided a communication device that communicates a computer with a key information generation device and a verification device, from the key information generation device to the communication device. A reception unit that receives a public key and key information generated using shared information shared by the key information generation device and the verification device, and transmits the key information received by the reception unit to the verification device A program for causing a communication unit to function as a transmission unit is provided.

  As described above, according to the present invention, key information can be generated without using a secret key.

It is explanatory drawing which shows the structure of the information processing system by embodiment of this invention. It is explanatory drawing which shows the system relevant to embodiment of this invention. It is explanatory drawing which shows the flow of a series of processes including issuing and unlocking of Ekey in the system shown in FIG. It is explanatory drawing which shows the structure of the management server by embodiment of this invention. It is explanatory drawing which shows the specific example of the information which a management information storage part memorize | stores. It is explanatory drawing which shows the specific example of the information which a management information storage part memorize | stores. It is explanatory drawing which shows the structure of a guest terminal and a lock device. It is explanatory drawing which shows the flow of issuing of Ekey. It is explanatory drawing which shows the flow of unlocking using Ekey. It is explanatory drawing which shows the structure of the information processing system by an application example. It is explanatory drawing which shows the specific example of the information which a management information storage part memorize | stores. It is explanatory drawing which shows the structure of a home hub. It is explanatory drawing which shows operation | movement of an application example. It is explanatory drawing which showed the hardware constitutions of the communication terminal.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

  In the present specification and drawings, a plurality of components having substantially the same functional configuration may be distinguished by adding different alphabets after the same reference numeral. However, when it is not necessary to particularly distinguish each of a plurality of constituent elements having substantially the same functional configuration, only the same reference numeral is given to each of the plurality of constituent elements.

<1. Configuration of information processing system>
FIG. 1 is an explanatory diagram showing a configuration of an information processing system according to an embodiment of the present invention. As shown in FIG. 1, the information processing system according to the embodiment of the present invention includes a lock device 10, a communication terminal 20, and a management server 30.

  The communication terminal 20 and the management server 30 are connected via the communication network 12. The communication network 12 is a wired or wireless transmission path for information transmitted from a device connected to the communication network 12. For example, the communication network 12 may include a public line network such as the Internet, a telephone line network, a satellite communication network, various local area networks (LANs) including the Ethernet (registered trademark), a wide area network (WAN), and the like. . Further, the communication network 12 may include a dedicated line network such as an IP-VPN (Internet Protocol-Virtual Private Network).

  The lock device 10 is an example of a verification device, and is attached to, for example, a door of a house entrance as shown in FIG. The lock device 10 has a wireless communication function. When an unlock request or a lock request is received from the communication terminal 20 using key information called Ekey, the lock device 10 verifies the validity of the Ekey of the communication terminal 20, and verifies the verification. Unlock or lock the door based on success. The lock device 10 can unlock or lock the door, for example, by rotating the thumb turn of the door.

  The wireless communication function of the lock device 10 is a short-range wireless communication function such as BLE (Bluetooth Low Energy), Bluetooth (registered trademark), wireless LAN (Local Area Network), or NFC (Near Field Communication). Also good.

  In the present specification, an example in which the lock device 10 is attached to the door of the house is described, but the door to which the lock device 10 is attached is not limited to the door of the house. For example, the lock device 10 may be attached to a door of a room in a house, or may be attached to a door in an office. Furthermore, the lock device 10 may be attached to an object other than the door. For example, the lock device 10 may be attached to a door of a safe, or may be attached to a door of a housing that covers a control panel in which an operator having an operation right is restricted.

  The communication terminal 20 is an example of a communication device used by a user. The communication terminal 20 has a function of communicating with the management server 30 via the communication network 12 and a function of communicating with the lock device 10. The communication terminal 20 can receive an Ekey from the management server 30 and make an unlock request or a lock request to the lock device 10 using the Ekey.

  Here, some terms are arranged. In this embodiment, a user is divided roughly into an owner and a guest. The owner is an administrator or owner of the lock device 10. In this specification, the communication terminal 20 used by the owner may be referred to as an owner terminal 21. The guest is a person who has been given the operation authority of the lock device 10 by the owner or a person who can be given the operation authority. In this specification, the communication terminal 20 used by the guest may be referred to as a guest terminal 22.

