JP2024078749A - Access control device, access control method, and access control program - Google Patents

Abstract

To provide an access control device, an access control method, and an access control program that contribute to reducing the complexity of authentication while maintaining security.SOLUTION: An access control device includes: a primary authentication unit that performs primary authentication based on personal authentication of a user; a secondary authentication unit that performs secondary authentication using a portable terminal carried by the user; an access control unit that controls entry of the user into a controlled area based on the authentication results of the primary authentication and the secondary authentication; and a terminal monitoring unit that monitors location of the portable terminal after the portable terminal has been brought into the controlled area by the user. When the portable terminal has not been monitored to be taken out of the controlled area, the access control unit controls re-entry of the user into the controlled area based on the authentication result of the primary authentication performed again without depending on the secondary authentication.SELECTED DRAWING: Figure 1

Description

The present invention relates to an entrance management device, an entrance management method, and an entrance management program.

For example, Patent Document 1 discloses a technology that simplifies authentication when a user temporarily enters and exits a managed area, reducing the complexity of authentication. Specifically, Patent Document 1 acquires a facial image of a user who temporarily leaves a managed area, and when that user re-enters the managed area, the re-entry is permitted based on the acquired facial image.

JP 2003-109010 A

The following analysis has been made from the perspective of the present invention. The disclosures of the above-mentioned prior art documents are incorporated herein by reference.

The technology disclosed in Patent Document 1 is based on the acquisition and matching of facial images, resulting in a complex device configuration. In addition, if a user intentionally registers a facial image when leaving a managed area, registering the facial image is time-consuming. On the other hand, if there is no need for users to intentionally register facial images, it is not necessarily possible to acquire an image clear enough to be used for matching. Reducing the clarity of the image required for matching leads to a decrease in security.

The present invention aims to provide an entrance management device, an entrance management method, and an entrance management program that contribute to reducing the complexity of authentication while maintaining security.

According to a first aspect of the present invention,
a primary authentication unit that performs primary authentication by personal authentication of a user;
a secondary authentication unit that performs secondary authentication using a mobile terminal carried by the user;
an entrance management unit that manages entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring unit that monitors a location of the mobile terminal after the mobile terminal is brought into the management area by the user;
Equipped with
When the portable terminal is not monitored for being taken out of the management area, the entrance management unit manages re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication.
An entrance control device is provided.

According to a second aspect of the present invention,
a primary authentication step of performing primary authentication by personal authentication of a user;
a secondary authentication step of performing secondary authentication using a mobile terminal carried by the user;
an entrance management step of managing entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring step of monitoring a location of the portable terminal after the portable terminal is brought into the controlled area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, re-entry of the user to the management area is managed based on a result of a primary authentication performed again without relying on the secondary authentication.
An entrance management method using an entrance management device is provided.

According to a third aspect of the present invention,
A primary authentication process for performing primary authentication by personal authentication of a user;
A secondary authentication process for performing secondary authentication using a mobile terminal carried by the user;
an entrance management process for managing the entrance of the user to a management area based on the results of the primary authentication and the secondary authentication;
a terminal monitoring process for monitoring the location of the mobile terminal after the mobile terminal is brought into the management area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, a process of managing re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication is performed.
An entrance management program is provided to be executed by a computer as the entrance management device.

According to each aspect of the present invention, an entrance management device, an entrance management method, and an entrance management program are provided that contribute to reducing the complexity of authentication while maintaining security.

FIG. 1 is a diagram for explaining an overview of the present invention. 10 is a flowchart showing an example of a process flow by the entry management device 100. 10 is a flowchart showing an example of a process flow by the entry management device 100. FIG. 1 is a diagram illustrating an example of a computer as an entry management device 100.

A preferred embodiment of the present invention will be described in detail with reference to the drawings. Note that the reference symbols in the drawings given in the following description are given for convenience to each element as an example to aid in understanding, and are not intended to limit the present invention to the illustrated form. Although not explicitly shown, input ports and output ports exist at the input and output ends of each connection line. The same applies to input/output interfaces.

First, an overview of the present invention will be described. As shown in FIG. 1, the entrance management device 100 includes a primary authentication unit 10, a secondary authentication unit 20, an entrance management unit 30, and a terminal monitoring unit 40. The primary authentication unit 10 performs primary authentication by personal authentication of the user. The secondary authentication unit 20 performs secondary authentication using a mobile terminal carried by the user. The entrance management unit 30 manages the entrance of the user to the management area based on the authentication results of the primary authentication and the secondary authentication. The terminal monitoring unit 40 monitors the location of the mobile terminal after the user brings the mobile terminal into the management area by entering the management area. Here, if the portable terminal is not monitored for being taken out of the management area, the entrance management unit 30 manages the user's re-entry to the management area based on the authentication result of the primary authentication performed again without relying on the secondary authentication.

