JP2019149758A - Communication device, management server, security system, control method, and program - Google Patents

Abstract

To reduce hardware costs while maintaining security.SOLUTION: A communication device according to the present invention includes a subscriber authentication module that is detachably attached to the own device and in which predetermined identification information is recorded, a password setting portion that determines whether a password for protecting the reading of identification information is set in the subscriber authentication module, at startup, and if the password is not set, sets a first password for the subscriber authentication module, and a storage unit that stores the first password.SELECTED DRAWING: Figure 1

Description

  The present disclosure relates to a communication device, a management server, a security system, a control method, and a program, and more particularly, to a communication device, a management server, a security system, a control method, and a program for protecting a subscriber authentication module.

  Many communication devices that require a SIM (Subscriber Identity Module) card have a function of setting a PIN (Personal Identification Number) code to protect the SIM card from being used by others. Here, setting the PIN code means setting a password in a subscriber authentication module such as a SIM card. That is, a password such as a PIN code is a password set to protect reading of identification information recorded in the subscriber authentication module.

  However, since many users do not perform this setting, when the communication device is stolen, there is a risk that the SIM card may be removed and misused by other devices. An example of a technique for solving this is disclosed in, for example, Patent Document 1.

  Patent Document 1 adds a circuit for monitoring the opening and closing of a cover (battery cover, etc.) that protects the SIM card. When the cover is opened, the password registered in the device in advance is set in the SIM card as a PIN. A technique for adding the function to be disclosed is disclosed.

Japanese Patent Laid-Open No. 2006-48882

  However, Patent Document 1 requires a special structure and circuit for monitoring the opening and closing of the cover that protects the SIM card. Therefore, there is a problem that the cost is increased in terms of mechanism, and there is a restriction that only specific devices can be used.

  The present disclosure has been made to solve such problems, and provides a communication device, a management server, a security system, a control method, and a program for suppressing hardware costs while maintaining security. For the purpose.

A communication device according to the first aspect of the present disclosure is provided.
A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
Is provided.

The management server according to the second aspect of the present disclosure is:
A password for protecting the reading of the identification information for the subscriber authentication module that is detachably attached to the first communication apparatus and in which the predetermined identification information is recorded is set in the first communication apparatus. A communication unit that receives the first password that is set when it is not activated at startup and the identification information from the first communication device via a network;
A storage unit that stores the identification information and the first password in association with each other in a database;
Is provided.

A communication device according to the third aspect of the present disclosure is:
When the other communication device is activated, a password is set to protect the reading of the identification information for the subscriber authentication module that is detachably attached to the other communication device and in which the predetermined identification information is recorded. A request for transmitting a password request including the identification information to the management server having a database in which the first password set when the identification information is not stored and the identification information is stored in association with each other. And
A display control unit that receives the first password associated with the identification information from the management server and displays the first password on a screen;
Is provided.

The security system according to the fourth aspect of the present disclosure includes:
A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
A first communication device comprising:
A management server connected to the first communication device via a network;
With
The first communication device is:
The password setting unit further includes a communication unit that transmits the identification information and the first password to the management server via the network when the setting is performed using the first password.
The management server
The identification information and the first password are received from the first communication device, and the identification information and the first password are associated with each other and stored in a database.

A control method of a communication device according to the fifth aspect of the present disclosure is:
Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated And
If the setting is not made, the subscriber authentication module performs the setting with a first password,
The first password is stored in a storage unit.

The program according to the sixth aspect of the present disclosure is:
Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated A process of determining
A process of performing the setting by a first password in the subscriber authentication module when the setting is not performed;
A process of storing the first password in a storage unit;
Is executed on the computer.

  According to the present disclosure, it is possible to provide a communication device, a management server, a security system, a control method, and a program for reducing hardware costs while maintaining security.

1 is a block diagram showing a configuration of a communication apparatus according to a first embodiment. 3 is a flowchart showing a flow of control processing of the communication apparatus according to the first embodiment. It is a block diagram which shows the structure of the communication apparatus concerning this Embodiment 2. 10 is a flowchart showing a flow of control processing of the communication apparatus according to the second embodiment. 10 is a flowchart showing a flow of control processing of the communication apparatus according to the second embodiment. 10 is a flowchart showing a flow of control processing of the communication apparatus according to the second embodiment. It is a block diagram which shows the whole structure of the security system concerning this Embodiment 3. It is a sequence diagram which shows the flow of the password registration process of the subscriber authentication module concerning this Embodiment 3. It is a block diagram which shows the whole structure of the security system concerning this Embodiment 4. It is a sequence diagram which shows the flow of the password acquisition process of the subscriber authentication module concerning this Embodiment 4. It is a block diagram which shows the whole structure of the security system concerning this Embodiment 5. It is a sequence diagram which shows the flow of the password update process of the subscriber authentication module concerning this Embodiment 5.

  Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are denoted by the same reference numerals, and redundant description is omitted as necessary for clarification of the description.

<Embodiment 1>
FIG. 1 is a block diagram illustrating a configuration of the communication device 1 according to the first embodiment. The communication device 1 is a communication terminal for performing wireless communication with another communication device (not shown) via a network (not shown). The communication device 1 includes a subscriber authentication module 11, a password setting unit 12, and a storage unit 13.

