JP5021093B1 - Portable device, information server device, and information management system - Google Patents

Abstract

[PROBLEMS] To find out who is trying to read this information.
In response to the unique number of the own device, the management number of the desired information, the position information and the time information, the information server device receives authentication of whether the device may read the desired information, It is determined that the acquisition unit that acquires the service number corresponding to the sequence for generating the one-time password (OTP) when it is authenticated that it can be read, and the second OTP and the first OTP issued by the information server device match. A first passcode for reading the desired information, and obtaining means for obtaining the first passcode encrypted by the matched OTP, wherein the information server device logs in the device When the device is authenticated, the information server device recognizes it as a log when it is detected whether the second OTP and the first OTP match. Sell recorded information of the device.
[Selection] Figure 1

Description

  The present invention relates to a portable device, an information server device, and an information management system for managing access to information.

  Technology for authenticating users is important in networks. User authentication is a technique for determining whether or not a user of a terminal to be connected is appropriate when connecting to a computer system from a terminal such as a PDA, a mobile phone, or a notebook PC via a network. is there. In order to access important information safely and reliably, user authentication technology is important. In user authentication, ID and password are often used. In recent years, an increase in unauthorized access due to password leakage has become a problem.

  As a countermeasure against unauthorized access, there is a technology that provides means for leaving a trail of who logged in to a computer when and where (see, for example, Patent Document 1). In this technology, when a user attempts to log in to a computer using a password, the computer checks the validity of the password so that only a legitimate user can log in, and after logging in, the computer enters the network. Notify the server that you are logged in when you connect. As a result, the server can manage a trail of when and who logged in on which computer.

  In addition to this, there is a technology aimed at ensuring information security by preventing and preventing information leakage due to the use of file sharing software, etc., and enhancing and facilitating such information leakage ( For example, refer nonpatent literature 1).

JP 2008-108084 A

Masakazu Karasawa, “Development of information leakage countermeasure technology shared by multiple organizations such as Waseda University”, [online], November 30, 2009, [October 7, 2011 search], Internet <URL: http: //cloud.watch.impress.co.jp/epw/docs/news/20091130_332450.html>

  However, this technology can only manage logins to computers. That is, when information is leaked due to unauthorized login, access management such as whether the leaked information has been read cannot be performed.

  Therefore, the problem to be solved by the present invention has been made in consideration of the above-described circumstances, and even when information is leaked, a portable device that can grasp who is trying to read this information, An information server device and an information management system are provided.

  In order to solve the above-described problem, the device of the present invention reads desired information from an information server device storing a plurality of information, and specifies a specifying unit, a first acquiring unit, a second acquiring unit, and an OTP issue Means, third acquisition means, decryption means, and reading means. The specifying means logs in to the information server device and specifies desired information. A 1st acquisition means acquires the positional information and time information of an own apparatus. The second acquisition means determines whether or not the device may read the desired information according to the unique number of the own device, the management number of the desired information, the position information, and the time information. Upon receiving authentication of the information server device, if it is authenticated that the desired information can be read, a service number corresponding to a sequence for generating a one-time password is acquired. The OTP issuing means issues a first one-time password that is a numerical value corresponding to the service number and the time information. The third acquisition means is a first pass code for reading the desired information when it is determined that the second one-time password issued by the information server device matches the first one-time password. The first passcode encrypted by the matched one-time password is acquired. The decrypting means decrypts the encrypted first passcode with the first one-time password. The reading means reads the desired information with the decoded first pass code. The information server device is configured to detect whether the second one-time password matches the first one-time password when the device is about to log in, when the device is authenticated, The device information that can be recognized by the information server device is recorded as a log.

  According to the portable device, the information server device, and the information management system of the present invention, it is possible to grasp who is trying to read this information even when information is leaked.

1 is a block diagram of an information server device and a mobile device according to an embodiment. The figure which shows the structure of the packet exchanged in each part. The figure which shows the content of the table which the authentication service part and OTP issuing part of FIG. 1 preserve | saved. The figure which shows the content of the log preserve | saved in the authentication log database of FIG. The flowchart which shows an example of operation | movement with the portable device and information server apparatus of FIG. The figure which shows an example of the data which the OTP issuing part of FIG. 1 stores. The figure which shows an example of the data which the authentication service part of FIG. 1 stores.