In short, the entrance management device 100 requires both primary and secondary authentication when a user first enters a managed area, but as long as the user leaves the mobile device within the managed area, the entrance management device 100 allows re-entry with only primary authentication without secondary authentication.

Here, the entrance management device 100 does not require secondary authentication in a situation where a user is expected to leave their mobile device behind and go outside for a short period of time, so security is not compromised. Also, for the user, if they leave their mobile device within the management area, secondary authentication is not required, and the complexity of authentication is reduced. In other words, the entrance management device 100 of the present invention is capable of reducing the complexity of authentication while maintaining security.

[Embodiment 1]
The following is a more detailed description of the entry control device 100. The entry control device 100 of the first embodiment includes a primary authentication unit 10, a secondary authentication unit 20, an entry control unit 30, and a terminal monitoring unit 40, similar to the above overview.

The primary authentication unit 10, for example, reads a user ID (IDentification) from an IC (Integrated Circuit) card presented by the user, compares it with information registered in a memory unit (not shown), and performs primary authentication to determine whether the user is a person permitted to enter the managed area. Here, primary authentication is not limited to using an IC card, and may also use, for example, a voiceprint, fingerprint, or iris. The memory unit may be provided in the entry management device 100 itself, or may be provided externally and connected via a network.

The secondary authentication unit 20 performs secondary authentication using a mobile device carried by the user, such as a smartphone. For example, the secondary authentication unit 20 notifies the mobile device of the user identified by the primary authentication of a one-time password via a telephone line, and performs secondary authentication by requesting the user to input the notified one-time password.

The processing performed by the entry management unit 30 will be explained in detail later.

The terminal monitoring unit 40 monitors the location of the mobile terminal after the user enters the management area and brings the mobile terminal into the management area. Specifically, the terminal monitoring unit 40 monitors the location of the mobile terminal via an application installed on the mobile terminal. Here, for example, the mobile terminal obtains its own location information using a GPS (Global Positioning System), and the terminal monitoring unit 40 receives notification of the location information from the mobile terminal.

The flow of processing by the entry management device 100 will be described with reference to Figures 2 and 3. Hereinafter, the authentication request after the approval result of the secondary authentication is erased (Figure 2, step S101) will be referred to as "initial entry by the user." Also, the authentication request while maintaining the approval result of the secondary authentication (Figure 3, step S201) will be referred to as "re-entry by the user."

(User first enters the room)
As shown in Fig. 2, when an IC card is presented to the primary authentication unit 10 and an authentication request is received from a user (step S101, Yes), the entrance management device 100 performs primary authentication (step S102). If the user is approved in the primary authentication (step S102, Yes), the entrance management device 100 performs secondary authentication (step S103). If the user is also approved in the secondary authentication (step S103, Yes), the entrance management device 100 unlocks the door to the management area (step S104). Then, the entrance management device 100 starts monitoring the location of the mobile terminal (step S105). After that, when the entrance management device 100 monitors the portable terminal being taken out of the management area (step S106, Yes), it erases the approval result of the secondary authentication (step S107) and returns to waiting for an authentication request (step S101). On the other hand, unless the portable terminal is monitored as being taken out of the controlled area (step S106, No), the entrance control device 100 waits for an authentication request while maintaining the approval result of the secondary authentication (proceed to step S201 in FIG. 3).

(Re-entering by user)
3 is a flow continuing from No in step S106 in FIG. 2, that is, starting from a state in which the mobile terminal has not been taken out of the management area. Under this condition, the entrance management device 100 maintains the approval result of the secondary authentication. Also, it is assumed that the user has left the management area while leaving the mobile terminal in the management area, although the entrance management device 100 does not perform any particular process.

As shown in FIG. 3, when an authentication request is received from a user who re-enters the managed area (step S201, Yes), the entrance management device 100 performs primary authentication (step S202). If the user is approved in the primary authentication (step S202, Yes), the entrance management device 100 unlocks the door to the managed area (step S203). After that, when the entrance management device 100 monitors the portable terminal being taken out of the managed area (step S204, Yes), it erases the approval result of the secondary authentication (step S205) and returns to waiting for an authentication request (FIG. 2, step S101). On the other hand, the entrance management device 100 waits for an authentication request while maintaining the approval result of the secondary authentication (step S201) unless the entrance management device 100 monitors the portable terminal being taken out of the managed area (step S204, No).

If the user is not approved in the primary authentication and secondary authentication (No, e.g., step S102), the entry management device 100 may notify the administrator of this fact.