  The subscriber authentication module 11 is detachably attached to the communication device 1 that is its own device. The subscriber authentication module 11 is a small contact IC (Integrated Circuit) card that also serves as an information storage medium, and predetermined identification information 111 is recorded thereon. The subscriber authentication module 11 is, for example, a SIM (Subscriber Identity Module) card, a UIM (User Identity Module) card, a USIM (Universal Subscriber Identity Module) card, or the like, but is not limited thereto. Here, the identification information 111 is, for example, a subscriber identification code (IMSI: International Mobile Subscriber Identity), ICCID (IC Card ID), mobile phone number (MSISDN (Mobile Subscriber Integrated Service Digital Network Number)), etc. It is not limited to these.

  In the subscriber authentication module 11, a password for protecting the reading of the identification information 111 can be set. When a password is set in the subscriber authentication module 11, the subscriber authentication module 11 can suppress reading of the identification information 111 from a control circuit or the like in the communication device 1 when the communication device 1 is activated. Specifically, when a password is set in the subscriber authentication module 11, the communication device 1 requests the user to input a password at the time of activation. When the input password matches the set password, the subscriber authentication module 11 cancels the protection setting of the identification information 111. Therefore, the communication device 1 can read the identification information 111 from the subscriber authentication module 11. Thereby, the communication apparatus 1 can communicate with the outside using the identification information 111 in the subsequent communication processing.

  The password setting unit 12 determines whether or not a password for protecting the reading of the identification information 111 is set in the subscriber authentication module 11 when the communication apparatus 1 is activated. Then, the password setting unit 12 performs the setting with the first password 131 in the subscriber authentication module 11 when the setting is not performed in the subscriber authentication module 11. Thereby, reading of the identification information 111 from the subscriber authentication module 11 is protected. Here, the password setting part 12 is implement | achieved when the control circuit etc. of the communication apparatus 1 read and run a program. The storage unit 13 is a storage device that stores the first password 131.

  FIG. 2 is a flowchart showing a flow of control processing of the communication apparatus 1 according to the first embodiment. First, the communication device 1 is activated when the power is turned on (S11). Next, the password setting unit 12 determines whether or not a password for protecting reading of the identification information 111 from the subscriber authentication module 11 is set (S12). If it is determined that the password has been set, the communication device 1 displays a password input request for the user on the screen, and if the input password matches the set password, the communication device 1 in the subscriber authentication module 11 The identification information 111 can be accessed. Thereafter, the communication device 1 reads the identification information 111 from the subscriber authentication module 11, and performs normal processing using the read identification information 111.

  On the other hand, if it is determined in step S12 that no password is set in the subscriber authentication module 11, the password setting unit 12 sets the first password 131 in the subscriber authentication module 11 (S13). In addition, the password setting unit 12 stores the first password 131 used for setting in the storage unit 13 (S14). Here, the first password 131 may be stored in advance in the storage unit 13. Alternatively, the password setting unit 12 may generate the first password 131 by a predetermined method in step S13 and use the generated first password 131 for setting.

  As described above, in this embodiment, when the password is not set in the subscriber authentication module 11 when the communication apparatus 1 is activated, the password is automatically set to protect the reading of the identification information 111. It is. Therefore, the protection of the identification information 111 can be realized without the user performing a password setting operation on the subscriber authentication module 11. Note that since the first password 131 is stored in the storage unit 13, the communication apparatus 1 can cancel the protection setting of the subscriber authentication module 11 as necessary without user operation. .

  In the present embodiment, the password setting unit 12 determines whether or not the password is set in the subscriber authentication module 11. The password setting unit 12 is realized by a general-purpose control circuit and a program as described above. Therefore, in the present embodiment, a dedicated circuit configuration for detecting opening / closing of the protective cover as in Patent Document 1 is not required.

  From the above, according to the present embodiment, it is possible to suppress hardware costs while maintaining security. Therefore, when the communication device 1 is stolen, the subscriber authentication module 11 is used by another device, so that the user can be prevented from being charged illegally.

<Embodiment 2>
The second embodiment is an example of the first embodiment described above. In the first embodiment, at the time of activation, the password setting unit automatically sets a password for a subscriber authentication module for which no password has been set, so that reading of identification information from the subscriber authentication module can be protected. That is, by setting the password itself in the subscriber authentication module, the protection setting for reading the identification information from the subscriber authentication module is also performed. Here, it is necessary for the communication device to read identification information (for example, IMSI) from the subscriber authentication module and add the read identification information to the transmission data and transmit it to the network during the communication process of the external communication device. is there. For this reason, it is necessary to cancel the protection by the password automatically set in the subscriber authentication module.

  Therefore, the password setting unit according to the present exemplary embodiment stores the first password stored in the storage unit at least before the start of the communication process after setting the first authentication password for the subscriber authentication module at the time of activation. The protection of the subscriber authentication module is canceled with the password. As a result, the protection setting for reading the identification information using the password can be automatically canceled without any user operation for the subscriber authentication module automatically set with the password according to the first embodiment. Processing can be performed. As an example, the password setting unit according to the present embodiment cancels the protection of the subscriber authentication module with the first password stored in the storage unit at the start of communication processing. Then, the password setting unit performs the protection with the first password again on the subscriber authentication module after the end of the communication process. As a result, it is possible to automatically release protection and reset protection before and after the communication process for the subscriber authentication module for which the password is automatically set according to the first embodiment. Therefore, it is possible to maintain security while reducing the trouble of the user canceling the protection setting such as password input.

  The storage unit stores the first random number in advance. The password setting unit reads the identification information from the subscriber authentication module when the setting is not performed in the subscriber authentication module. The password setting unit calculates the first password using the identification information and the first random number stored in the storage unit. Thereafter, the password setting unit performs the setting with the first password, and stores the first password in the storage unit. As a result, it is possible to protect appropriately using a password that is difficult to guess compared to a fixed password.