Hereinafter, a mobile device, an information server device, and an information management system according to embodiments of the present invention will be described in detail with reference to the drawings. Note that, in the following embodiments, the same numbered portions are assumed to perform the same operation, and repeated description is omitted.
First, I will briefly explain the one-time password. As a measure for preventing unauthorized access, there is a technology that uses a stronger one-time password than authentication using a password. The one-time password is generated, for example, by an OTP (one time password) issuing device (also called a token) in association with the OTP seed issued by the communication partner and the time information. The server device as the communication partner stores a table of an OTP seed corresponding to the user identification information and a one-time password corresponding to the OTP seed and time information. Furthermore, if the time information is acquired and set to the same time, the one-time password generated by the OTP issuing device and the one-time password generated by the server device are the same, and user authentication can be performed.
Without storing the table, the server device that is the communication partner may store the OTP seed corresponding to the identification information of the user and generate a one-time password corresponding to the OTP seed and the time information. In this case, the OTP issuing device and the server device have the same OTP seed information and the same algorithm for generating a one-time password is set. Furthermore, if the time information is also synchronized, the one-time password generated by the OTP issuing device and the one-time password generated by the server device are the same, and user authentication can be performed.
Since the one-time password can be used only once for authentication because time information changes, the one-time password authentication can ensure high security.

Next, a portable device, an information server device, and an information management system according to an embodiment will be described with reference to FIG.
The information management system of this embodiment includes an information server device 100 and a portable device 110. The information server device 100 includes an information management unit 101, an authentication service unit 102, and an authentication log database 103, and the portable device 110 includes a reader unit 111, a GPS unit 112, and an OTP issuing unit 113.

The information management unit 101 stores and manages a plurality of pieces of information and pass codes α and β corresponding to each piece of information. In addition, the information management unit 101 stores and manages the user IDs and passwords of all users registered in the information server device 100. A user who has logged in with this user ID can access a packet containing desired information or download the packet. Here, accessing a packet means that the packet in the information server apparatus 100 is not directly downloaded from the information server apparatus 100 but is directly connected to the packet, rather than being downloaded to the portable device 110. . These access and download use the Internet or the mobile network 120 or the like. Information exchange between the other information server apparatus 100 and the portable device 110 uses the Internet or the portable network 120.
The information is stored in the information unit 203. The information unit 203 has a readable unit 201 and a header unit 202 added thereto as shown in FIG. The information management unit 101 stores a plurality of packets 200 in units of packets 200 including a readable unit 201, a header unit 202, and an information unit 203. The readable unit 201 includes a management number for identifying the packet 200, restriction information indicating whether the header unit 202 and the information unit 203 of the packet 200 are encrypted, and reference destination information (for example, URL) for authentication. Since the packet 200 is received, the information can be immediately recognized. The header section 202 includes a service number corresponding to the seed of the OTP and a position range and / or a time range in which the information can be read based on the position information and time, and is encrypted with the pass code α. The information unit 203 includes information and is encrypted with a passcode β. The pass codes α and β are different for each packet 200.
The readable unit 201 may include a unique number of the mobile device 110 in which information included in the packet 200 including the readable unit 201 is readable.