  The management server 30 is an example of a key information generation device having a function for generating an Ekey. Specifically, when receiving the guest registration request including the designation of the guest and the lock device 10 from the owner terminal 21, the management server 30 obtains the account information of the designated guest and the lock ID of the designated lock device 10. Associate. Then, the management server 30 generates an Ekey for unlocking the lock device 10 having the lock ID associated with the account information of the guest based on the Ekey issuance request from the guest, and the generated Ekey is the guest Downloaded to the terminal 22.

(background)
The outline of the information processing system according to the embodiment of the present invention has been described above. Subsequently, in order to clarify the technical significance of the information processing system according to the embodiment of the present invention, prior to detailed description of the information processing system according to the embodiment of the present invention, processing in the system related to the embodiment of the present invention. Will be explained.

  FIG. 2 is an explanatory diagram showing a system related to the embodiment of the present invention. As shown in FIG. 2, the system includes a management server, an owner terminal, a guest terminal, and a lock device. The owner terminal has a secret key O_sk of the owner terminal, the guest terminal has a secret key G_sk of the guest terminal, and the management server has a public key O_pk of the owner terminal and a public key G_pk of the guest terminal.

  FIG. 3 is an explanatory diagram showing a flow of a series of processes including Ekey issuance and unlocking in the system shown in FIG. As shown in FIG. 3, first, the owner approaches the lock device with the owner terminal, and registers the public key O_pk of the owner terminal in the lock device (0). Thereafter, when the guest terminal transmits an Ekey issuance request to the owner terminal (1), the owner terminal acquires the public key G_pk of the guest terminal from the management server from the management server (2). Then, the owner terminal generates Ekey using the secret key O_sk of the owner terminal and the public key G_pk of the guest terminal (3), and uploads Ekey to the management server (4).

  Thereafter, the guest terminal downloads Ekey from the management server (5). The guest terminal transmits an unlock request to the lock device using the downloaded Ekey (6). The lock device verifies Ekey using the public key O_pk of the owner terminal registered in the lock device, and unlocks the door when the verification is successful (7).

  However, there are several concerns with this system. For example, regarding the process of registering the owner terminal public key O_pk in advance in the lock device, the registration of the owner terminal public key O_pk to the lock device is performed in a state where the owner terminal and the lock device are physically close to each other. The owner with the owner terminal has to go to the place where the lock device is located. Also, when removing the public key O_pk registered in the lock device, the owner having the owner terminal has to go to the place where the lock device is located.

  Further, since the secret key O_sk of the owner terminal is used for generation of Ekey, the generation subject of Ekey is limited to the owner terminal having a secret key. For this reason, a load is generated on the owner side for generating an Ekey every time an Ekey issuance is requested. In addition, the management server can acquire the generated Ekey, but cannot generate the Ekey itself, so it is difficult for the management server to centrally manage the Ekey format change and the like.

  Therefore, the inventor of the present invention has come up with an embodiment of the present invention by focusing on the above circumstances. The operation according to the embodiment of the present invention is realized without the process of registering the public key of the owner terminal 21 in the lock device. For this reason, it is possible to reduce the trouble of the owner. Further, according to the embodiment of the present invention, the management server 30 can generate an Ekey without using the secret key of the owner terminal 21. For this reason, it is possible to reduce the load on the owner side and to perform central management by the management server 30. Hereinafter, the configuration and operation of the embodiment of the present invention will be sequentially described in detail.

<2. Management Server Configuration>
FIG. 4 is an explanatory diagram showing the configuration of the management server 30 according to the embodiment of the present invention. As shown in FIG. 4, the management server 30 according to the embodiment of the present invention includes a communication unit 320, a management information storage unit 330, and a key information generation unit 340.

(Communication Department)
The communication unit 320 communicates with the owner terminal 21 and the guest terminal 22 via the communication network 12. For example, the communication unit 320 receives a guest registration request from the owner terminal 21, receives an Ekey issuance request from the guest terminal 22, and transmits the Ekey generated by the key information generation unit 340 to the guest terminal 22.

(Management information storage unit)
The management information storage unit 330 stores information regarding the owner, the guest, and the lock device 10. Hereinafter, the information stored in the management information storage unit 330 will be specifically described with reference to FIGS. 5 and 6.