  FIG. 3 is a block diagram illustrating a configuration of the communication apparatus 100 according to the second embodiment. The communication device 100 is a communication terminal such as a mobile phone or a smartphone. The SIM card 170 is an example of the above-described subscriber authentication module 11 and records identification information such as IMSI, ICCID, and telephone number. The SIM card 170 can set a PIN code as a password for protecting reading of IMSI and the like. The PIN code is, for example, a four-digit number, but is not limited to this. The protection setting for suppressing the reading of the identification information on the SIM card 170 by the PIN code may hereinafter be referred to as PIN lock.

  The communication device 100 includes a battery 110, a power supply circuit 120, a CPU (Central Processing Unit) 130, a radio circuit 140, a SIM connector 150, and a memory 160. The power supply circuit 120 supplies power from the battery 110 to the CPU 130, the memory 160, and the like. The CPU 130 is a control circuit for controlling operations of various circuits in the communication apparatus 100 including the wireless circuit 140 and the SIM connector 150. The radio circuit 140 performs radio communication with a base station (not shown) or the like. The SIM connector 150 is a connection part for mounting the SIM card 170. The memory 160 is an example of the storage unit 13 described above, and is a storage device that stores a random number 161 and a PIN code 162. Note that the memory 160 further stores an operating system (OS) and a computer program in which the control processing of the communication apparatus according to the present embodiment is implemented as a configuration (not shown). Further, the CPU 130 reads out the OS and the program from the memory 160 and executes them. Thereby, CPU130 implement | achieves the control processing of the communication apparatus concerning this Embodiment including the password setting part 12 mentioned above.

  4, 5, and 6 are flowcharts illustrating a flow of control processing of the communication apparatus 100 according to the second embodiment. First, it is assumed that the SIM card 170 is already installed in the communication device 100.

  The communication device 100 is powered on (S101) and starts up. Then, the CPU 130 determines whether or not a PIN code is set in the SIM card 170 via the SIM connector 150, that is, whether or not the PIN lock is set (S102). When determining that the PIN lock has not been established, the CPU 130 reads the telephone number from the SIM card 170 via the SIM connector 150 and reads the random number 161 from the memory 160 (S103). Then, the CPU 130 calculates a PIN code using the telephone number and the random number 161 (S104). The CPU 130 may calculate the PIN code using IMSI or ICCID instead of the telephone number. That is, the CPU 130 generates a password for protecting reading of the identification information from the subscriber authentication module using at least the identification information recorded in the subscriber authentication module. Thereafter, the CPU 130 writes the PIN code to the SIM card 170 and performs PIN lock setting (S105). In addition, the CPU 130 stores the calculated PIN code 162 in the memory 160 (S106).

  Thereafter, (going to FIG. 5), the communication apparatus 100 starts normal operation (S107). That is, the communication device 100 performs processing according to user operations and various background processing. Among them, the communication device 100 starts communication processing with the outside (S108). Examples of the communication process include a communication process for establishing communication with a wireless communication network including a base station and the like at the time of activation, a telephone call, and data communication. In this case, access from the CPU 130 to the SIM card 170 is required. In step S105 described above, a PIN lock is set on the SIM card 170.

  Therefore, the CPU 130 reads the PIN code 162 from the memory 160 and tries to release the PIN lock of the SIM card 170 using the PIN code 162 (S109). For example, the CPU 130 inputs the PIN code 162 to the SIM card 170 via the SIM connector 150. As a result, the SIM card 170 collates the input PIN code 162 with the set PIN code. When the PIN code matches by the verification, the SIM card 170 releases the PIN lock.

  Then, the CPU 130 determines whether or not the PIN lock of the SIM card 170 has been released (S110). When the PIN lock is released, the CPU 130 reads IMSI, ICCID, and the like from the SIM card 170, and executes communication processing using these. And the communication apparatus 100 complete | finishes a communication process (S111). Thereafter, the CPU 130 reads the PIN code 162 from the memory 160, and again sets the PIN lock of the SIM card 170 by the PIN code 162 (S112). Then, as long as the communication apparatus 100 is not turned off (NO in S113), the processes from Step S107 to S113 are repeated. However, if the PIN lock is not released in step S110, the communication apparatus 100 displays an error display on the screen (not shown) indicating that the PIN lock could not be released due to the failure of PIN code verification (S114). ). Then, the process ends.

  A case where it is determined in step S102 that a PIN code is set in the SIM card 170 will be described with reference to FIG. As an example of this case, there is a case where the PIN code 162 is set in the SIM card 170 and the PIN code 162 is stored in the memory 160 by step S105 by at least the time when the communication apparatus 100 is activated immediately before. In this state, the communication apparatus 100 is turned off last time. As another example, there is a case where the user has set a PIN code using an existing function while the communication apparatus 100 has been activated up to the previous time.

  Therefore, the CPU 130 attempts to release the PIN lock of the SIM card 170 using the PIN code 162 stored in the memory 160 (S115). Then, the CPU 130 determines whether or not the PIN lock of the SIM card 170 has been released (S116). When the PIN lock is released, the CPU 130 reads IMSI, ICCID, and the like from the SIM card 170 and executes communication processing at the time of activation using these (S117). Then, after the communication processing at the time of activation, the CPU 130 reads the PIN code 162 from the memory 160, and sets the PIN lock of the SIM card 170 again by the PIN code 162 (S118). Thereafter, the process proceeds to step S107.