When the packet 200 is encrypted, the authentication service unit 102 performs authentication processing on the mobile device 110 that is accessed to obtain the passcode. The authentication service unit 102 has a unique number of a device that has been authenticated, a checksum calculated by the device (for example, a CRC (cyclic redundancy check) value, more specifically, CRC32 and CRC64 values), Authentication processing is performed based on the management number, location information, and time at that time. In the authentication process, whether or not the information specified by the management number may be read by the user of the portable device 110, and whether or not the information is readable depending on the position where the portable device 110 is located and the time at that time Based on whether the checksum calculated by the reader unit 111 matches the checksum calculated by the authentication service unit 102, it is determined whether or not the authentication is successful. If it is determined that the authentication has not been successful, the authentication service unit 102 issues an alarm to the administrator of the information server device 100 to call attention. Here, the checksum calculation method to be calculated based on the packet is previously set to be the same in the reader unit 111 and the authentication service unit 102. For example, if the checksum calculated by the reader unit 111 and the checksum calculated by the authentication service unit 102 are different, there is a high possibility that the packet has been tampered with. In terms of checksum, it is determined that authentication is successful.
The authentication service unit 102 stores an OTP table determined by a service number and time. An example of the table is shown in FIG. For example, the service number is indicated by 256-bit data, and a 20-bit OTP calculated according to the service number and a 32-bit time is tabulated. The authentication service unit 102 obtains the OTP by referring to the table from the service number attached to the packet desired by the mobile device 110 and the time when the location information acquired from the mobile device 110 is acquired. The OTP issuing unit 113 also stores a similar table. However, if the clock used by the authentication service unit 102 and the clock used by the OTP issuing unit 113 are synchronized and the algorithm for generating the OTP is the same as that of the OTP issuing unit 113, the table is not necessary. Further, when the time is exchanged between the information server device 100 and the portable device 110 and the OTP is generated by referring to the same time, only the algorithm for generating the OTP is the authentication service unit 102 and the OTP issuing unit 113. If they are the same, the table is unnecessary.
Further, the authentication service unit 102 inputs a user ID in order to log in to the information server apparatus 100, acquires the log until logging out, and stores these logs in the authentication log database 103. The authentication service unit 102 records, for example, the unique number of the mobile device 110, the management number of the packet 200, the location information and time of the device at the time of login, and the user ID in the authentication log database 103. Further, the authentication service unit 102 may record the checksum of the packet 200 by the portable device 110 in the authentication log database 103. As shown in FIG. 4, the authentication log database 103 leaves a log of information on the portable device 110 that can be recognized on the information server apparatus 100 side. The authentication service unit 102 authenticates, for example, as a table together with other recognizable information such as login, download of a packet, whether authentication has succeeded or failed, whether an alarm has been issued, and whether the OTP matches or does not match. Record in the log database 103. By recording data in the authentication log database 103 in this way, it is possible to know where the information is being read even if the information is leaked. Even if information is leaked, you can know who is trying to read this information.

  Further, the authentication service unit 102 may store a registered unique number of the mobile device 110, a checksum of the packet 200, a user ID and password, a management number, restriction information, and pass codes α and β. Apart from this, the authentication service unit 102 may acquire these pieces of information from the information management unit 101. These pieces of information may be stored somewhere in the information management unit 101 or the authentication service unit 102 and acquired from the storage location when necessary.

The reader unit 111 finally decrypts and displays the encrypted packet 200, but first accesses the information management unit 101, inputs the user ID and password to the information management unit 101, and further manages the information. The information desired by the unit 101 is designated and the packet 200 containing this information is accessed from the information management unit 101, or the packet 200 is downloaded and acquired. At this time, if there is limited information in the limited information of the packet 200, only the readable portion 201 can be decoded.
When the restriction information of the readable unit 201 includes information indicating that there is a restriction, the reader unit 111 acquires the position information and the time at that time from the GPS unit 112, and the position information and time, the management number of the information, the device The authentication service unit 102 is notified of the check number calculated based on the unique number and the packet 200, and the authentication service unit 102 receives the authentication process. If the authentication process determines that the authentication is successful, the authentication service unit 102 transmits the passcode α to the reader unit 111. The reader unit 111 decrypts the header unit 202 to obtain a service number, issues an OTP (de) generated by the portable device 110 based on the service number and time, and transmits the OTP (de) to the authentication service unit 102. The authentication service unit 102 compares the OTP (s) issued by the authentication service unit 102 and the OTP (de), and if they are the same, this OTP (= OTP (s) = OTP (de)) uses a passcode. β is encrypted, and the encrypted passcode β is transmitted to the portable device 110. The reader unit 111 decrypts the passcode encrypted by OTP (de), obtains the passcode β, decrypts the information in the information unit 203 of the packet 200 with the passcode β, and reads this information. In the embodiment, the exchange of the pass codes α and β is performed between the information server apparatus 100 and the portable device 110 and does not involve a human being, for example, input by a user. Therefore, the pass codes α and β in the present embodiment can be freely set as large data, and the safety can be remarkably improved as compared with human intervention. For example, it is possible to set a passcode length that can withstand a brute force password attack.

