JP6360854B2 - Beacon device authentication system, portable terminal device, beacon device, beacon device installation system, beacon device authentication method, beacon device installation method, beacon device authentication program, and beacon device installation program - Google Patents

Description

  The present invention relates to a beacon device authentication system, a mobile terminal device, a beacon device, a beacon device installation system, a beacon device authentication method, a beacon device installation method, a beacon device authentication program, and a beacon device installation program.

  In recent years, many services have been provided that use a GPS (global positioning system) function provided in a smartphone or the like to detect a user's current position and present information according to the detected position. On the other hand, the GPS function cannot be used in subway platforms, underground malls, buildings, etc. where GPS signals do not reach, and in such places, it is used by receiving beacon signals transmitted from beacon devices placed in various places. A technology has been developed that identifies the current location of a person and presents information such as advertisements and directions.

  However, since the beacon device that transmits the beacon signal is small and lightweight and can be carried, when the user is moved from the original installation location, the user cannot grasp the fact, There was a problem of receiving incorrect location information. In order to solve such a problem, the movable distance of the user terminal is calculated from the latest position information (latitude, longitude, etc.) acquired by the GPS function and the time when the position information is acquired, and corresponds to the identifier included in the beacon signal A technique for determining whether a beacon is a valid beacon depending on whether the installation location information to be included is included in the movable range is disclosed (see Patent Document 1).

JP2016-046651A

  However, in the technology described in the above-mentioned publication, even if a beacon device is installed for an improper purpose such as impersonation if the beacon device is arranged in the movable range from the latest position information, There is a problem that even if it is moved, it may be determined as a valid beacon device.

  In addition, there is a problem that it is difficult to determine a beacon device belonging to the company's system from beacon devices of other companies existing within the movable range, even if the beacon device is not installed for an unauthorized purpose.

  The present invention has been made in view of the above, and a beacon device authentication system, a mobile terminal device, a beacon device, a beacon device installation system, a beacon device authentication method, and a beacon device installation that can authenticate the validity of a beacon device. It is an object to provide a method, a beacon device authentication program, and a beacon device installation program.

In order to solve the above-described problem, in the present invention, a beacon signal transmitted from a beacon device is received, an electronic certificate is acquired from the received beacon signal, and the electronic certificate is revoked in the certificate authority server. When a request for a revocation list indicating whether or not an electronic certificate has been revoked is determined based on the revocation list transmitted from the certificate authority server , and the electronic certificate has not been revoked A value obtained by decrypting an electronic signature obtained by encrypting a hash value of position information included in the beacon signal with a public key included in the electronic certificate, and a hash value calculated from the position information included in the beacon signal. When it is determined whether or not the location information is matched, and it is determined that the location information has been verified, the location information is transmitted to the application server connected via the network, and the application Transmitting from over server, and outputs the presentation information associated with the position information.

Further, in another aspect of the present invention, an electronic certificate storage means for storing an electronic certificate issued by a certificate authority and a private key indicating that the beacon apparatus has been authenticated by the certificate authority. A beacon information storage means for storing the position information of the beacon device, and an electronic device in which a hash value of the position information is encrypted with a position information stored in the beacon information storage means and a secret key stored in the electronic certificate storage means A beacon signal including a signature and an electronic certificate is transmitted .

  In another aspect of the present invention, the beacon device transmits beacon identification information for identifying the beacon device to the information terminal device, and the information terminal device transmits the beacon identification information transmitted from the beacon device to the certificate authority server. The certificate authority server generates a private key and a public key related to the beacon identification information, generates an electronic certificate electronically signed to the public key, stores the electronic certificate in the issued electronic certificate information storage unit, The certificate and private key are transmitted to the information terminal device, the information terminal device transmits the received electronic certificate and private key to the beacon device, and the beacon device receives the electronic certificate and private key and receives the received electronic certificate. A certificate and a private key are stored in an electronic certificate storage unit.

  In another aspect of the present invention, the beacon device generates a secret key and a public key, transmits the generated public key to the information terminal device, and the information terminal device transmits the public key transmitted from the beacon device to the certificate authority. The certificate authority server generates an electronic certificate electronically signed with the public key, stores the generated electronic certificate in the issued electronic certificate storage unit, and transmits the electronic certificate to the information terminal device. The information terminal device transmits an electronic certificate transmitted from the certificate authority server to the beacon device, and the beacon device stores the received electronic certificate and private key in the electronic certificate storage unit.

  According to this invention comprised as mentioned above, there exists an effect that the correctness of a beacon apparatus can be authenticated.

It is explanatory drawing which shows the outline | summary of the beacon apparatus authentication system 10 concerning Example 1. FIG. It is a block diagram which shows the structural example of the beacon apparatus authentication system 10 concerning Example 1. FIG. 4 is an explanatory diagram illustrating an example of a data configuration of an issued electronic certificate storage unit 110. FIG. It is explanatory drawing which shows an example of the data structure of the beacon signal transmitted from the beacon apparatus. 6 is an explanatory diagram illustrating an example of a data configuration of a presentation information storage unit 410. It is a flowchart which shows the beacon apparatus authentication processing procedure which the certificate authority server 100, the portable terminal device 200, the beacon apparatus 300, and the application server 400 perform. It is a block diagram which shows the structural example of the beacon apparatus installation system 20 concerning Example 2. FIG. It is a flowchart which shows the beacon apparatus installation processing procedure which the certification authority server 500, the information terminal device 600, and the beacon apparatus 300 perform. It is a block diagram which shows the structural example of the beacon apparatus installation system 30 concerning Example 3. FIG. It is a flowchart which shows the beacon apparatus installation processing procedure which the certification authority server 500, the information terminal device 600, and the beacon apparatus 700 perform.