  On the other hand, when it is determined in step S116 that the PIN lock is not released, the following cases can be cited. For example, there is a case where the SIM card 170 is attached to the communication apparatus 100 after some PIN code has been set in the SIM card 170 in another communication apparatus. In this case, since the PIN code 162 is not stored in the memory 160, the PIN lock is not released. Alternatively, there is a case where the communication apparatus 100 once sets the PIN code 162 in the SIM card 170 and then the user sets the PIN code before the power is turned off last time. In this case, since the PIN code 162 stored in the memory 160 is different from the PIN code set in the SIM card 170, the verification fails and the PIN lock is not released.

  If it is determined in step S116 that the PIN lock is not released, the communication apparatus 100 displays on the screen a request to input the PIN code. The user manually inputs the PIN code according to the screen display. Then, the CPU 130 attempts to release the PIN lock using the PIN code input by the user (S119). Then, the CPU 130 determines whether or not the PIN lock of the SIM card 170 has been released (S120). When the PIN lock is released, the CPU 130 reads IMSI, ICCID, and the like from the SIM card 170, and executes communication processing at startup using these (S121). Then, the communication device 100 starts normal operation (S122). Then, step S122 is repeated unless the communication device 100 is powered off (NO in S123). However, if the PIN lock is not released by the PIN code entered by the user in step S120, the communication device 100 fails to verify the PIN code on the screen and displays an error display indicating that the PIN lock could not be released. Perform (S124). Then, the process ends.

  As described above, the password setting unit according to the present embodiment can maintain security while reducing the time and effort required to cancel the password setting by the user. Furthermore, when a password is not set in the subscriber authentication module, a password is generated using identification information such as a telephone number and a random number each time, so that the password can be protected with higher security.

  In the case of Patent Document 1 described above, when the SIM card is taken out by breaking other parts without opening and closing the SIM card cover, the PIN lock may not be applied. However, in this embodiment, the password is automatically set in the subscriber authentication module at the time of startup, and the protection setting for reading the identification information from the subscriber authentication module is temporarily canceled before and after the communication processing and reset. I do. Therefore, security can be further increased.

  As described above, in the first embodiment, the PIN code is automatically locked by setting the automatically generated PIN code in the SIM card. Therefore, in the second embodiment, the PIN may be released at least once after the PIN lock is automatically applied and before the start of the communication process. Specifically, processing corresponding to step S109 can be performed after step S105. In this case, steps SS109, S110, S112 and S114, and S118 can be omitted.

<Embodiment 3>
The third embodiment is an application example of the first or second embodiment described above. That is, the password set in the subscriber authentication module is held in an external management server. The management server according to the third embodiment includes a communication unit and a storage unit. The communication unit receives the first password set for the subscriber authentication module in the first embodiment and the identification information recorded in the subscriber authentication module from the communication device via the network. The storage unit stores the identification information and the first password in association with each other in the database. The communication apparatus according to the first or second embodiment further includes a communication unit that transmits the identification information recorded in the subscriber authentication module and the first password to the management server via the network. Here, the communication unit transmits the identification information and the first password in association with each other when the password setting unit performs the setting with the first password. . As a result, even if the PIN lock cannot be released due to an unexpected situation, the PIN lock can be appropriately released using a PIN code appropriately managed externally.

  FIG. 7 is a block diagram showing the overall configuration of the security system 2000 according to the third embodiment. The security system 2000 is an information system for protecting reading of various types of identification information recorded on a SIM card that is an example of a subscriber authentication module. The security system 2000 includes a communication device 100a and a PIN code management server 200. The communication device 100a and the PIN code management server 200 are connected by a network N. The network N is a communication network such as the Internet.

  The communication device 100a is obtained by improving the configuration of the communication device 1 or the communication device 100a described above, and includes a communication unit 180. For this reason, the communication device 100a includes the password setting unit 12 and the storage unit 13 described above as a configuration (not shown). The communication device 100a is detachably mounted with a SIM card 170, which is an example of the subscriber authentication module 11. When the password setting unit 12 performs the setting with the first password (PIN code), the communication unit 180 transmits the identification information and the first password to the PIN code management server 200 via the network N. Here, the communication unit 180 adds the identification information and the first password to the registration request for storing the identification information and the first password in association with each other in the PIN code management server 200. . Here, the identification information added to the registration request may be at least one of IMSI, ICCID, and telephone number recorded in the SIM card 170. Furthermore, as identification information added to the registration request, in addition to these, the serial number of the communication device 100a itself may be included. Alternatively, as the identification information added to the registration request, the serial number of the communication device 100a itself may be used instead of the IMSI, ICCID, and telephone number recorded in the SIM card 170. Further, the communication unit 180 may be realized using the CPU 130 and the wireless circuit 140 of FIG. 3 described above.

  The PIN code management server 200 is an example of a management server that responds to requests from various client terminals via the network N. Therefore, the PIN code management server 200 can be realized by, for example, an information processing apparatus that operates a WEB server, an application server, a DB server, or the like. The PIN code management server 200 may be configured by a plurality of information processing apparatuses.

  The PIN code management server 200 includes a communication unit 210, a storage unit 220, and a database 230. The communication unit 210 receives the identification information and the first password from the communication device 100a via the network N. Here, as described above, the identification information is information recorded on the SIM card 170, and the first password is a PIN code or the like set to protect reading of the identification information from the SIM card 170. Alternatively, as described above, in addition to or instead of the information recorded on the SIM card 170 as identification information, the serial number of the communication device 100a itself may be included. The storage unit 220 stores the identification information received by the communication unit 210 and the PIN code in the database 230 in association with each other. The database 230 manages the identification information 231 and the PIN code 232 in association with each other.