  The GPS unit 112 acquires the position information of the mobile device 110 and the time at that time. For example, such information is acquired by an artificial satellite. The accuracy of the location information acquired by the GPS unit 112 is set in advance, and it is necessary to set the accuracy better than the location information used when the authentication service unit 102 performs authentication. The authentication service unit 102 determines whether the position of the mobile device 110 is within a position range where authentication is successful. The authentication service unit 102 defines the position range by one latitude value and one longitude value. For example, among 35 ° 05'34.2 ″ north latitude and 136 ° 52′47.5 ″ east longitude, the position range is determined depending on how many digits are used from the left and how many digits are used from the left. Since 1 ″ defines a distance 60 times smaller than 1 ′ and 1 ′ defines a distance 60 times smaller than 1 °, the position range can be determined depending on how many digits are used.

  A case where the earth is approximated as a sphere having a radius of 6400 km is considered as an example model. In this case, 1 ° corresponds to approximately 111701.0 m, 1 ′ corresponds to approximately 1861.7 m, 1 ″ corresponds to approximately 31.0 m, and 0.1 ″ corresponds to approximately 3.1 m. The authentication service unit 102 designates the position range with north accuracy 35 ° 05′34 ″ and east longitude 136 ° 52′47 ″ each with accuracy of seconds, latitude 6 digits from the left, longitude 7 digits from the left In this case, this position range is from 35 ° 05'34.0 "north latitude to 35 ° 05'35.0" north latitude and 136 ° 52'47.0 "east longitude to 136 ° 52'48.0" east longitude. It becomes the range. By specifying the position range in this way, information can be reduced compared to specifying the position range by specifying two latitudes and two longitudes. However, as long as the amount of information can be reduced, the position range may be specified by other methods without being limited to the method shown here.

  The OTP issuing unit 113 acquires a service number from the reader unit 111, issues an OTP based on the time acquired from the GPS unit 112 and the service number, and passes this OTP to the reader unit 111. The OTP issuing unit 113 has the OTP table shown in FIG. 3 determined by the service number and time, and issues the OTP from this table.

  If the OTP issuing unit 113 and the reader unit 111 are separate from each other, the reader unit 111 displays an information word and inputs the information word to the OTP issuing unit 113 to thereby display the OTP issuing unit. 113 issues a one-time password. As the information word, for example, a combination of a unique ID number added to the information asset and a letter and a number obtained by compressing the unique number, position information, and time information of the reader unit 111 are used.

Next, an example of the operation of the information management system will be described with reference to FIG.
The reader unit 111 inputs the user ID and password to the information management unit 101 and logs into the information management unit 101 (step S501). Further, the reader unit 111 designates desired information to the information management unit 101 and accesses the packet 200 containing this information from the information management unit 101 (step S502-1) or downloads the packet 200. Obtain (step S502). In this example, a case where the reader unit 111 downloads the packet 200 will be described. However, the process for accessing the packet 200 is essentially the same as the process for downloading the packet 200 and does not affect the contents of the present invention.

  The GPS unit 112 acquires the position information of the portable device 110, and further acquires the time when the position information is acquired (step S503).

  The reader unit 111 decodes the restriction information with reference to the readable unit 201 of the packet 200 (step S504). Further, the reader unit 111 calculates a checksum corresponding to the packet 200. When the restriction information includes a restriction that the header part 202 and the information part 203 of the packet 200 are encrypted, the process proceeds to step S507, and when the header part 202 and the information part 203 of the packet 200 are not encrypted. Advances to step S506 (step S505). In step S506, since the packet 200 is not encrypted, the information included in the information unit 203 can be read (step S506).