  5 and 6 are explanatory diagrams showing specific examples of information stored in the management information storage unit 330. FIG. As shown in FIG. 5, in the management information storage unit 330, information on the lock device 10, owner account information, and information on the owner terminal 21 are associated with each other.

  The information of the lock device 10 includes a lock ID that is identification information of the lock device 10 and a security code of the lock device 10. The security code is an example of shared information shared between the management server 30 and the lock device 10.

  The owner's account information includes an account ID and the owner's email address. The information of the owner terminal 21 includes a device ID that is identification information of the owner terminal 21, an owner account ID, and the public key of the owner terminal 21.

  The association between the lock device 10 information and the owner account information and the association between the owner account information and the owner terminal 21 can be realized by an operation by the owner. For example, when a security code is assigned when the lock device 10 is manufactured, the management information storage unit 330 stores the assigned security code and information bundled with the lock device 10 in association with the lock ID. Thereafter, the owner who has purchased the lock device 10 creates his / her account, and transmits the lock ID of the lock device 10 and the information included in the lock device 10 to the management server 30, whereby the owner's account information is obtained. And the information of the lock device 10 may be associated with each other.

  As shown in FIG. 6, in the management information storage unit 330, guest account information and guest terminal 22 information are also associated. The guest account information includes an account ID and a guest email address. The information of the guest terminal 22 includes a device ID that is identification information of the guest terminal 22, a guest account ID, and a public key of the guest terminal 22. The association between the guest account information and the guest terminal 22 information can be realized by an operation by the guest. As shown in FIG. 6, the guest can associate a plurality of guest terminals 22 with the same account. Similarly, a plurality of owner terminals 21 can be associated with the owner account information described with reference to FIG.

(Key information generator)
The key information generation unit 340 registers a guest based on a request from the owner. Specifically, when the guest information request including the account ID of the guest to which the Ekey is issued and the lock ID of the lock device 10 is received, the key information generation unit 340 receives the specified guest based on the request. The management information storage unit 330 associates the account ID with the designated lock ID. Then, the key information generation unit 340 obtains the public key of the guest terminal 22 associated with the guest account ID and the lock ID associated with the guest account ID based on the Ekey issuance request from the guest. An Ekey is generated using the security code of the lock device 10 having the key. For example, the key information generation unit 340 generates a message authentication code of the key part including the public key of the guest terminal 22 and other information such as an expiration date by using a security code, and performs message authentication of the key part and the key part. An Ekey consisting of a code is generated.

<3. Guest terminal and lock device configuration>
The configuration of the management server 30 has been described above with reference to FIG. Next, the configuration of the guest terminal 22 and the lock device 10 will be described with reference to FIG.

(Guest device)
As shown in FIG. 7, the guest terminal 22 includes a communication unit 220, an operation unit 230, a storage unit 240, and a response generation unit 250.

  The communication unit 220 has a function of communicating with the management server 30 and a function of communicating with the lock device 10. For example, the communication unit 220 functions as a reception unit that receives an Ekey from the management server 30 and a transmission unit that transmits an unlock request or a lock request to the lock device 10 using the Ekey.

  The operation unit 230 is configured for a guest to input information and instructions to the guest terminal 22. For example, the guest performs operations for registering the guest account information in the management server 30, associating the guest account information with the information of the guest terminal 22, sending an unlock request or a lock request, etc. to the operation unit 230. Do it.

  The storage unit 240 stores information for the operation of the guest terminal 22. Specifically, the storage unit 240 stores the secret key of the guest terminal 22 and the Ekey received from the management server 30 by the communication unit 220.

  The response generation unit 250 generates response information to a random number that the lock device 10 transmits based on reception of the unlock request or the lock request. For example, the response generation unit 250 may generate the response information by signing the random number received from the lock device 10 and the random number generated by the response generation unit 250 with the private key of the guest terminal 22.

(Lock device)
As illustrated in FIG. 7, the lock device 10 includes a communication unit 120, a security code storage unit 130, a verification unit 140, a random number generation unit 150, and a process execution unit 160.