  FIG. 8 is a sequence diagram showing the flow of password registration processing of the subscriber authentication module according to the third embodiment. First, the communication device 100a is activated when the power is turned on (S201). Next, when the password is not set in the SIM card 170, the password setting unit 12 acquires identification information from the SIM card 170 (S202). Here, the identification information is, for example, IMSI, ICCID, telephone number, and the like. Moreover, the password setting part 12 produces | generates a 1st password using identification information or a random number as needed. Then, the password setting unit 12 sets a first password for the SIM card 170 (S203). In addition, the password setting unit 12 stores the first password 131 in the storage unit 13.

  Thereafter, the communication unit 180 transmits the first password and the identification information to the PIN code management server 200 via the network N (S204). Specifically, communication unit 180 transmits a registration request for storing the identification information and the first password in association with each other. At that time, the communication unit 180 includes the identification information and the first password in the registration request.

  The communication unit 210 of the PIN code management server 200 receives a registration request from the communication device 100a. Then, the storage unit 220 extracts the identification information and the first password from the received registration request. Then, the storage unit 220 stores the identification information and the first password in association with each other in the database 230 (S205).

  As described above, in this embodiment, a password such as a PIN code automatically set by the communication device 100a is stored in the external PIN code management server 200 in association with the identification information of the SIM card 170 or the communication device 100a. To do. Therefore, the administrator of the PIN code management server 200 can specify and acquire the PIN code 232 from the database 230 using the identification information 231 as a key.

<Embodiment 4>
The fourth embodiment is an application example of the third embodiment described above. As a premise, a password is set in the above-described subscriber authentication module in the first communication device, and the identification information and password of the first communication device are stored in association with each other in the database of the management server. Then, a second communication device different from the first communication device transmits a password request including the input identification information (of the first communication device) to the management server via the network. Then, the communication unit of the management server receives a password request including the identification information from the second communication device via the network N. In response, the communication unit obtains the first password associated with the identification information from the database, and transmits the obtained first password to the second communication device. Then, the display control unit of the second communication device displays the first password received from the management server on the screen. As a result, even if the first communication device is PIN-locked, a maintenance staff or the like who can legitimately obtain the identification information of the first communication device is a communication terminal (second device) different from the first communication device. The PIN code (first password) can be appropriately acquired using the communication device. Therefore, the PIN lock of the subscriber authentication module attached to the first communication device or another communication device can be released using the PIN code acquired by the maintenance staff.

  FIG. 9 is a block diagram showing the overall configuration of the security system 3000 according to the fourth embodiment. The security system 3000 is an improvement of the security system 2000 described above. The security system 3000 includes a communication device 100a, a communication device 100b, a communication device 300, and a PIN code management server 200a. The communication device 100a, the communication device 100b, the communication device 300, and the PIN code management server 200a are connected by a network N.

  The communication device 100a is the same as FIG. 7, and when the SIM card 170 is installed and activated, the PIN code is generated and set, and the communication unit 180 transmits the PIN code and identification information to the PIN code management server 200a. It is a thing.

  The maintenance staff U removes the SIM card 170 from the communication device 100a and attaches it to the communication device 100b. Here, the communication device 100b has a function equivalent to that of the communication device 100a, or is a communication terminal capable of mounting at least a general SIM card. In addition, as described above, the SIM card 170 has a PIN code set by the function of the communication device 100a.

  The communication device 300 is an example of the second communication device described above, and is an information terminal used by the maintenance staff U in maintenance work. The communication device 300 includes a request unit 310 and a display control unit 320. The request unit 310 transmits a password request including the input identification information of the SIM card 170 to the PIN code management server 200a via the network N. The method of inputting identification information will be described later. The display control unit 320 receives the PIN code associated with the identification information from the PIN code management server 200a, and displays the PIN code on a screen (not shown). Here, the request unit 310 and the display control unit 320 can be realized by a control circuit (not shown) in the communication device 300 reading and executing a dedicated application stored in a storage unit (not shown). is there.

  The PIN code management server 200a is obtained by replacing the communication unit 210 with the communication unit 210a in addition to the functions of the PIN code management server 200 described above. The communication unit 210a receives the above-described password request from the communication device 300. In this case, the communication unit 210a acquires the PIN code 232 associated with the identification information 231 from the database 230, and transmits the acquired PIN code 232 to the communication device 300.

  FIG. 10 is a sequence diagram showing the flow of the password acquisition process of the subscriber authentication module according to the fourth embodiment. As a premise, it is assumed that the communication device 100a sets a PIN code for the attached SIM card 170 by the function of the communication device 100a as in the third embodiment. The PIN code management server 200a is assumed to store the PIN code set in the SIM card 170 and the identification information in the database 230 in association with each other. And the maintenance person U shall transfer the SIM card 170 from the communication apparatus 100a to the communication apparatus 100b, and shall perform various settings to the communication apparatus 100b.

  First, the maintenance staff U activates a dedicated application of the communication device 300. And the exclusive application of the communication apparatus 300 acquires the identification information of the communication apparatus 100a (S301). For example, it is assumed that the communication device 100a displays a two-dimensional barcode indicating the serial number of its own device on the screen by the operation of the maintenance staff U, and the communication device 300 reads the two-dimensional barcode. In this case, the communication device 300 converts the read two-dimensional barcode into the serial number of the communication device 100a. The two-dimensional barcode may indicate at least one of IMSI, ICCID, and telephone number recorded on the SIM card 170. Alternatively, the maintenance staff U may input the ICCID described on the surface of the SIM card 170 via the input unit of the communication device 300.

  Next, the communication apparatus 300 transmits a password request to the PIN code management server 200a via the network N (S302). Here, the communication apparatus 300 includes the identification information acquired in step S301 in the password request.