The entry management unit 30 will now be described with reference to the above-mentioned process flow. The entry management unit 30 of the first embodiment manages the unlocking and locking of the doors of the management area, and also manages the processing by the entire entry management device 100. That is, for example, when the primary authentication unit 10 is configured as an IC card reader, the entry management unit 30 checks the user ID. Also, when the secondary authentication unit 20 is configured as a touch panel, the entry management unit 30 notifies the user of a PIN number. Here, for users approved by the secondary authentication, the entry management unit 30 stores the fact that the secondary authentication was approved, that is, the approval result of the secondary authentication, by setting a flag in the user ID list. This flag is erased by the entry management unit 30 when the terminal monitoring unit 40 detects that a mobile terminal has been taken out of the management area.

When a user is approved in the primary authentication, the entry management unit 30 checks whether a flag has been set for the user ID of the approved user. If the flag has not been set, the primary authentication (step S102) is the case of "first entry by the user," and secondary authentication is performed after the primary authentication (step S103). On the other hand, if the flag has been set, the primary authentication (step S202) is the case of "re-entry by the user," and the door to the managed area is unlocked without secondary authentication after the primary authentication.

As described above, according to the entrance management device 100 of the first embodiment, it is possible to reduce the complexity of authentication while maintaining security. Furthermore, according to the entrance management device 100 of the first embodiment, even if a user carelessly leaves his/her mobile terminal in the managed area, the user can be permitted to enter the managed area.

[Other variations]
As described above regarding entry into a managed area, the managed area is assumed to be a room, but the managed area may be a field or building where approval is required for entry.

The mobile terminal is not limited to a smartphone. In other words, the main requirements for a mobile terminal are that it can be carried by the user into the managed area, that it can be left by the user within the managed area, and that the entrance management device 100 can monitor its location. Therefore, it may be a dedicated terminal.

It is preferable that the secondary authentication unit 20 performs secondary authentication by notifying the mobile terminal of an authentication code (including a one-time password) and requesting the user to input the authentication code. In other words, it is preferable that the mobile terminal is configured to be able to receive the authentication code from the secondary authentication unit 20. If configured in this way, the mobile terminal becomes an essential item for secondary authentication, and it becomes necessary to bring it into the controlled area. In addition, security is improved because the authentication code can be made into a one-time password that can be used temporarily.

The key point of the present invention is that secondary authentication is not required when the user re-enters the managed area as long as the mobile terminal is left inside the managed area, and there are no limitations on the type of secondary authentication. An example is shown below.

For example, the entrance management device 100 refers to a storage unit (not shown), confirms that the user ID is registered, and performs primary approval. Then, it reads out the telephone number, PIN, terminal ID for acquiring location information, and date and time of use stored in association with the user ID. If the date and time of use match, it calls the user's telephone number to call the mobile terminal and requests location information from the mobile terminal. The mobile terminal acquires location information, for example, by GPS, and notifies the entrance management device 100 of the location information via an installed application. When the user answers the call on the mobile terminal and dials a previously registered PIN, the mobile terminal transmits a PB (push button) signal to the entrance management device 100 via the telephone network. If the number of the received PB signal matches the user's PIN, the entrance management device 100 records the entry time of the user ID and unlocks the door to the management area.

When a user temporarily leaves a managed area, an IC card reader installed in the managed area reads the user ID from the IC card presented by the user. The entrance management device 100 records the time of exit of the user ID and unlocks the door to the managed area.

When a user re-enters the room, the entrance management device 100 reads the user ID from the IC card presented by the user. If the location information periodically acquired from the mobile terminal indicates that the user is within the managed area, the entrance management device 100 records the entry time of the user ID and unlocks the door to the managed area. If it is confirmed that the location information indicates that the user has left the managed area, the entry is not treated as re-entry and the same control as for normal entry is carried out.

The entrance management device 100 can use a variety of existing technologies to unlock and lock the doors of the managed area, such as technology via a telephone exchange and a HA (Home Automation) line.

Monitoring the location of the mobile terminal is not limited to monitoring the location of the mobile terminal based on the location information of the mobile terminal, but may be sufficient as long as it can be confirmed that the mobile terminal is within the management area. For example, if the management area is configured to block radio waves from the outside, a receiver installed within the management area may receive a signal transmitted from the mobile terminal and monitor the location of the mobile terminal. For this reason, the mobile terminal may be configured like a beacon, and the signal transmitted by the beacon may be used as an authentication key for secondary authentication and to confirm that the mobile terminal is within the management area. Conversely, the mobile terminal may be requested to respond to a signal from a transmitter installed within the management area. Here, monitoring of the location of the mobile terminal may be performed continuously or periodically.

The present invention can also be realized as an entrance management program executed by a computer serving as the entrance management device 100. For example, as shown in FIG. 4, in the computer serving as the entrance management device 100, the computer's CPU (Central Processing Unit) reads out the entrance management program from memory. Here, the CPU realizes modules corresponding to the primary authentication unit 10, the secondary authentication unit 20, the entrance management unit 30, and the terminal monitoring unit 40. Note that, in the case where the primary authentication unit 10 and the secondary authentication unit 20 in the entrance management device 100 are configured as an IC card reader or a touch panel, the module corresponding to the entrance management unit 30 is responsible for the processing executed by them.