  The communication unit 120 has a function of communicating with the guest terminal 22. For example, the communication unit 120 functions as a reception unit that receives an unlock request or a lock request from the guest terminal 22 and a transmission unit that transmits the random number generated by the random number generation unit 150 to the guest terminal 22.

  The security code storage unit 130 stores a security code shared with the management server 30. The security code is stored in the security code storage unit 130 when the lock device 10 is manufactured.

  The verification unit 140 verifies the validity of the Ekey received from the guest terminal 22 together with the unlock request or the lock request. Specifically, the verification unit 140 verifies Ekey with a security code. If the verification is successful, the verification unit 140 instructs the random number generation unit 150 to generate a random number. When the response information generated using the random number is received from the guest terminal 22, the verification unit 140 generates the public key extracted from Ekey, the random number generated by the random number generation unit 150, and the guest terminal 22. The response information is verified using the random number (included in the response information), that is, whether or not the guest terminal 22 is a valid issuer of Ekey. Note that the response information is generated using the random number generated in the guest terminal 22 in addition to the random number generated by the lock device 10, so that the impersonation of the lock device 10 can be dealt with.

  The random number generation unit 150 generates a random number based on an instruction from the verification unit 140. The random number generated by the random number generation unit 150 is transmitted to the guest terminal 22 via the communication unit 120.

  When the verification of the Ekey and the verification of the response information by the verification unit 140 are successful, the process execution unit 160 executes the process requested by the guest terminal 22. For example, when the process requested from the guest terminal 22 is unlocking, the process execution unit 160 may drive an actuator such as a motor to rotate the thumb turn of the door in the unlocking direction.

<4. Operation>
The configuration of the information processing system according to the embodiment of the present invention has been described above. Subsequently, with reference to FIG. 8 and FIG. 9, the operation of the information processing system according to the embodiment of the present invention is organized.

  FIG. 8 is an explanatory diagram showing the flow of Ekey issuance. First, the owner terminal 21 transmits a guest registration request to the management server 30 (S404). At this time, the owner terminal 21 specifies the guest account ID and the lock ID of the lock device 10 in the guest registration request.

  Based on the guest registration request from the owner terminal 21, the management server 30 associates the designated guest account ID and the designated lock ID in the management information storage unit 330 (S408). If the designated lock ID is not associated with the account information of the owner who uses the owner terminal 21, the management server 30 rejects the guest registration request from the owner terminal 21.

  Thereafter, the management server 30 notifies the guest terminal 22 of the completion of guest registration (S412), and the guest terminal 22 accesses the management server 30 based on the notification (S416). Then, the management server 30 generates an Ekey using the security code of the lock device 10 having the designated lock ID and the public key of the guest terminal 22 (S420).

  The guest terminal 22 downloads the Ekey generated by the management server 30 (S424), and stores the Ekey in the storage unit 240 (S428).

  FIG. 9 is an explanatory diagram showing a flow of unlocking using Ekey. As shown in FIG. 9, for example, when the guest terminal 22 transmits Ekey to the lock device 10 together with the unlock request based on an operation by the guest (S504), the lock device 10 verifies Ekey (S508). Specifically, the verification unit 140 of the lock device 10 verifies Ekey with a security code, that is, verifies whether generation of Ekey is performed by the management server 30 having a valid authority. Here, when the verification fails (S512 / no), the unlock request is rejected, and the process ends in error.

  On the other hand, when the verification of Ekey is successful, the lock device 10 generates a random number (S516), and transmits the generated random number to the guest terminal 22 (S520).

  When the guest terminal 22 receives the random number, the response generation unit 250 also generates a random number, and signs the received random number and the random number generated by the response generation unit 250 using the private key of the guest terminal 22 to generate response information Then, the response information is transmitted to the lock device 10 (S528).

  Subsequently, the lock device 10 verifies the response information (S532). Specifically, the verification unit 140 of the lock device 10 includes the random number generated by the random number generation unit 150, the random number generated in the guest terminal 22 (included in the response information), and the guest terminal 22 extracted from Ekey. The response information is verified using the public key.

  If verification of the validity of the response information fails (S536 / no), the unlock request is rejected, and the process ends in error. If verification of the validity of the response information is successful (S536 / yes), the process execution unit 160 unlocks the door and the process ends (S540).