  Embodiments of the present invention will be described below with reference to the accompanying drawings. In addition, the following description is an example of embodiment and this invention is not limited to these Examples.

  FIG. 1 is an explanatory diagram illustrating an outline of the beacon device authentication system 10 according to the first embodiment. As shown in FIG. 1, the beacon device authentication system 10 includes a certificate authority server 100, a mobile terminal device 200, beacon devices 300-1 to 300-n, and an application server 400. Since the mobile terminal device 200 carried by the user 1 exists in the communication area 2 of the beacon device 300-3, the mobile terminal device 200 receives the beacon signal transmitted from the beacon device 300-3. Since the current position of the mobile terminal device 200 is also within the communication area of the beacon device X, the mobile terminal device 200 receives a beacon signal transmitted from the beacon device X.

  The mobile terminal device 200 determines whether or not the beacon device that transmitted the beacon signal is valid based on whether or not the electronic certificate transmitted by the beacon signal of the beacon device 300 has expired. When the mobile terminal device 200 determines that the beacon device is valid, the mobile terminal device 200 acquires position information from the beacon signal. The certificate authority server 100 transmits a revocation list for determining whether or not the electronic certificate has been revoked to the mobile terminal device 200. The application server 400 transmits presentation information corresponding to the position information to the mobile terminal device 200. The mobile terminal device 200 is, for example, a smartphone, a mobile phone, a tablet terminal, a notebook PC, or the like, and may be any information processing device that can receive a beacon signal.

  FIG. 2 is a block diagram of a configuration example of the beacon device authentication system 10 according to the first embodiment. The certificate authority server 100, the mobile terminal device 200, and the application server 400 are connected to each other via a network N so that they can communicate with each other. The network N is a communication network such as the Internet, an intranet, a LAN (Local Area Network), and a mobile communication network.

  The mobile terminal device 200 and the beacon device 300 are connected so as to be able to communicate with each other by short-range wireless communication. The short-range wireless communication system includes Bluetooth (registered trademark), Wi-Fi (registered trademark) and other wireless LANs (IEEE 802.11), ZigBee (registered trademark), infrared communication, visible light communication, NFC (Near Field Communication), Any specific low power wireless communication (920 MHz) or any other wireless communication method may be used.

  Next, the configurations and functions of the certificate authority server 100, the mobile terminal device 200, the beacon device 300, and the application server 400 provided in the beacon device authentication system 10 will be described.

  The certificate authority server 100 includes a transmission / reception unit 101, an issued electronic certificate storage unit 110, and a revocation list storage unit 120.

  FIG. 3 is an explanatory diagram illustrating an example of a data configuration of the issued electronic certificate storage unit 110. The issued electronic certificate storage unit 110 stores an electronic certificate issued by the certificate authority server 100. The electronic certificate is the same as the electronic certificate held by each of the beacon devices 300, and electronic certificate identification information (for example, serial number) for identifying each electronic certificate is described in the electronic certificate. .

  The revocation list storage unit 120 stores a revocation list indicating a revoked electronic certificate. Specifically, the revocation list stores information that uniquely identifies a revoked electronic certificate, that is, a serial number of the electronic certificate.

  The transmission / reception unit 101 transmits / receives data to / from the mobile terminal device 200. Specifically, the transmission / reception unit 101 receives a revocation list request transmitted from the mobile terminal device 200 and transmits the revocation list stored in the revocation list storage unit 120 to the mobile terminal device 200.

  Next, the beacon device 300 will be described. The beacon device 300 is installed at an installation location planned in advance by a beacon device installation system described later, and transmits a beacon signal from the installation location. The beacon signal transmitted from the beacon device 300 is received by the mobile terminal device 200 existing in the communication area.

  The beacon device 300 includes a short-range wireless communication unit 301, an electronic signature unit 302, an electronic certificate storage unit 310, and a beacon information storage unit 320.

  The electronic certificate storage unit 310 stores an electronic certificate that has been electronically signed with the private key of the beacon device 300 itself and the public key that is paired with the private key. The electronic certificate is an electronic certificate issued by a certificate authority indicating that the beacon device 300 itself has been authenticated by the certificate authority (the certificate authority server 100).

  The beacon information storage unit 320 stores information regarding the beacon device 300. The information regarding the beacon device 300 includes beacon identification information, position information, and the like of the beacon device 300. Here, the beacon identification information is information that uniquely identifies the beacon device 300. The position information is information related to the installation location of the beacon device 300. For example, latitude, longitude, height from the ground surface (or floor surface), and in addition to or instead of “Toei Namboku Line Roppongi 1-chome The name of the installation location such as “ticket gate” may be used.

  The short-range wireless communication unit 301 transmits / receives a beacon signal and establishes communication with the mobile terminal device 200 that has received the beacon signal. The short-range wireless communication unit 301 transmits position information and the like to the mobile terminal device 200 using a beacon signal.

  FIG. 4 is an explanatory diagram illustrating an example of a data configuration of a beacon signal transmitted from the beacon device 300. The beacon signal including the position information includes position information (plain text), an electronic signature, and an electronic certificate. The electronic signature is obtained by encrypting a hash value generated from position information (plain text) using a hash function with a secret key held by the beacon device 300. The electronic certificate includes a public key corresponding to the private key and an electronic signature made by the certificate authority server 100 for the public key.

  The electronic signature unit 302 electronically signs the position information stored in the beacon information storage unit 320 with the private key of the beacon device 300 itself stored in the electronic certificate storage unit 310.

  Next, the mobile terminal device 200 will be described. The mobile terminal device 200 includes a short-range wireless communication unit 201, a transmission / reception unit 202, a beacon device authentication unit 203, an electronic signature verification unit 204, and an information presentation unit 205.