  Then, the communication unit 210a of the PIN code management server 200a receives the password request from the communication device 300. The communication unit 210a extracts identification information from the password request. Then, the communication unit 210a acquires the PIN code 232 associated with the extracted identification information from the database 230 (S303). Thereafter, the communication unit 210a transmits the acquired PIN code 232 to the communication device 300 via the network N (S304).

  Then, the display control unit 320 of the communication device 300 displays the received PIN code 232 on the screen (S305).

  Further, after step S301, the maintenance staff U removes the SIM card 170 from the communication device 100a (S306), and attaches the SIM card 170 to the communication device 100b (S307). Then, the maintenance staff U turns on the communication device 100b. In response to this, the communication device 100b is activated and the PIN code is already set in the SIM card 170, so that the PIN lock is applied (S308). For example, when the communication device 100b has the same function as that of the communication device 100a, a process in the case of NO in step S116 in FIG. 6 is performed. That is, the communication apparatus 100b displays on the screen a request to input a PIN code.

  Accordingly, the maintenance staff U inputs the PIN code displayed on the screen of the communication device 300 to the communication device 100b (S309). In response to this, the communication device 100b compares the PIN code set in the SIM card 170 with the input PIN code, and releases the PIN lock (S310).

  Here, in Patent Document 1 described above, the PIN lock is applied when the cover is opened, and the PIN lock is released when the cover is closed. However, Patent Document 1 does not consider that the user arbitrarily releases the PIN lock. In the second embodiment and the like described above, since the communication apparatus 100 automatically generates a password (PIN code or the like), there is no means for the user to know the password. Therefore, in this embodiment, the user can legitimately obtain the PIN code using the identification information of the communication device 100a from the PIN code management server 200a in which the PIN code used for the PIN lock has already been registered. Therefore, it is possible to reduce the trouble for the maintenance staff U and the like to investigate the PIN code of the SIM card 170 in advance. For example, the maintenance staff U can easily release the PIN lock in the communication device 100b into which the SIM card 170 is inserted by a screen operation of a WEB screen or a dedicated application of the mobile terminal.

<Embodiment 5>
The fifth embodiment is an improved example of the third embodiment described above. In the third embodiment, the password set in the subscriber authentication module is a fixed value. On the other hand, in the fifth embodiment, the password is periodically updated. That is, the management server includes a calculation unit that calculates a second password using a predetermined random number (second random number) and the identification information after a predetermined period has elapsed since the storage unit stored in the database. Further prepare. Then, the communication unit of the management server transmits the second password to the first communication device. The password setting unit of the first communication device cancels the protection of the subscriber authentication module by the first password, performs the setting of the subscriber authentication module by the second password, and Is stored in the storage unit. Thus, since the password set in the subscriber authentication module is changed with the passage of time, the security for protecting the subscriber authentication module can be improved.

  FIG. 11 is a block diagram showing the overall configuration of the security system 4000 according to the fifth embodiment. The security system 4000 is an improvement of the security system 2000 described above. The security system 4000 includes a communication device 100c and a PIN code management server 200b. The communication device 100c and the PIN code management server 200b are connected by a network N.

  In the PIN code management server 200b, in addition to the functions of the PIN code management server 200 described above, the communication unit 210 and the storage unit 220 are replaced with the communication unit 210b and the storage unit 220b, and a calculation unit 240 is added. It is assumed that the PIN code management server 200b stores a predetermined random number that is different from the random number 161 stored in the memory 160 of the communication device 100c in an internal storage unit (not shown). When the storage unit 220b stores the identification information 231 and the PIN code 232 in association with each other, the storage unit 220b records the storage date and time. The calculation unit 240 calculates a second password (such as a PIN code) using a predetermined random number and the identification information 231 after a predetermined period has elapsed since the storage unit 220b stored in the database 230. Here, the calculated PIN code is different from the PIN code 162 stored in the memory 160 of the communication device 100c. Then, the communication unit 210b transmits the calculated second password to the communication device 100c via the network N. At this time, the communication unit 210b causes the communication device 100c to cancel the protection setting of the SIM card 170 with the first password, perform the setting of the SIM card 170 with the second password, and use the second password for the communication device. A request for saving in 100c is transmitted. That is, the communication unit 210b transmits a request for updating the password set in the SIM card 170. At this time, the update request includes the second password.

  The communication device 100c is an improvement of the communication device 100a described above, and includes at least a communication unit 180b, a password setting unit 12b, and a memory 160. Further, the SIM card 170 in which the PIN code 162 is set is attached to the communication device 100c. The communication unit 180b receives the password update request from the PIN code management server 200b via the network N. Then, in response to receiving the update request, the password setting unit 12b cancels the protection setting of the SIM card 170 using the PIN code 162 stored in the memory 160. Then, the password setting unit 12b sets the SIM card 170 with the PIN code that is the second password included in the update request. Then, the password setting unit 12b stores the second password in the memory 160.

  FIG. 12 is a sequence diagram showing the flow of the password update process of the subscriber authentication module according to the fifth embodiment. First, the calculation unit 240 of the PIN code management server 200b detects that a predetermined period has elapsed from the storage date and time when the identification information 231 and the PIN code 232 are stored. In this case, the calculation unit 240 reads the identification information 231 from the database 230. Then, the calculation unit 240 calculates a new PIN code using the read identification information 231 and a predetermined random number (S401).