<5. Effect>
According to the present embodiment described above, a remarkable effect not found in other systems can be obtained. For example, in the present embodiment, the lock device 10 can be locked and unlocked without the process of registering the public key of the owner terminal 21 in the lock device. For this reason, in this embodiment, since the owner who has the owner terminal 21 does not need to go near the lock device 10 for registration of a public key, it is possible to reduce an owner's effort.

  In the present embodiment, Ekey is generated without using the secret key of the owner terminal 21. For this reason, it is not essential for the owner terminal 21 to have a secret key. Furthermore, since the Ekey can be generated not by the owner terminal 21 but by the management server 30, it is possible to reduce the load on the owner side regarding the issue of Ekey. In addition, the management server 30 can generate the Ekey so that central management of the Ekey by the management server 30 can be realized.

<6. Application example>
Next, application examples of the present invention will be described. The application example can realize remote operation of the lock device 10 by the owner.

(Constitution)
FIG. 10 is an explanatory diagram illustrating a configuration of an information processing system according to an application example. As illustrated in FIG. 10, the information processing system according to the application example includes a lock device 10, an owner terminal 21, a management server 30, and a home hub 40.

  The management information storage unit 330 of the management server 30 according to the application example stores information regarding the owner, the lock device 10 and the home hub 40. Specifically, as shown in FIG. 11, in the management information storage unit 330, the lock device 10 information, the owner account information, and the home hub 40 information are associated with each other. The information of the home hub 40 includes a hub ID that is identification information of the home hub 40 and a public key (hub public key) of the home hub 40. The association of information regarding the owner, the lock device 10, and the home hub 40 can be realized by an operation by the owner.

  The key information generation unit 340 of the management server 30 according to the application example generates Ekey based on a request from the owner. Specifically, the owner terminal 21 transmits a request to unlock the lock device 10 to the management server 30 by designating the lock ID of the lock device 10. The key information generation unit 340 extracts the information of the home hub 40 associated with the lock ID, and uses the public key of the home hub 40 and the security code of the lock device 10 having the specified lock ID to generate an Ekey. Generate.

  For example, the key information generation unit 340 generates a message authentication code of a key part including other information such as a public key of the home hub 40 and an expiration date by using a security code, and performs message authentication of the key part and the key part. An Ekey consisting of a code is generated. The Ekey generated by the key information generation unit 340 is transmitted from the communication unit 320 to the home hub 40.

  The home hub 40 is an example of a communication terminal installed in a house where the lock device 10 is provided. The in-home hub 40 receives Ekey from the management server 30 based on the unlocking request or locking request from the owner terminal 21, and performs unlocking or locking of the lock device 10 using the Ekey. The home hub 40 may be connected to a commercial power source, for example.

  FIG. 12 is an explanatory diagram showing the configuration of the home hub 40. As shown in FIG. 12, the home hub 40 includes a communication unit 420, a storage unit 440, and a response generation unit 450.

  The communication unit 420 has a function of communicating with the management server 30 and a function of communicating with the lock device 10. For example, the communication unit 420 functions as a reception unit that receives an Ekey from the management server 30 and a transmission unit that transmits an unlock request or a lock request to the lock device 10 using the Ekey. Note that communication between the communication unit 420 and the lock device 10 may be realized by a short-range wireless communication function such as BLE, Bluetooth (registered trademark), wireless LAN, or NFC, for example.

  The storage unit 440 stores information for the operation of the home hub 40. Specifically, the storage unit 440 stores the private key of the home hub 40 and the Ekey received from the management server 30 by the communication unit 420.

  The response generation unit 450 generates response information to a random number that the lock device 10 transmits based on reception of the unlock request or the lock request. For example, the response generation unit 450 may generate the response information by signing the random number received from the lock device 10 and the random number generated by the response generation unit 450 with the private key of the home hub 40.

  The lock device 10 in the application example has substantially the same configuration as that described with reference to FIG. 7, and is unlocked based on communication with the home hub 40 instead of communication with the guest terminal 22. Perform locking.

(Operation)
The configuration of the application example of the present invention has been described above. Next, the operation of the application example of the present invention will be described with reference to FIG.