  The short-range wireless communication unit 201 transmits and receives beacon signals. The short-range wireless communication unit 201 receives a beacon signal transmitted by the beacon device 300 and transmits a beacon signal. The short-range wireless communication unit 201 acquires the beacon identification information of the beacon device 300 from the beacon signal transmitted by the beacon device 300.

  The transmission / reception unit 202 transmits / receives data to / from the certificate authority server 100 and the application server 400. Specifically, the transmission / reception unit 201 transmits a revocation list request to the certificate authority server 100 and receives the revocation list. The transmission / reception unit 201 transmits position information to the application server 400 and receives presentation information corresponding to the position information.

  The beacon device authentication unit 203 determines whether or not the beacon device 300 that has received the beacon signal is a valid beacon device. Here, the legitimate beacon device is a beacon managed by the beacon device authentication system 10 and a beacon device determined not to be moved or taken away from the installation location. More specifically, the beacon device authentication unit 203 determines whether the electronic certificate held by the beacon device 300 that transmitted the beacon signal has been revoked based on the revocation list transmitted from the certificate authority server 100. It is determined whether the beacon device is valid.

  The electronic signature verification unit 204 verifies the location information transmitted from the beacon device 300 and signed with the electronic signature. More specifically, the electronic signature verification unit 204 compares the hash value calculated from the position information with the hash value obtained by decrypting the electronic signature using the public key included in the electronic certificate to determine whether or not they match. To verify.

  The information output unit 205 outputs presentation information transmitted from the application server 400. Here, the presentation information is, for example, characters, images, sounds, moving images, vibrations, light, etc., and may be any information as long as it can be perceived by the user and output by the mobile terminal device 200. The information output unit 205 is specifically a display device that displays characters, images, and moving images, a speaker that outputs sound, a vibrator that outputs vibration, a light that outputs light, and the like.

  Next, the application server 400 will be described. The application server 400 includes a transmission / reception unit 401 and a presentation information storage unit 410.

  FIG. 5 is an explanatory diagram illustrating an example of a data configuration of the presentation information storage unit 410. The presentation information storage unit 410 stores presentation information corresponding to position information. The presentation information storage unit 410 stores position information, attribute information, and presentation information in association with each other.

  Here, the attribute information is information indicating the attribute of the user, for example, information that is referred to when presentation information such as use of a cane, use of a wheelchair, visual impairment, hearing impairment, male, female, or the like is changed. Note that the number of attributes is not limited to one, and the presentation information may be associated by combining a plurality of attributes or excluding some attributes.

  The presentation information is information output by the mobile terminal device 200, and is, as described above, characters, images, sounds, moving images, vibrations, light, and the like. For example, a voice such as “Men's toilet is 20 meters ahead on the right side” or a map image showing location information. In addition, the presentation information may be changed according to a predetermined condition, and may be switched to information instructing an evacuation route in an emergency such as an earthquake.

  The transmission / reception unit 401 transmits / receives data to / from the mobile terminal device 200. Specifically, the transmission / reception unit 401 receives position information from the mobile terminal device 200 and transmits presentation information corresponding to the position information to the mobile terminal device 200.

  A beacon device authentication process executed by the beacon device authentication system 10 configured as described above will be described. FIG. 6 is a flowchart showing a beacon device authentication processing procedure executed by the certificate authority server 100, the mobile terminal device 200, the beacon device 300, and the application server 400.

  The short-range wireless communication unit 301 of the beacon device 300 transmits a beacon signal (step S601). The beacon signal may be transmitted at regular intervals in order to keep the battery for a long time. The short-range wireless communication unit 201 of the mobile terminal device 200 determines whether a beacon signal has been detected (step S602). If it is determined that a beacon signal is not detected (step S602: No), step S602 is repeated. If it is determined that a beacon signal has been detected (step S602: Yes), communication is established with the beacon device 300 that has transmitted the beacon signal (step S603).

  The short-range wireless communication unit 301 of the beacon device 300 transmits a beacon signal including the location information with the electronic signature to the mobile terminal device 200 (step S604). The wireless communication unit 201 of the mobile terminal device 200 receives a beacon signal including the location information that has been digitally signed (step S605).

  The short-range wireless communication unit 201 acquires an electronic certificate from the beacon signal (step S606). The beacon device authentication unit 203 determines whether an electronic certificate is included in the beacon signal (step S607). If it is determined that an electronic certificate is not included in the beacon signal (step S607: No), since the beacon device does not have an electronic certificate, it is determined that the beacon device is not valid, and the process ends. If it is determined that the beacon signal includes an electronic certificate (step S607: Yes), the transmission / reception unit 202 transmits a request for a revocation list to the certificate authority server 100 (step S608).

  The transmission / reception unit 101 of the certificate authority server 100 receives the request for the revocation list, and acquires the revocation list stored in the revocation list storage unit 120 (step S609). The transmission / reception unit 101 transmits the revocation list to the mobile terminal device 200 (step S610).

  The transmission / reception unit 202 of the mobile terminal device 200 receives the revocation list. The beacon device authentication unit 203 determines whether or not the electronic certificate has been revoked using the revocation list (step S611). More specifically, it is confirmed whether the serial number described in the electronic certificate is not described in the revocation list. If it is determined that the electronic certificate has expired (step S611: Yes), it is determined that the beacon device is not valid, and the process ends.

  If it is determined that the electronic certificate has not expired (step S611: No), the electronic signature verification unit 204 determines whether the position information has been verified (step S612). Specifically, it is determined whether or not the hash value generated from the position information matches the value decrypted with the public key included in the electronic certificate. If it is determined that the position information cannot be verified (step S612: No), it is determined that the position information has been tampered with, and the process ends. When it is determined that the position information has been verified (step S612: Yes), the transmission / reception unit 202 transmits the position information to the application server 400 (step S613).