  In step S507, the reader unit 111 calculates the position information and time acquired in step S503, the management number included in the readable unit 201, the unique number of the mobile device 110, and the checksum calculated by the reader unit 111 based on the packet 200. The information is transmitted to the information server device 100 (step S507). If the information server apparatus 100 and the portable device 110 set the same algorithm for generating an OTP and synchronize the time between these apparatuses, it is not necessary to transmit the time in step S507.

  In the information server device 100, the authentication service unit 102 acquires the information transmitted in step S507, and authenticates the portable device 110 based on the information (step S508). If the authentication is successful, the process proceeds to step S511, and if the authentication is not successful, the process proceeds to step S510 (step S509). In step S510, the authentication service unit 102 issues an alarm to the administrator of the information server device 100 to call attention. In step S511, the authentication service unit 102 transmits the pass code α that encrypts the header part 202 of the packet 200 downloaded in step S502 to the portable device 110 (step S510).

  The reader unit 111 of the portable device 110 decrypts the header unit 202 with the passcode α acquired in step S510, and acquires a service number corresponding to the packet 200 (step S512). The reader unit 111 passes the service number acquired in step S512 to the OTP issuing unit 113, and the OTP issuing unit 113 issues an OTP (de) corresponding to the service number and the time acquired in step S503 (step S513). The unit 111 acquires the OTP (de) from the OTP issuing unit 113 and transmits it to the authentication service unit 102 (step S515). In the information server device 100, if the authentication in step S509 is successful, then the authentication service unit 102 issues an OTP (service) corresponding to the service number of the packet 200 downloaded in step S502 and the time acquired in step S507. (Step S514).

  The authentication service unit 102 compares the OTP (S) with the OTP (D) acquired in Step S515. If the OTP (S) and the OTP (D) are the same, the authentication service unit 102 proceeds to Step S518. If OTP (de) is not the same, the process proceeds to step S517 (step S516). In step S517, since the portable device 110 has not issued the OTP issued by the information server apparatus 100, the portable device 110 refuses to read the information included in the packet downloaded in step S502 as not being a reliable partner. Then, the process proceeds to step S510 (step S517). In step S518, the authentication service unit 102 encrypts the passcode β with the same OTP as OTP (service) and OTP (de) (step S518).

  The authentication service unit 102 transmits the passcode β encrypted in step S518 to the portable device 110 (step S519). The reader unit 111 acquires the encrypted passcode β in step S519, and decrypts the encrypted passcode β with OTP (de) (step S520). The reader unit 111 decrypts the information unit 203 with the decrypted passcode β and reads desired information (step S521).

Next, OTP issuance in the case where there are a plurality of information server devices 100 and a plurality of portable devices 110 will be described with reference to FIGS.
As shown in FIG. 6, the OTP issuing unit 113 of the mobile device 110 stores data including an information server device ID, a CID (communication identifier), and an OTP seed as many as the number of information server devices with which the user is affiliated. Storing. These CID and OTP seed are determined for each user (that is, for each portable device 110). That is, generally, even in the same information server device, the CID and the OTP seed are different depending on the user. Therefore, the one-time password generated from the CID and the OTP seed is excellent in safety and can communicate with a correct partner on the network.

  The key data stored in the OTP issuing unit 113 is the same as the number of affiliated information server devices, but there are, for example, about 100 cases, and the provider ID and CID are each indicated by 8 digits, for example. For example, it has 256 bits. In this case, the OTP issuing unit 113 stores about 4000 bytes of data.

  The OTP issuing unit 113 inputs the time of occurrence and the OTP seed corresponding to the information server device 100 input by the user among the stored OTP seeds, and generates a numerical value from this time and the OTP seed. . This numerical value is generated using, for example, a hash function. The hash function (for example, SHA-256) of the OTP issuing unit 113 inputs, for example, 32-bit data as a time and 256-bit data as an OTP seed, and outputs a 256-bit numerical value. The OTP issuing unit 113 outputs a part of the numerical value (for example, 20 bits) obtained by the hash function as a one-time password.