  FIG. 13 is an explanatory diagram illustrating the operation of the application example. As shown in FIG. 13, the owner terminal 21 designates the lock ID of the lock device 10 and transmits an unlock request for the lock device 10 to the management server 30 (S610). The key information generation unit 340 of the management server 30 extracts information on the home hub 40 associated with the lock ID specified in the unlocking request, and the lock having the public key of the home hub 40 and the specified lock ID. An Ekey is generated using the security code of the device 10 (S620).

  Then, the communication unit 320 of the management server 30 transmits Ekey to the home hub 40 (S630), and the home hub 40 stores the Ekey (S640). Thereafter, the home hub 40 performs substantially the same operation as the guest terminal 22 described with reference to FIG. 9 using the Ekey. Thereby, the lock device 10 unlocks the door.

  In addition, when the expiration date is set to Ekey, the lock device 10 also verifies whether or not the expiration date of Ekey has passed, and when the expiration date has passed, rejects the unlocking request. May be. Here, the expiration date set to Ekey by the key information generation unit 340 of the management server 30 is managed by the length of time that is expected to be taken from generation of Ekey to reception of Ekey by the lock device 10, and by each device. Considering the time lag, it may be set to about 10 minutes, for example. According to such a configuration, since the expiration date of Ekey is limited, it is possible to suppress security risks such as eavesdropping and replay attacks.

(effect)
As described above, according to the application example of the present invention, even if the owner terminal 21 is not within the range in which short-range wireless communication with the lock device 10 is possible, the unlocking and unlocking of the lock device 10 can be performed via the home hub 40. It is possible to remotely control the lock. For this reason, when the parent having the owner terminal 21 unlocks the lock device 10 from a remote place when the child comes home, the owner of the real estate having the owner terminal 21 receives the lock device 10 when the guest of the private residence arrives. Can be unlocked from a remote location.

<7. Hardware configuration>
The embodiments and application examples of the present invention have been described above. Information processing such as communication related to Ekey and generation of response information described above is realized by cooperation of software and hardware of the communication terminal 20 described below.

  FIG. 14 is an explanatory diagram showing a hardware configuration of the communication terminal 20. As shown in FIG. 14, the communication terminal 20 includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, an input device 208, an output device 210, A storage device 211, a drive 212, an imaging device 213, and a communication device 215 are provided.

  The CPU 201 functions as an arithmetic processing device and a control device, and controls the overall operation in the communication terminal 20 according to various programs. Further, the CPU 201 may be a microprocessor. The ROM 202 stores programs used by the CPU 201, calculation parameters, and the like. The RAM 203 temporarily stores programs used in the execution of the CPU 201, parameters that change as appropriate during the execution, and the like. These are connected to each other by a host bus including a CPU bus. For example, the function of the response generation unit 250 of the guest terminal 22 described with reference to FIG. 7 is realized by the cooperation of the CPU 201, the ROM 202, the RAM 203, and the software.

  The input device 208 includes input means for a user to input information, such as a mouse, keyboard, touch panel, button, microphone, switch, and lever, and an input control circuit that generates an input signal based on the input by the user and outputs the input signal to the CPU 201. Etc. The user of the communication terminal 20 can input various data and instruct processing operations to the communication terminal 20 by operating the input device 208.

  The output device 210 includes a display device such as a liquid crystal display (LCD) device, an OLED (Organic Light Emitting Diode) device, and a lamp. Furthermore, the output device 210 includes an audio output device such as a speaker and headphones. For example, the display device displays a captured image or a generated image. On the other hand, the audio output device converts audio data or the like into audio and outputs it.

  The storage device 211 is a data storage device configured as an example of a storage unit of the communication terminal 20 according to the present embodiment. The storage device 211 may include a storage medium, a recording device that records data on the storage medium, a reading device that reads data from the storage medium, a deletion device that deletes data recorded on the storage medium, and the like. The storage device 211 stores programs executed by the CPU 201 and various data.

  The drive 212 is a storage medium reader / writer, and is built in or externally attached to the communication terminal 20. The drive 212 reads information recorded on a removable storage medium 24 such as a mounted magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, and outputs it to the RAM 203. The drive 212 can also write information to the removable storage medium 24.