  The transmission / reception unit 401 of the application server 400 receives the position information, and acquires the presentation information associated with the position information from the presentation information storage unit 410 (step S614). In addition, when the user's attribute information is received together with the position information from the mobile terminal device 200, the presentation information associated with the position information and the attribute information is acquired. The transmission / reception unit 401 transmits the presentation information to the mobile terminal device 200 (step S615).

  The transmission / reception unit 202 of the mobile terminal device 200 receives the presentation information, and the information output unit 205 outputs the received presentation information (step S616).

  Thus, when acquiring position information from the beacon signal received from the beacon device, it is confirmed that the electronic certificate is attached and whether the electronic certificate has expired from the certificate authority server 100. In order to check the revocation list to be transmitted and further verify the digital signature of the location information, spoofing of the beacon device, the beacon device moved from the original installation location, and presentation information based on the altered location information can be output The user can receive the presentation information based on the position information transmitted only from the legitimate beacon device.

  Next, as Example 2, processing for storing an electronic certificate in a beacon device when the beacon device is installed at an installation location will be described with reference to the accompanying drawings. The beacon installation process according to the second embodiment will be described with a focus on differences from the first embodiment.

  FIG. 7 is a block diagram of a configuration example of the beacon device installation system 20 according to the second embodiment. The beacon device installation system 20 includes a certificate authority server 500, an information terminal device 600, and a beacon device 300. In addition, the same number is attached | subjected about the part which has the same function as Example 1, and description here is abbreviate | omitted.

  The certificate authority server 500 includes a transmission / reception unit 101, an electronic signature verification unit 502, a key generation unit 503, an electronic signature unit 504, an issued electronic certificate storage unit 110, and a revocation list storage unit 120.

  The electronic signature verification unit 502 verifies the digitally signed beacon identification information transmitted from the information terminal device 600. More specifically, the electronic signature verification unit 502 compares and verifies the hash value of the beacon identification information with the hash value generated using the public key included in the electronic certificate of the information terminal device 600.

  The key generation unit 503 generates a secret key corresponding to the beacon identification information of the beacon device 300 and a publication key. The electronic signature unit 504 electronically signs the public key generated by the key generation unit 503 with the private key of the certificate authority server 500 to generate an electronic certificate. The electronic signature unit 504 stores the generated electronic certificate in the issued electronic certificate storage unit 110.

  The information terminal apparatus 600 includes a short-range wireless communication unit 601, a transmission / reception unit 602, an electronic signature unit 603, a terminal verification unit 604, an electronic signature verification unit 605, and an electronic certificate storage unit 610.

  The electronic certificate storage unit 610 stores the electronic certificate digitally signed by the certificate authority server 500 in the private key of the information terminal device 600 itself and the public key corresponding to the private key.

  The short-range wireless communication unit 601 transmits and receives beacon signals. The short-range wireless communication unit 601 receives a beacon signal transmitted by the beacon device 300 and transmits a beacon signal. The short-range wireless communication unit 601 receives beacon identification information transmitted from the beacon device 300. The short-range wireless communication unit 601 transmits the electronic certificate and the private key received from the certificate authority server 500 to the beacon device 300.

  The transmission / reception unit 602 transmits / receives data to / from the certificate authority server 500. Specifically, the transmission / reception unit 602 transmits a revocation list request to the certificate authority server 100 and receives the revocation list. The transmission / reception unit 602 transmits the beacon identification information digitally signed to the certificate authority server 100 and receives the electronic certificate and the private key. The electronic signature unit 603 digitally signs the beacon identification information transmitted from the beacon device 300 with the private key of the information terminal device 600 itself stored in the electronic certificate storage unit 610.

  The terminal verification unit 604 verifies the information terminal device 600 itself based on the revocation list received from the certificate authority server 500. More specifically, the terminal verification unit 604 verifies the electronic certificate of the information terminal device 600 by checking whether the serial number of the electronic certificate of the information terminal device 600 itself is described in the revocation list. The electronic signature verification unit 605 verifies the electronic certificate of the beacon device 300 received from the certificate authority server 500.

  A beacon device installation process executed by the beacon device installation system 20 configured as described above will be described. FIG. 8 is a flowchart showing a beacon device installation processing procedure executed by the certificate authority server 500, the information terminal device 600, and the beacon device 300.

  The short-range wireless communication unit 301 of the beacon device 300 acquires the position information stored in the beacon information storage unit 320 (step S801). The location information is stored in the beacon information storage unit 320 in advance, and when the beacon device 300 is installed, the latitude, longitude, and height of the installation location are measured by the measuring device, and the short-range wireless communication unit from the measuring device You may receive via 301. The short-range wireless communication unit 301 acquires beacon identification information stored in the beacon information storage unit 320 (step S802). The short-range wireless communication unit 301 transmits beacon identification information to the information terminal device 600 (step S803).

  The short-range wireless communication unit 601 of the information terminal device 600 receives the beacon identification information, and the electronic signature unit 603 electronically signs the beacon identification information (step S804). The transmission / reception unit 602 transmits a request for the revocation list to the certificate authority server 500 (step S805).

  The transmission / reception unit 101 of the certificate authority server 500 receives the request for the revocation list and acquires the revocation list stored in the revocation list storage unit 120 (step S806). The transmission / reception unit 101 transmits the revocation list to the information terminal device 600 (step S807).