  The OTP seed related to the information server device 100 among the key data stored in the OTP issuing unit 113 of the portable device 110 is the OTP seed stored in the authentication service unit 102 of the information server device 100. It is set so as to match the OTP seed corresponding to this user. For example, when the user performs usage registration for each corresponding information server device 100, the user's CID and one-time password are transmitted to the information server device 100. Further, the key management company mails the key data to the user and the information server device 100 in advance, and the user copies the key data to the OTP issuing unit 113 of the portable device 110. In addition, the portable device 110 may download the key data from the information server device 100 using a communication line with excellent confidentiality or a communication technology with excellent confidentiality.

  As shown in FIG. 7, the authentication service unit 102 of the information server device 100 stores key data for each information server device. The key data for each information server device is a set of a CID of a registered user and an OTP seed that is a sequence for generating a one-time password corresponding to the CID. Multiple sets are stored. The CID and OTP seed stored in the authentication service unit 102 are all different for each set. The OTP seed related to the corresponding information server device among the key data stored in the OTP issuing unit 113 of the one-time password device is the OTP seed of the corresponding user among the OTP seeds stored in the authentication service unit 102. It matches.

  The authentication service unit 102 of the information server device 100 stores, for each information server device 100, data having a set of CID and OTP seed as many as the number of users. These CID and OTP seed are determined for each user. That is, generally, even in the same information server device 100, the CID and the OTP seed are different depending on the user. Therefore, the one-time password generated from the CID and the OTP seed is excellent in safety and can communicate with a correct partner on the network.

  The number of key data stored in the information server apparatus 100 is the same as the number of registered mobile devices 110, but there are about 10 million cases, for example, the CID is shown by 8 digits, for example, and the OTP seed has 256 bits, for example. ing. In this case, the authentication service unit 102 stores about 360 million bytes of data per information server device.

  According to the embodiment described above, since the log of portable device information that can be recognized on the information server device side is left, it is possible to grasp who is trying to read this information even when the information is leaked. it can. Even if information is leaked, you can know who is trying to read this information.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 100 ... Information server apparatus, 101 ... Information management part, 102 ... Authentication service part, 103 ... Authentication log database, 110 ... Portable device, 111 ... Reader part, 112 ... GPS unit, 113... OTP issuing unit, 120... Internet or mobile network, 200... Packet, 201.

Claims (18)