  The imaging device 213 includes an imaging optical system such as a photographing lens and a zoom lens that collects light, and a signal conversion element such as a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor). The imaging optical system collects light emitted from the subject and forms a subject image in the signal conversion unit, and the signal conversion element converts the formed subject image into an electrical image signal.

  The communication device 215 is a communication interface configured with, for example, a communication device for connecting to the communication network 12. The communication device 215 may include a short-range wireless communication device, an LTE (Long Term Evolution) compatible communication device, or a wire communication device that performs wired communication.

<8. Conclusion>
As described above, according to the embodiment of the present invention, the lock device 10 can be locked and unlocked without the process of registering the public key of the owner terminal 21 in the lock device. For this reason, in this embodiment, since the owner who has the owner terminal 21 does not need to go near the lock device 10 for registration of a public key, it is possible to reduce an owner's effort.

  In the present embodiment, Ekey is generated without using the secret key of the owner terminal 21. For this reason, it is not essential for the owner terminal 21 to have a secret key. Furthermore, since the Ekey can be generated not by the owner terminal 21 but by the management server 30, it is possible to reduce the load on the owner side regarding the issue of Ekey. In addition, the management server 30 can generate the Ekey so that central management of the Ekey by the management server 30 can be realized.

  Although the preferred embodiments of the present invention have been described in detail with reference to the accompanying drawings, the present invention is not limited to such examples. It is obvious that a person having ordinary knowledge in the technical field to which the present invention pertains can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that these also belong to the technical scope of the present invention.

  For example, in the above embodiment, an example in which the security code is stored in the management server 30 as shared information has been described, but the shared information may be a hash value of the security code. According to this configuration, it is possible to reduce the risk when shared information is leaked.

  Further, each step in the processing of the information processing system of the present specification does not necessarily have to be processed in time series in the order described as a sequence diagram. For example, each step in the processing of the information processing system may be processed in an order different from the order described as the sequence diagram or may be processed in parallel.

  In addition, hardware such as CPU, ROM, and RAM built in the lock device 10, the communication terminal 20, and the management server 30 exhibits the same functions as the configurations of the lock device 10, the communication terminal 20, and the management server 30 described above. It is also possible to create a computer program for this purpose.

10 lock device 20 communication terminal 21 owner terminal 22 guest terminal 30 management server 40 residential hub 120 communication unit 130 security code storage unit 140 verification unit 150 random number generation unit 160 processing execution unit 220 communication unit 230 operation unit 240 storage unit 250 response generation unit 320 Communication Unit 330 Management Information Storage Unit 340 Key Information Generation Unit 420 Communication Unit 440 Storage Unit 450 Response Generation Unit

Claims (6)

An information processing system comprising a communication device, a verification device, and a key information generation device,
The key information generation device includes:
A key information generating unit that generates key information using a public key of the communication device and shared information shared with the verification device;
The communication device
A receiving unit for receiving the key information generated by the key information generating unit;
A transmitter that transmits the key information received by the receiver to the verification device;
With
The verification device includes:
A verification unit that verifies the key information received from the communication device based on the shared information shared with the key information generation device;
An information processing system comprising: The receiving unit receives a random number from the verification device after the verification of the key information by the verification unit is successful,
The communication device further includes a response generation unit that generates response information using the random number and a secret key of the communication device,
The said verification part verifies the said response information using the response information received from the said communication apparatus, and the public key of the said communication apparatus extracted from the said key information, The said response information is characterized by the above-mentioned. Information processing system.   The information processing apparatus according to claim 1, wherein the verification apparatus further includes a process execution unit that executes a process requested by the communication apparatus based on a successful verification by the verification unit. system.   The information processing system according to claim 3, wherein the processing execution unit executes locking or unlocking of a door. A communication device that communicates with a key information generation device and a verification device,
A receiving unit that receives, from the key information generation device, public information of the communication device and key information generated using shared information shared by the key information generation device and the verification device;
A transmitter that transmits the key information received by the receiver to the verification device;
A communication apparatus comprising: Computer
A communication device that communicates with a key information generation device and a verification device,
A receiving unit that receives, from the key information generation device, public information of the communication device and key information generated using shared information shared by the key information generation device and the verification device;
A transmitter that transmits the key information received by the receiver to the verification device;
A program for causing a communication apparatus to function as the communication apparatus.

Images