  The transmission / reception unit 602 of the information terminal device 600 receives the revocation list. The terminal authentication unit 604 determines whether the electronic certificate has not been revoked using the revocation list (step S808). More specifically, it is confirmed whether the serial number described in the electronic certificate of the information terminal device 600 is described in the revocation list. If it is determined that the electronic certificate has expired (step S808: Yes), it is determined that data cannot be transmitted safely from the information terminal device 600, and the process ends.

  If it is determined that the electronic certificate has not expired (step S808: No), the transmission / reception unit 602 transmits the beacon identification information that has been digitally signed to the certificate authority server 500 (step S809).

  The transmitting / receiving unit 101 of the certificate authority server 500 receives the beacon identification information that has been digitally signed, and the electronic signature verification unit 502 verifies the beacon identification information that has been digitally signed (step S810). If the beacon identification information that has been electronically signed cannot be verified (step S810: No), it is determined that the beacon identification information has been tampered with, and the process ends. When the digitally signed beacon identification information can be verified (step S810: Yes), the key generation unit 503 generates a secret key and a public key (step S811). The electronic signature unit 504 electronically signs the public key and generates an electronic certificate (step S812). The electronic signature unit 504 stores the electronic certificate in the issued electronic certificate storage unit 110 (step S813). The transmission / reception unit 101 transmits the electronic certificate and the private key to the information terminal device 600 (step S814).

  The transmission / reception unit 602 of the information terminal device 600 receives the electronic certificate and the private key, and the electronic signature verification unit 605 verifies the received electronic certificate (step S815). If the electronic certificate cannot be verified (step S815: No), the process ends. When the electronic certificate can be verified (step S815: Yes), the short-range wireless communication unit 601 transmits the electronic certificate and the private key to the beacon device 300 (step S816).

  The short-range wireless communication unit 301 of the beacon device 300 receives the electronic certificate and the private key, and stores the received electronic certificate and private key in the electronic certificate storage unit 310 (step S817). The electronic certificate and the private key may be stored in a secret area that cannot be accessed by ordinary means. The electronic signature unit 302 electronically signs the location information with the private key (step S818) and stores it in the electronic certificate storage unit 310.

  In this way, when the beacon device 300 is installed at the installation location, the beacon device 300 itself holds the electronic certificate by receiving the electronic certificate and the private key from the certificate authority server 500 via the information terminal device 600. Therefore, the validity of the beacon device 300 can be confirmed with an electronic certificate. Thereby, the reliability of the beacon signal transmitted from the beacon device 300 can be improved.

  Further, since the beacon device 300 has a secret key and can digitally sign the position information, the beacon apparatus 300 can check whether the position information has been tampered with, and the user can obtain more secure information. be able to. The information transmitted from the beacon signal need not be limited to the position information, and information other than the position information can be safely transmitted to the user.

  Note that the beacon device 300 may have the function of the information terminal device 600 and may be integrated with the information terminal device 600.

  Furthermore, as Example 3, processing for storing an electronic certificate in a beacon device when the beacon device is installed at an installation location will be described with reference to the accompanying drawings. The third embodiment is different from the second embodiment in which the secret key and the public key of the beacon device are generated by the certificate authority server, and the secret key and the public key are generated by the beacon device. Hereinafter, a description will be given focusing on differences from the second embodiment.

  FIG. 9 is a block diagram of a configuration example of the beacon device installation system 30 according to the third embodiment. The beacon device installation system 30 includes a certificate authority server 500, an information terminal device 600, and a beacon device 700. In addition, the same number is attached | subjected about the part which has the same function as Example 1, 2, and description here is abbreviate | omitted.

  The beacon device 700 includes a short-range wireless communication unit 301, an electronic signature unit 302, a key generation unit 703, an electronic certificate storage unit 310, and a beacon information storage unit 320. The key generation unit 703 generates a secret key of the beacon device 700 itself and a publication key.

  A beacon device installation process executed by the beacon device installation system 30 configured as described above will be described. FIG. 10 is a flowchart showing a beacon device installation processing procedure executed by the certificate authority server 500, the information terminal device 600, and the beacon device 700.

  The short-range wireless communication unit 301 of the beacon device 700 acquires position information stored in the beacon information storage unit 320 (step S1001). The key generation unit 703 generates a secret key and a public key (step S1002). The short-range wireless communication unit 301 transmits the public key to the information terminal device 600 (step S1003).

  The short-range wireless communication unit 601 of the information terminal device 600 receives the public key, and the electronic signature unit 603 digitally signs the public key (step S1004). The transmission / reception unit 602 transmits a request for the revocation list to the certificate authority server 500 (step S1005).

  The transmitting / receiving unit 101 of the certificate authority server 500 receives the request for the revocation list, and acquires the revocation list from the revocation list storage unit 120 (step S1006). The transmission / reception unit 101 transmits the revocation list to the information terminal device 600 (step S1007).

  The transmission / reception unit 602 of the information terminal device 600 receives the revocation list. The terminal authentication unit 604 uses the revocation list to determine whether the electronic certificate stored in the electronic certificate storage unit 610 has expired (step S1008). If it is determined that the electronic certificate has expired (step S1008: Yes), it is determined that data cannot be transmitted safely from the information terminal device 600, and the process ends.

  If it is determined that the electronic certificate has not expired (step S1008: No), the transmission / reception unit 602 transmits the public key with the electronic signature to the certificate authority server 500 (step S1009).

  The transmission / reception unit 101 of the certificate authority server 500 receives the public key that has been digitally signed, and the electronic signature verification unit 502 verifies the electronic signature of the public key that has been digitally signed (step S1010). If the electronic signature cannot be verified (step S1010: No), the process ends. If the electronic signature can be verified (step S1010: Yes), the electronic signature unit 504 electronically signs the received public key with the private key held by the certificate authority server 500 and generates an electronic certificate (step S1011). The electronic signature unit 504 stores the electronic certificate in the issued electronic certificate storage unit 110 (step S1012). The transmission / reception unit 101 transmits the electronic certificate to the information terminal device 600 (step S1013).