A device for reading desired information from an information server device storing a plurality of information,
A specifying means for logging in to the information server device and specifying desired information;
First acquisition means for acquiring position information and time information of the device itself;
The information server apparatus authenticates whether the device may read the desired information according to the unique number of the own device, the management number of the desired information, the position information, and the time information. And a second acquisition means for acquiring a service number corresponding to a number sequence for generating a one-time password when it is authenticated that the desired information may be read;
OTP issuing means for issuing a first one-time password that is a numerical value corresponding to the service number and the time information;
A first pass code for reading the desired information when it is determined that the second one-time password issued by the information server device and the first one-time password match, and the matching one-time password Third acquisition means for acquiring a first passcode encrypted by a password;
Decryption means for decrypting the encrypted first passcode with the first one-time password;
Reading means for reading the desired information by the decrypted first pass code,
The information server device is configured to detect whether the second one-time password matches the first one-time password when the device is about to log in, when the device is authenticated, A device that records information on the device that can be recognized by the information server device as a log. The desired information is included in a first part of a packet which is a management unit in the information server device, and the first part is encrypted with the first passcode,
The device according to claim 1, wherein the third acquisition unit acquires the encrypted first passcode from the information server device. The service number is included in a second part of a packet that is a management unit in the information server device, and the second part is encrypted with a second passcode,
The said 2nd acquisition means receives the said 2nd passcode from the said information server apparatus, decodes the said 2nd part with this 2nd passcode, and acquires the said service number, The Claim 1 or Claim characterized by the above-mentioned. Item 3. The device according to Item 2.   The information server device authenticates that the desired information may be read when the position of the device is within a predetermined position range, and the second acquisition unit acquires the service number. The device according to any one of claims 1 to 3. A device for generating a one-time password used for reading desired information of an information server device,
And server information of the information server apparatus, the server and the seed is a sequence for generating a one-time password corresponding to the server information, in association with a a pair, the pair only a plurality of information server apparatus min store, the server information and the seeds and all different storage means for each set,
A specifying means for logging in to the information server device and specifying desired information;
First acquisition means for acquiring position information and time information of the device itself;
The information server apparatus authenticates whether the device may read the desired information according to the unique number of the own device, the management number of the desired information, the position information, and the time information. receiving a second acquisition means for acquiring a first server information of the information server apparatus when said authenticated the desired information may be read,
And OTP issuing means for issuing a first correspondence seed and the first one-time password is a numeric value corresponding to said time information corresponding to the first server information,
A first pass code for reading the desired information when it is determined that the second one-time password issued by the information server device and the first one-time password match, and the matching one-time password Third acquisition means for acquiring a first passcode encrypted by a password;
Decryption means for decrypting the encrypted first passcode with the first one-time password;
Reading means for reading the desired information by the decrypted first pass code,
The information server device associates a unique number of a device with a seed that is a sequence for generating a one-time password corresponding to the unique number of the device into one set, and stores a plurality of the sets, The second one-time password corresponds to the time information and a second corresponding seed corresponding to the unique number of the device,
The information server device is configured to detect whether the second one-time password matches the first one-time password when the device is about to log in, when the device is authenticated, A device that records information on the device that can be recognized by the information server device as a log.   If the information server device is not authenticated that the desired information may be read, or if it is detected that the second one-time password and the first one-time password do not match, it takes a log and issues an alarm. The device according to claim 1, wherein the device emits light. Each of the plurality of information is included in one packet,
The device according to claim 1, wherein the specifying unit downloads a packet including the desired information. Each of the plurality of information is included in one packet,
The device according to claim 1, wherein the specifying unit accesses a packet including the desired information. A storage means for storing a plurality of information;
Whether or not the device may read the desired information according to the unique number of the device, the management number of the desired information specified by the device, the position information of the device, and the time information of the device An authentication means for authenticating
Transmitting means for transmitting to the device a service number corresponding to a number sequence for generating a one-time password when it is authenticated that the desired information may be read;
An OTP issuing means for issuing a second one-time password which is a numerical value corresponding to the service number and the time information;
Determining means for determining whether or not the first one-time password issued by the device matches the second one-time password;
An encryption means for encrypting a first passcode for reading the desired information with the matched one-time password when it is determined that the first one-time password and the second one-time password match; ,
When the device attempts to log in, when the device is authenticated, when it is determined whether the first one-time password and the second one-time password match, the information server apparatus logs Recording means for recording information on the device that can be recognized,
The information server device, wherein the device decrypts the encrypted first passcode with the first one-time password and reads the desired information with the decrypted first passcode. The desired information is included in a first part of a packet which is a management unit in the information server device, and the first part is encrypted with the first passcode,
The information server apparatus according to claim 9, wherein the encrypted first passcode is transmitted to the device. The service number is included in a second part of a packet that is a management unit in the information server device, and the second part is encrypted with a second passcode,
The said 2nd passcode is transmitted to the said device, The said device decodes the said 2nd part with this 2nd passcode, and acquires the said service number, The Claim 10 characterized by the above-mentioned. Information server device.   10. The authentication unit authenticates that the desired information may be read when the position of the device is within a predetermined position range, and the device acquires the service number. The information server device according to claim 11. A storage means for storing a plurality of information;