  Subsequently, the storage unit 220b updates the database 230 with the old PIN code associated with the identification information 231 with the newly calculated PIN code (S402). For example, the storage unit 220b updates the database 230 in association with the identification information 231, the newly calculated PIN code, and the current date and time. Then, the communication unit 210b transmits a password update request including the newly calculated PIN code to the communication device 100c via the network N (S403).

  Thereafter, the communication unit 180b of the communication device 100c receives the password update request from the PIN code management server 200b. Then, in response to the reception of the update request, the password setting unit 12b cancels the protection setting of the SIM card 170 using the PIN code 162 stored in the memory 160 (S404). Then, the password setting unit 12b sets the SIM card 170 with the PIN code that is the second password included in the update request (S405). Then, the password setting unit 12b stores the second password in the memory 160 (S406). Therefore, thereafter, the password setting unit 12b cancels the protection setting of the SIM card 170 using the second password before the start of the communication process of the communication device 100c, and uses the second password after the end of the communication process. The protection of the SIM card 170 can be reset.

  Thus, in this Embodiment, since the password set to a subscriber authentication module is changed according to progress of time, the security for protecting a subscriber authentication module can be improved.

<Other embodiments>
In the above-described embodiment, the hardware configuration has been described. However, the present invention is not limited to this. The present disclosure can also realize arbitrary processing by causing a CPU (Central Processing Unit) to execute a computer program.

  In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, DVD (Digital Versatile Disc), semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)) are included. The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

  Note that the present disclosure is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present disclosure. In addition, the present disclosure may be implemented by appropriately combining the respective embodiments.

A part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.
(Appendix 1)
A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
A communication device comprising:
(Appendix 2)
The password setting unit
After the setting by the first password at the time of starting, the protection of the subscriber authentication module is released by the first password stored in the storage unit at least before the start of communication processing The communication apparatus according to attachment 1.
(Appendix 3)
The storage unit stores a first random number in advance,
The password setting unit
When the setting is not performed in the subscriber authentication module, the identification information is read from the subscriber authentication module, and the first random number stored in the storage unit is read using the identification information and the first random number. The communication apparatus according to Supplementary Note 1 or 2, wherein a password is calculated, the setting is performed using the first password, and the first password is stored in the storage unit.
(Appendix 4)
When performing the setting with the first password in the password setting unit, the identification information and the first password are stored via a network in order to store the identification information and the first password in association with each other. The communication device according to any one of appendices 1 to 3, further comprising: a communication unit that transmits to the management server.
(Appendix 5)
The communication unit is
Receiving a second password calculated from the management server using a second random number and the identification information after elapse of a predetermined period in the management server;
The password setting unit
Canceling the protection of the subscriber authentication module with the first password;
Performing the setting of the subscriber authentication module with the second password;
The communication device according to attachment 4, wherein the second password is stored in the storage unit.
(Appendix 6)
A password for protecting the reading of the identification information for the subscriber authentication module that is detachably attached to the first communication apparatus and in which the predetermined identification information is recorded is set in the first communication apparatus. A communication unit that receives the first password that is set when it is not activated at startup and the identification information from the first communication device via a network;
A storage unit that stores the identification information and the first password in association with each other in a database;
A management server comprising:
(Appendix 7)
The communication unit is
When a password request including the identification information is received from the second communication device via the network, the first password associated with the identification information is acquired from the database, and the acquired first The management server according to attachment 6, wherein the password is transmitted to the second communication device.
(Appendix 8)
A calculation unit that calculates a second password using a predetermined random number and the identification information after elapse of a predetermined period after being stored in the database by the storage unit;
The communication unit is
Causing the first communication device to cancel the setting of the subscriber authentication module with the first password, to perform the setting of the subscriber authentication module with the second password, and to use the second password. Transmitting the second password to the first communication device in order to store the first password in the first communication device;
The management server according to appendix 6 or 7.
(Appendix 9)
When the other communication device is activated, a password is set to protect the reading of the identification information for the subscriber authentication module that is detachably attached to the other communication device and in which the predetermined identification information is recorded. A request for transmitting a password request including the identification information to the management server having a database in which the first password set when the identification information is not stored and the identification information is stored in association with each other. And
A display control unit that receives the first password associated with the identification information from the management server and displays the first password on a screen;
A communication device comprising:
(Appendix 10)
A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
A first communication device comprising:
A management server connected to the first communication device via a network;
With
The first communication device is:
The password setting unit further includes a communication unit that transmits the identification information and the first password to the management server via the network when the setting is performed using the first password.
The management server
A security system that receives the identification information and the first password from the first communication device and stores the identification information and the first password in a database in association with each other.
(Appendix 11)
A second communication device that transmits a password request including the input identification information to the management server via the network;
The management server
When the password request is received from the second communication device, the first password associated with the identification information is acquired from the database, and the acquired first password is used as the second communication device. Send to
The security system according to attachment 10.
(Appendix 12)
The management server
A second password is calculated using a second random number and the identification information after a lapse of a predetermined period after the identification information and the first password are stored in the database;
Sending the second password to the first communication device;
The password setting unit
Canceling the setting of the subscriber authentication module with the first password;
Performing the setting of the subscriber authentication module with the second password;
The security system according to appendix 10 or 11, wherein the second password is stored in the storage unit.
(Appendix 13)
Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated And
If the setting is not made, the subscriber authentication module performs the setting with a first password,
A communication device control method for storing the first password in a storage unit.
(Appendix 14)
A password for protecting the reading of the identification information for the subscriber authentication module that is detachably attached to the first communication apparatus and in which the predetermined identification information is recorded is set in the first communication apparatus. Receiving the first password set when not activated at the time of startup and the identification information from the first communication device via the network;
A management server control method for storing the identification information and the first password in a database in association with each other.
(Appendix 15)
When the other communication device is activated, a password is set to protect the reading of the identification information for the subscriber authentication module that is detachably attached to the other communication device and in which the predetermined identification information is recorded. A password request including the identification information is transmitted to the management server having a database in which the first password set when the identification information is not stored and the identification information is stored in association with each other via the network;
Receiving the first password associated with the identification information from the management server;
A method for controlling a communication apparatus, wherein the first password is displayed on a screen.
(Appendix 16)
Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated A process of determining
A process of performing the setting by a first password in the subscriber authentication module when the setting is not performed;
A process of storing the first password in a storage unit;
A program that causes a computer to execute.
(Appendix 17)
A password for protecting the reading of the identification information for the subscriber authentication module that is detachably attached to the first communication apparatus and in which the predetermined identification information is recorded is set in the first communication apparatus. A process of receiving the first password set when not activated at the time of startup and the identification information from the first communication device via a network;
A process of associating the identification information with the first password and storing them in a database;
A program that causes a computer to execute.
(Appendix 18)
When the other communication device is activated, a password is set to protect the reading of the identification information for the subscriber authentication module that is detachably attached to the other communication device and in which the predetermined identification information is recorded. Processing for transmitting a password request including the identification information to the management server having a database in which the first password set in the case where the identification information is not stored and the identification information is stored in association with each other When,
A process of receiving the first password associated with the identification information from the management server;
Displaying the first password on a screen;
A program that causes a computer to execute.
(Appendix 19)
The password setting unit
At the start of the communication process, the protection of the subscriber authentication module is canceled by the first password stored in the storage unit,
The communication device according to any one of appendices 1 to 5, wherein after the communication process is finished, the protection is performed again on the subscriber authentication module by the first password.