  The transmission / reception unit 602 of the information terminal device 600 receives the electronic certificate, and the electronic signature verification unit 605 verifies the electronic certificate (step S1014). If the electronic certificate cannot be verified (step S1014: No), the process ends. When the electronic certificate can be verified (step S1014: Yes), the short-range wireless communication unit 601 transmits the electronic certificate to the beacon device 700 (step S1015).

  The short-range wireless communication unit 301 of the beacon device 700 receives the electronic certificate, and stores the received electronic certificate and the private key generated by the key generation unit 703 in the electronic certificate storage unit 310 (step S1016). The electronic signature unit 302 electronically signs the location information with the private key (step S1017) and stores it in the electronic certificate storage unit 310.

  As a result, in addition to producing the effects described in the second embodiment, the secret key is not generated by the beacon device and transmitted to other devices, so there is no possibility of eavesdropping during communication. Reliability can be increased.

  The beacon device 700 may have the function of the information terminal device 600 and may be integrated with the information terminal device 600.

  The communication between the devices may be SSL (Secure Socket Layer) encrypted communication using an electronic certificate.

  The hardware configurations of the certificate authority servers 100 and 500, the mobile terminal device 200, the beacon devices 300 and 700, the allocation server 400, and the information terminal device 600 according to the first to third embodiments described above are a CPU (Central Processing Unit), a ROM (Read Only Memory), RAM (Random Access Memory), HDD (Hard Disk Drive) and other external storage devices, such as a normal computer equipped with a communication control device, and programs stored in ROM, RAM, HDD, etc. The above-described configuration and functions are realized by the CPU performing a read operation.

  Programs operating on the certificate authority servers 100 and 500, the mobile terminal device 200, the beacon devices 300 and 700, the allocation server 400, and the information terminal device 600 are stored on a computer connected to the network N such as the Internet, Provide it by downloading it via the network N, or record it on a computer-readable recording medium such as a CD-ROM, DVD, USB memory, SD card, etc. in an installable or executable format file Also good. Further, the program for realizing the functions and processes described above may be provided in a usage form such as API (Application Programming Interface), SaaS (Software as a Service), or cloud computing.

  Note that the present invention is not limited to the above-described embodiments as they are, and does not necessarily have to be physically configured as illustrated. In addition, the present invention is configured to functionally or physically divide, integrate, replace, modify, or delete all or a part of the constituent elements described in the embodiments in arbitrary units according to various loads or usage conditions. Can be configured.

DESCRIPTION OF SYMBOLS N ... Network, 10 ... Beacon apparatus authentication system, 100, 500 ... Certificate authority server, 101 ... Transmission / reception part, 110 ... Issued electronic certificate storage part, 120 ... Revocation list storage part, 200 ... Portable terminal device, 201 ... Short distance Wireless communication unit 202 ... Transmission / reception unit 203 ... Beacon device authentication unit 204 ... Electronic signature verification unit 205 ... Information output unit 300, 700 ... Beacon device 301 ... Short-range wireless communication unit 302 ... Electronic signature unit 310 ... Electronic certificate storage unit, 320 ... Beacon information storage unit, 400 ... Application server, 401 ... Transmission / reception unit, 410 ... Presentation information storage unit, 502 ... Electronic signature verification unit, 503 ... Key generation unit, 504 ... Electronic signature unit , 600 ... Information terminal device, 601 ... Short-range wireless communication unit, 602 ... Transmission / reception unit, 603 ... Electronic signature unit, 604 ... Terminal verification unit, 6 5 ... electronic signature verification unit, 703 ... key generation unit

Claims (15)