Whether or not the device may read the desired information according to the unique number of the device, the management number of the desired information specified by the device, the position information of the device, and the time information of the device An authentication means for authenticating
Transmitting means for transmitting the first server information of the own server device to the device when it is authenticated that the desired information may be read;
A unique number of a device and a seed that is a sequence for generating a one-time password corresponding to the unique number of the device are associated with one set, and a plurality of such sets are stored, and the unique number of the device and the seed Are different second storage means for each set,
OTP generation means for generating a second one-time password corresponding to the time information and a second corresponding seed corresponding to the unique number of the device;
Determining means for determining whether the first one-time password and the second one-time password match;
An encryption means for encrypting a first passcode for reading the desired information with the matched one-time password when it is determined that the first one-time password and the second one-time password match; ,
When the device attempts to log in, when the device is authenticated, when it is determined whether the first one-time password and the second one-time password match, the information server apparatus logs Recording means for recording information on the device that can be recognized,
The device, and server information of the information server apparatus, and the seed is a sequence for generating a one-time password corresponding to the server information, a set in association with the information of the set plurality of containing only the server component, the server information and the seed all different for each set, the first one-time password, and the time information, it corresponds to the first corresponding seed that corresponds to the server information And
The information server device, wherein the device decrypts the encrypted first passcode with the first one-time password and reads the desired information with the decrypted first passcode.   The recording means logs and issues an alarm when it is not authenticated that the desired information may be read, or when it is detected that the second one-time password does not match the first one-time password. The information server device according to any one of claims 9 to 13, wherein the information server device is a device. The storage means stores the plurality of pieces of information so as to be included in one packet,
15. The information server apparatus according to claim 9, wherein the device downloads a packet including the desired information. The storage means stores the plurality of pieces of information so as to be included in one packet,
15. The information server apparatus according to claim 9, wherein the device accesses a packet including the desired information. An information management system comprising an information server device and a device for reading desired information from the information server device,
The device is
A specifying means for logging in to the information server device and specifying desired information;
First acquisition means for acquiring position information and time information of the device itself,
The information server device
A storage means for storing a plurality of information;
Whether or not the device may read the desired information according to the unique number of the device, the management number of the desired information specified by the device, the position information of the device, and the time information of the device An authentication means for authenticating
Transmitting means for transmitting to the device a service number corresponding to a number sequence for generating a one-time password when it is authenticated that the desired information may be read;
OTP issuing means for issuing a second one-time password that is a numerical value corresponding to the service number and the time information,
The device further comprises:
Second acquisition means for acquiring the service number;
OTP issuing means for issuing a first one-time password that is a numerical value corresponding to the service number and the time information,
The information server device further includes:
Determination means for determining whether or not the first one-time password matches the second one-time password;
An encryption means for encrypting a first passcode for reading the desired information with the matched one-time password when it is determined that the first one-time password and the second one-time password match; ,
When the device attempts to log in, when the device is authenticated, when it is determined whether the first one-time password and the second one-time password match, the information server apparatus logs Recording means for recording information on the device that can be recognized,
The device further comprises:
Third acquisition means for acquiring the encrypted first passcode;
Decryption means for decrypting the encrypted first passcode with the first one-time password;
Reading means for reading the desired information by the decrypted first pass code. An information management system comprising an information server device and a device for reading desired information from the information server device,
The device is
And server information of the information server apparatus, the server and the seed is a sequence for generating a one-time password corresponding to the server information, in association with a a pair, the pair only a plurality of information server apparatus min store, the server information and the seeds and all different storage means for each set,
A specifying means for logging in to the information server device and specifying desired information;
First acquisition means for acquiring position information and time information of the device itself,
The information server device
A storage means for storing a plurality of information;
Whether or not the device may read the desired information according to the unique number of the device, the management number of the desired information specified by the device, the position information of the device, and the time information of the device An authentication means for authenticating
Transmitting means for transmitting the first server information of the own server device to the device when it is authenticated that the desired information may be read;
A unique number of the device, in association with, and seed is a sequence for generating a one-time password corresponding to the ID number of the device as a pair, the pairs a plurality stored unique number and seed of the device Different second storage means for each set;
OTP generating means for generating a second one-time password corresponding to the time information and a second corresponding seed corresponding to the unique number of the device,
The device further comprises:
Anda OTP issuing means for issuing a first one-time password is a numeric value corresponding to the first correspondence seed and said time information corresponding to the first server information,
The information server device further includes a determination unit that determines whether or not the first one-time password and the second one-time password match.
An encryption means for encrypting a first passcode for reading the desired information with the matched one-time password when it is determined that the first one-time password and the second one-time password match; ,
When the device attempts to log in, when the device is authenticated, when it is determined whether the first one-time password and the second one-time password match, the information server apparatus logs Recording means for recording information on the device that can be recognized,
The device further includes third acquisition means for acquiring the encrypted first passcode;
Decryption means for decrypting the encrypted first passcode with the first one-time password;
Reading means for reading the desired information by the decrypted first pass code.

Images