Some or all of the above embodiments may be described as follows, but are not limited to the following:

(Appendix 1)
a primary authentication unit that performs primary authentication by personal authentication of a user;
a secondary authentication unit that performs secondary authentication using a mobile terminal carried by the user;
an entrance management unit that manages entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring unit that monitors a location of the mobile terminal after the mobile terminal is brought into the management area by the user;
Equipped with
When the portable terminal is not monitored for being taken out of the management area, the entrance management unit manages re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication.
Entrance control device.

(Appendix 2)
The entrance management device according to claim 1, wherein the secondary authentication unit performs secondary authentication by notifying the mobile terminal of an authentication code and requesting the user to input the authentication code.

(Appendix 3)
The entrance management device according to claim 1, wherein the terminal monitoring unit monitors the location of the mobile terminal based on location information of the mobile terminal.

(Appendix 4)
2. The entrance management device according to claim 1, wherein the terminal monitoring unit receives a signal transmitted from the mobile terminal using a receiver installed within the management area, and monitors the location of the mobile terminal.

(Appendix 5)
a primary authentication step of performing primary authentication by personal authentication of a user;
a secondary authentication step of performing secondary authentication using a mobile terminal carried by the user;
an entrance management step of managing entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring step of monitoring a location of the portable terminal after the portable terminal is brought into the controlled area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, re-entry of the user to the management area is managed based on a result of a primary authentication performed again without relying on the secondary authentication.
An entrance management method using an entrance management device.

(Appendix 6)
A primary authentication process for performing primary authentication by personal authentication of a user;
A secondary authentication process for performing secondary authentication using a mobile terminal carried by the user;
an entrance management process for managing the entrance of the user to a management area based on the results of the primary authentication and the secondary authentication;
a terminal monitoring process for monitoring the location of the mobile terminal after the mobile terminal is brought into the management area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, a process of managing re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication is performed.
An entrance management program to be executed by a computer as an entrance management device.

The disclosures of the above cited patent documents are incorporated into this document by reference and may be used as the basis or part of the present invention as necessary. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure, including the scope of claims, and the technical ideas. In particular, with regard to the numerical ranges described in this document, any numerical value or small range included within the range should be interpreted as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents may be used in part or in whole in combination with the descriptions in this document as part of the disclosure of the present invention in accordance with the spirit of the present invention as necessary, and are considered to be included in the disclosures of this application.

10 Primary authentication unit 20 Secondary authentication unit 30 Entrance management unit 40 Terminal monitoring unit 100 Entrance management device

Claims (6)

a primary authentication unit that performs primary authentication by personal authentication of a user;
a secondary authentication unit that performs secondary authentication using a mobile terminal carried by the user;
an entrance management unit that manages entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring unit that monitors a location of the mobile terminal after the mobile terminal is brought into the management area by the user;
Equipped with
When the portable terminal is not monitored for being taken out of the management area, the entrance management unit manages re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication.
Entrance control device. The entrance management device according to claim 1, wherein the secondary authentication unit performs secondary authentication by notifying the mobile terminal of an authentication code and requesting the user to input the authentication code. The entrance management device according to claim 1, wherein the terminal monitoring unit monitors the location of the mobile terminal based on the location information of the mobile terminal. The entrance management device according to claim 1, wherein the terminal monitoring unit receives a signal transmitted from the mobile terminal with a receiver installed in the management area and monitors the location of the mobile terminal. a primary authentication step of performing primary authentication by personal authentication of a user;
a secondary authentication step of performing secondary authentication using a mobile terminal carried by the user;
an entrance management step of managing entrance of the user to a management area based on authentication results of the primary authentication and the secondary authentication;
a terminal monitoring step of monitoring a location of the portable terminal after the portable terminal is brought into the controlled area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, re-entry of the user to the management area is managed based on a result of a primary authentication performed again, without relying on the secondary authentication.
An entrance management method using an entrance management device. A primary authentication process for performing primary authentication by personal authentication of a user;
A secondary authentication process for performing secondary authentication using a mobile terminal carried by the user;
an entrance management process for managing the entrance of the user to a management area based on the results of the primary authentication and the secondary authentication;
a terminal monitoring process for monitoring the location of the mobile terminal after the mobile terminal is brought into the management area by the user's entry;
Including,
When the portable terminal is not monitored for being taken out of the management area, a process of managing re-entry of the user to the management area based on a result of a primary authentication performed again without relying on the secondary authentication is performed.
An entrance management program to be executed by a computer as an entrance management device.

Images