A beacon device authentication system comprising an information terminal device and a certificate authority server connected to the information terminal device via a network,
The information terminal device
Radio communication means for receiving a beacon signal transmitted from a beacon device and obtaining an electronic certificate from the received beacon signal;
First transmission means for transmitting to the certificate authority server a request for a revocation list indicating whether or not the electronic certificate has been revoked,
The certificate authority server is
In response to a request for the revocation list transmitted from the information terminal device, the second transmission means for transmitting the revocation list to the information terminal device,
The information terminal device
Based on the revocation list transmitted from the certificate authority server, beacon device authentication means for determining whether or not the electronic certificate is revoked,
When it is determined by the beacon device authentication means that the electronic certificate has not expired, an electronic signature that is included in the beacon signal and that is an encrypted hash value of the location information is used with a public key included in the electronic certificate. comprising a value obtained by decrypting the hash value calculated from the position information included in the beacon signal, and a validation means you verify whether they meet, and
When the first transmission means determines that the position information has been verified by the verification means, the first transmission means transmits the position information to an application server connected via the network,
Information output means for outputting the presentation information associated with the position information, transmitted from the application server;
A beacon device authentication system comprising:
A portable terminal device connected to a certificate authority server via a network,
Radio communication means for receiving a beacon signal transmitted from a beacon device and obtaining an electronic certificate from the received beacon signal;
Transmitting means for transmitting a request for a revocation list indicating whether or not the electronic certificate has been revoked to the certificate authority server;
In response to the request for the revocation list, receiving means for receiving the revocation list transmitted from the certificate authority server;
Beacon device authentication means for determining whether or not the electronic certificate is revoked based on the revocation list received by the receiving means;
When it is determined by the beacon device authentication means that the electronic certificate has not expired, an electronic signature that is included in the beacon signal and that is an encrypted hash value of the location information is used with a public key included in the electronic certificate. comprising a value obtained by decrypting the hash value calculated from the position information included in the beacon signal, and a validation means you verify whether they meet, and
When the transmission means determines that the position information has been verified by the verification means, the position information is transmitted to an application server connected via the network,
Information output means for outputting the presentation information associated with the position information, transmitted from the application server;
A portable terminal device comprising:
The wireless communication means determines whether or not the electronic certificate has been acquired from the beacon signal received from the beacon device, and terminates the process when determining that the electronic certificate has not been acquired. The portable terminal device according to claim 2, wherein:
The transmission means transmits attribute information of the user of the mobile terminal device to the application server in addition to the position information,
The mobile terminal device according to claim 2 or 3 , wherein the information output means outputs presentation information associated with the position information and the attribute information transmitted from the application server.
A beacon device,
Indicating that it has been authenticated for the presence of the beacon device itself authentication station, an electronic certificate storage means for storing an electronic certificate and private key issued by said certification authority,
Beacon information storage means for storing position information of the beacon device;
A beacon signal including the location information stored in the beacon information storage unit, an electronic signature obtained by encrypting a hash value of the location information with the private key stored in the electronic certificate storage unit, and the electronic certificate. And a wireless communication means for transmitting the beacon.
A beacon device installation system for connecting a beacon device, an information terminal device, and a certificate authority server via a network,
The beacon device
First wireless communication means for transmitting beacon identification information for identifying the beacon device to the information terminal device,
The information terminal device
A first electronic signature means for digitally sign the beacon identification information that sends from the beacon device,
First transmitting means for transmitting the electronically signed beacon identification information to the certificate authority server,
The certificate authority server is
First verification means for verifying the digitally signed beacon identification information transmitted from the information terminal device;
When the beacon identification information is verified by the first verification unit, a key generation unit that generates a secret key and a public key related to the beacon identification information;
A second electronic signature means for generating an electronic certificate electronically signed to the public key and storing the electronic certificate in an issued electronic certificate information storage unit;
Second transmitting means for transmitting the electronic certificate and the private key to the information terminal device,
The information terminal device
Second verification means for receiving the electronic certificate and the private key transmitted from the certificate authority server and verifying the received electronic certificate;
A second wireless communication unit that transmits the electronic certificate and the private key to the beacon device when the electronic certificate is verified by the second verification unit;
The beacon device
The beacon device installation system, wherein the first wireless communication unit receives the electronic certificate and the private key, and stores the received electronic certificate and the private key in an electronic certificate storage unit.
The information terminal device
Terminal verification means for verifying an electronic certificate corresponding to the private key used for digital signature by said first digital signature means, further comprising a
When the electronic certificate is verified by the terminal verifying means, said first transmission means, according to claim 6, it is characterized in that transmitting the beacon identification information digital signature to the authentication station server Beacon device installation system.
A beacon device installation system for connecting a beacon device, an information terminal device, and an authentication server via a network,
The beacon device
A key generation means for generating a secret key and a public key;
And a first wireless communication means for transmitting the public key generated in the information terminal device by the key generation means,
The information terminal device
First electronic signature means for electronically signing the public key transmitted from the beacon device ;
First transmitting means for transmitting the electronically signed public key to the certificate authority server,
The certificate authority server is
First verification means for verifying the digitally signed public key transmitted from the information terminal device;
When the public key digitally signed by the first verification unit is verified, an electronic certificate electronically signed to the public key is generated, and the generated electronic certificate is stored in the issued electronic certificate storage unit. Electronic signature means;
Second transmitting means for transmitting the electronic certificate to the information terminal device,
The information terminal device
Second verification means for verifying the electronic certificate transmitted from the certificate authority server;
A second wireless communication unit that transmits the electronic certificate to the beacon device when the electronic certificate is verified by the second verification unit;
The beacon device
The first wireless communication unit receives the electronic certificate, and stores the received electronic certificate and the private key generated by the key generation unit in an electronic certificate storage unit. Installation system.
The information terminal device
Terminal verification means for verifying an electronic certificate corresponding to the private key used for digital signature by said first digital signature means, further comprising a
The beacon according to claim 8 , wherein when the electronic certificate is verified by the terminal verification unit, the first transmission unit transmits the public key that has been electronically signed to the certificate authority server. Equipment installation system.
A beacon device authentication method executed in a beacon device authentication system comprising an information terminal device and a certificate authority server connected to the information terminal device via a network,
The information terminal device
A wireless communication step of receiving a beacon signal transmitted from a beacon device and acquiring an electronic certificate from the received beacon signal;
A first transmission step of transmitting to the certificate authority server a request for a revocation list indicating whether or not the electronic certificate has been revoked,
The certificate authority server is
A second transmission step of transmitting the revocation list to the information terminal device in response to a request for the revocation list transmitted from the information terminal device;
The information terminal device