DESCRIPTION OF SYMBOLS 1 Communication apparatus 11 Subscriber authentication module 111 Identification information 12 Password setting part 13 Memory | storage part 131 1st password 100 Communication apparatus 110 Battery 120 Power supply circuit 130 CPU
140 wireless circuit 150 SIM connector 160 memory 161 random number 162 PIN code 170 SIM card 2000 security system 100a communication device 180 communication unit 200 PIN code management server 210 communication unit 220 storage unit 230 database 231 identification information 232 PIN code N network 3000 security system 100b Communication device 200a PIN code management server 210a Communication unit U Maintenance staff 300 Communication device 310 Request unit 320 Display control unit 4000 Security system 100c Communication device 12b Password setting unit 180b Communication unit 200b PIN code management server 210b Communication unit 220b Storage unit 240 Calculation unit

Claims (10)

A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
A communication device comprising: The password setting unit
After performing the setting with the first password for the subscriber authentication module at the time of activation, the subscriber uses the first password stored in the storage unit at least before the start of communication processing. The communication apparatus according to claim 1, wherein the protection of the authentication module is canceled. The storage unit stores a first random number in advance,
The password setting unit
When the setting is not performed in the subscriber authentication module, the identification information is read from the subscriber authentication module, and the first random number stored in the storage unit is read using the identification information and the first random number. The communication apparatus according to claim 1, wherein a password is calculated, the setting is performed using the first password, and the first password is stored in the storage unit. When performing the setting with the first password in the password setting unit, the identification information and the first password are stored via a network in order to store the identification information and the first password in association with each other. The communication device according to any one of claims 1 to 3, further comprising a communication unit that transmits to the management server. The communication unit is
Receiving a second password calculated from the management server using a second random number and the identification information after elapse of a predetermined period in the management server;
The password setting unit
Canceling the protection of the subscriber authentication module with the first password;
Performing the setting of the subscriber authentication module with the second password;
The communication apparatus according to claim 4, wherein the second password is stored in the storage unit. A password for protecting the reading of the identification information for the subscriber authentication module that is detachably attached to the first communication apparatus and in which the predetermined identification information is recorded is set in the first communication apparatus. A communication unit that receives the first password that is set when it is not activated at startup and the identification information from the first communication device via a network;
A storage unit that stores the identification information and the first password in association with each other in a database;
A management server comprising: When the other communication device is activated, a password is set to protect the reading of the identification information for the subscriber authentication module that is detachably attached to the other communication device and in which the predetermined identification information is recorded. A request for transmitting a password request including the identification information to the management server having a database in which the first password set when the identification information is not stored and the identification information is stored in association with each other. And
A display control unit that receives the first password associated with the identification information from the management server and displays the first password on a screen;
A communication device comprising: A subscriber authentication module that is detachably attached to its own device and in which predetermined identification information is recorded;
At the time of activation, it is determined whether or not a password for protecting the reading of the identification information is set in the subscriber authentication module. If the setting is not performed, the subscriber authentication module receives a first A password setting unit for performing the setting by a password;
A storage unit for storing the first password;
A first communication device comprising:
A management server connected to the first communication device via a network;
With
The first communication device is:
The password setting unit further includes a communication unit that transmits the identification information and the first password to the management server via the network when the setting is performed using the first password.
The management server
A security system that receives the identification information and the first password from the first communication device and stores the identification information and the first password in a database in association with each other. Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated And
If the setting is not made, the subscriber authentication module performs the setting with a first password,
A communication device control method for storing the first password in a storage unit. Whether or not a password for protecting reading of the identification information is set in the subscriber authentication module that is detachably attached to the communication device and records predetermined identification information when the communication device is activated A process of determining
A process of performing the setting by a first password in the subscriber authentication module when the setting is not performed;
A process of storing the first password in a storage unit;
A program that causes a computer to execute.

Images