A beacon device authentication step for determining whether the electronic certificate is revoked based on the revocation list transmitted from the certificate authority server;
If it is determined that the electronic certificate has not expired in the beacon device authentication step, an electronic signature, which is included in the beacon signal and encrypted with a hash value of position information, is used with a public key included in the electronic certificate. wherein a value obtained by decrypting the hash value calculated from the position information included in the beacon signal, a verification step you verify whether they meet is a,
The first transmission step transmits the position information to an application server connected via the network when it is determined that the position information has been verified by the verification step;
An information output step of outputting presentation information associated with the position information, transmitted from the application server;
A beacon device authentication method comprising:
A beacon device installation method executed in a beacon device installation system that connects a beacon device, an information terminal device, and a certificate authority server via a network,
The beacon device
A first wireless communication step of transmitting beacon identification information for identifying the beacon device to the information terminal device,
The information terminal device
A first electronic signature step of digitally sign the beacon identification information that sends from the beacon device,
A first transmission step of transmitting the electronically signed beacon identification information to the certificate authority server,
The certificate authority server is
A first verification step of verifying the digitally signed beacon identification information transmitted from the information terminal device;
When the beacon identification information is verified by the first verification step, a key generation step of generating a secret key and a public key related to the beacon identification information;
A second electronic signature step of generating an electronic certificate electronically signed to the public key and storing the electronic certificate in an issued electronic certificate information storage unit;
A second transmission step of transmitting the electronic certificate and the private key to the information terminal device,
The information terminal device
A second verification step of receiving the electronic certificate and the private key transmitted from the certificate authority server and verifying the received electronic certificate;
A second wireless communication step of transmitting the electronic certificate and the private key to the beacon device when the electronic certificate is verified by the second verification step;
The beacon device
The first wireless communication step receives the electronic certificate and the private key, and stores the received electronic certificate and the private key in an electronic certificate storage unit.
A beacon device installation method executed in a beacon device installation system that connects a beacon device, an information terminal device, and an authentication server via a network,
The beacon device
A key generation step for generating a secret key and a public key;
A first wireless communication step of transmitting the public key generated by the key generation step to the information terminal device,
The information terminal device
A first electronic signature step of electronically signing the public key transmitted from the beacon device ;
Transmitting the electronically signed public key to the certificate authority server, and
The certificate authority server is
A first verification step for verifying the digitally signed public key transmitted from the information terminal device;
When the public key digitally signed in the first verification step is verified, a second electronic certificate is generated by digitally signing the public key, and the generated electronic certificate is stored in the issued electronic certificate storage unit. An electronic signature step;
A second transmission step of transmitting the electronic certificate to the information terminal device,
The information terminal device
A second verification step of verifying the electronic certificate transmitted from the certificate authority server ;
When verifying the electronic certificate by the second verification step, wherein the second radio communication step of transmitting the electronic certificate to the beacon device,
The beacon device
The first wireless communication step receives the electronic certificate, and stores the received electronic certificate and the private key generated by the key generation step in an electronic certificate storage unit. Installation method.
In a beacon device authentication system comprising an information terminal device and a certificate authority server connected to the information terminal device via a network,
In the information terminal device,
A wireless communication step of receiving a beacon signal transmitted from a beacon device and acquiring an electronic certificate from the received beacon signal;
Causing the certificate authority server to transmit a request for a revocation list indicating whether or not the electronic certificate has been revoked, and
In the certificate authority server,
In response to the request for the revocation list transmitted from the information terminal device, a second transmission step of transmitting the revocation list to the information terminal device is performed.
In the information terminal device,
A beacon device authentication step for determining whether the electronic certificate is revoked based on the revocation list transmitted from the certificate authority server;
If it is determined that the electronic certificate has not expired in the beacon device authentication step, an electronic signature, which is included in the beacon signal and encrypted with a hash value of position information, is used with a public key included in the electronic certificate. a value obtained by decrypting the hash value calculated from the position information included in the beacon signal, and a validation step you verify whether they meet, is executed,
The first transmission step transmits the position information to an application server connected via the network when it is determined that the position information has been verified by the verification step;
An information output step of outputting presentation information associated with the position information, transmitted from the application server;
A beacon device authentication program characterized in that
In a beacon device installation system that connects a beacon device, an information terminal device, and a certificate authority server via a network,
In the beacon device,
A first wireless communication step of transmitting beacon identification information for identifying the beacon device to the information terminal device;
In the information terminal device,
A first electronic signature step of digitally sign the beacon identification information that sends from the beacon device,
A first transmission step of transmitting the electronically signed beacon identification information to the certificate authority server; and
In the certificate authority server,
A first verification step of verifying the digitally signed beacon identification information transmitted from the information terminal device;
When the beacon identification information is verified by the first verification step, a key generation step of generating a secret key and a public key related to the beacon identification information;
A second electronic signature step of generating an electronic certificate electronically signed to the public key and storing the electronic certificate in an issued electronic certificate information storage unit;
A second transmission step of transmitting the electronic certificate and the private key to the information terminal device,
In the information terminal device,
A second verification step of receiving the electronic certificate and the private key transmitted from the certificate authority server and verifying the received electronic certificate;
A second wireless communication step of transmitting the electronic certificate and the private key to the beacon device when the electronic certificate is verified by the second verification step;
In the beacon device,
The beacon device installation program, wherein the first wireless communication step receives the electronic certificate and the private key, and stores the received electronic certificate and the private key in an electronic certificate storage unit.
In a beacon device installation system that connects a beacon device, an information terminal device, and an authentication server via a network,
In the beacon device,
A key generation step for generating a secret key and a public key;
A first wireless communication step of transmitting the public key generated by the key generation step to the information terminal device;
In the information terminal device,
A first electronic signature step of electronically signing the public key transmitted from the beacon device ;
Transmitting the electronically signed public key to the certificate authority server; and
In the certificate authority server,
A first verification step for verifying the digitally signed public key transmitted from the information terminal device;
When the public key digitally signed in the first verification step is verified, a second electronic certificate is generated by digitally signing the public key, and the generated electronic certificate is stored in the issued electronic certificate storage unit. An electronic signature step;
A second transmission step of transmitting the electronic certificate to the information terminal device; and
In the information terminal device,
A second verification step of verifying the electronic certificate transmitted from the certificate authority server;
When the electronic certificate is verified by the second verification step, a second wireless communication step of transmitting the electronic certificate to the beacon device is executed.
In the beacon device,
The first wireless communication step receives the electronic certificate, and stores the received electronic certificate and the private key generated by the key generation step in an electronic certificate storage unit. Installation program.

Images