JP6868819B2 - Communication systems, integrated communication systems, relay systems, receiving systems, communication methods, and programs - Google Patents

Description

The present disclosure generally relates to communication systems, integrated communication systems, relay systems, receiving systems, communication methods, and programs. More specifically, the present disclosure relates to a communication system that outputs information to a receiving system, a comprehensive communication system, a relay system, a receiving system, a communication method, and a program.

Conventionally, an entry / exit management system for controlling the entry or exit of a user into a section of a facility has been known, and is disclosed in, for example, Patent Document 1. The entry / exit management system described in Patent Document 1 includes a card reader and a control device. The card reader is installed near the door of the facility room and is associated with an electric lock. The control device is connected to a card reader and an electric lock. The control device can receive the personal identification information read by the card reader. In addition, the control device can control locking or unlocking of the electric lock.

The control device uses the verification information transmitted from the entry / exit management server to determine whether or not the personal identification information read by the card reader has the authority to pass through the door. Then, when the control device has authority, it performs an unlocking operation of the electric lock corresponding to the card reader that has transmitted the personal identification number.

Japanese Unexamined Patent Publication No. 2013-140517

In the entry / exit management system described in Patent Document 1, for example, when a plurality of users hold an IC card (portable terminal) all at once with a plurality of card readers (reception systems), an individual is placed on a control device (communication system). Identification information is centrally transmitted at one time. In such a case, the communication system may have an excessive load of communication with the receiving system.

The present disclosure has been made in view of the above points, and provides a communication system, a comprehensive communication system, a relay system, a receiving system, a communication method, and a program capable of reducing the load of communication with the receiving system. The purpose.

The communication system according to one aspect of the present disclosure includes a processing unit, a first communication unit, and a second communication unit. The processing unit performs the first authentication using the identification information included in the request information from the mobile terminal in the outer region of the inner region and the outer region of the facility separated by the gate. When the processing unit succeeds in the authentication in the first authentication, the first communication unit outputs the first information which is the encrypted data to the mobile terminal. The second communication unit outputs second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information. The second communication unit outputs the second information before the processing unit performs the first authentication.

The comprehensive communication system according to one aspect of the present disclosure includes the above-mentioned communication system and a relay system. The relay system is provided at the gate and relays communication between the mobile terminal and the first communication unit.

The comprehensive communication system according to one aspect of the present disclosure includes the above-mentioned communication system and a plurality of receiving systems. Each of the plurality of receiving systems is provided in the inner region and acquires the second information from the second communication unit.

The relay system according to one aspect of the present disclosure is provided at a gate that separates the inner region and the outer region of the facility, and relays communication between the communication system and the mobile terminal. The communication system includes a processing unit, a first communication unit, and a second communication unit. The first authentication is performed using the identification information included in the request information from the mobile terminal in the outer region. The first communication unit outputs first information, which is encrypted data, to the mobile terminal. The second communication unit outputs second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. The relay system relays at least one of the request information and the first information. When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information. The second communication unit outputs the second authentication before the processing unit performs the first authentication.

The receiving system according to one aspect of the present disclosure is provided in the inner region of the inner region and the outer region of the facility separated by the gate, and receives the second information from the communication system. The communication system includes a processing unit, a first communication unit, and a second communication unit. The processing unit performs the first authentication using the identification information included in the request information from the mobile terminal in the outer region. When the processing unit succeeds in the authentication by the first authentication, the first authentication unit outputs the first information which is the encrypted data to the mobile terminal. The second communication unit outputs the second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information. The second communication unit outputs the second information before the processing unit performs the first authentication.

The communication method according to one aspect of the present disclosure includes a processing step, a first communication step, and a second communication step. The processing step performs the first authentication using the identification information included in the request information from the mobile terminal in the outer region of the inner region and the outer region of the facility separated by the gate. The first communication step is a step of outputting the first information, which is encrypted data, to the mobile terminal when the processing step succeeds in the authentication by the first authentication. The second step is a step of outputting the second information, which is the key information for decoding the first information, to the receiving system capable of communicating with the mobile terminal in the inner region. When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information. The second communication step outputs the second information before the processing step performs the first authentication.

The program according to one aspect of the present disclosure is a program for realizing a processing function, a first communication function, and a second communication function in a computer. The processing function is a function of performing the first authentication using the identification information included in the request information from the mobile terminal in the outer area of the inner area and the outer area of the facility separated by the gate. The first communication function is a function of outputting first information, which is encrypted data, to the mobile terminal when the processing function succeeds in authentication by the first authentication. The second communication function is a function of outputting second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information. The second communication function outputs the second information before the processing function performs the first authentication.

The present disclosure has an advantage that the load of communication with the receiving system can be reduced.

FIG. 1 is a block diagram showing a configuration of a communication system and a comprehensive communication system according to an embodiment of the present disclosure. FIG. 2 is a schematic view showing an example of a facility in which the above-mentioned integrated communication system is used. FIG. 3 is a schematic view showing another example of a facility in which the above-mentioned integrated communication system is used. FIG. 4 is a sequence diagram showing an example of the operation of the same communication system and the integrated communication system.

(1) Outline Hereinafter, an outline of the communication system 1 and the integrated communication system 100 according to the embodiment will be described with reference to FIGS. 1 to 3. The integrated communication system 100 of the present embodiment includes a communication system 1 and a plurality of (here, five) receiving systems 2. Each of the plurality of receiving systems 2 is located in the inner region 60 of the inner region 60 and the outer region 61 of the facility 6 separated by the gate 7, and can communicate with the mobile terminal 4. Here, the facility 6 is a set (including the site 62) of a plurality of buildings 81 installed on the site 62, such as a factory, a commercial complex, a theme park, etc. (see FIG. 2). In this case, the gate 7 is installed, for example, at the doorway in the site 62. Further, the facility 6 is a single building 63, such as an office building or an apartment building (see FIG. 3). In this case, the gate 7 is installed at the entrance / exit of the building 63. In addition, the facility 6 may be, for example, a welfare facility, a hospital, a store, or the like, or may be a detached house or the like.

The communication system 1 includes a first communication unit 11 and a second communication unit 12. The first communication unit 11 is configured to output the first information, which is encrypted data, to the mobile terminal 4 based on the request information from the mobile terminal 4 in the outer region 61. That is, the mobile terminal 4 can acquire the first information from the first communication unit 11.

The mobile terminal 4 is, for example, a smartphone and is owned by the user A1. The user A1 is, for example, an employee working at the facility 6 or a visitor visiting the facility 6. That is, the first communication unit 11 refers to the mobile terminal 4 of the user A1 who is about to enter the inner area 60 of the facility 6, not the mobile terminal 4 of the user A1 who has already entered the inner area 60 of the facility 6. , It is configured to output the first information. Then, the user A1 who has entered the inner region 60 of the facility 6 has the first information.

The second communication unit 12 is configured to output the second information, which is the key information for decoding the first information, to the receiving system 2. Here, the key information is, for example, a private key or a public key. That is, the receiving system 2 can acquire the second information from the second communication unit 12. Then, the receiving system 2 can decode the first information by using this second information.

As described above, in the present embodiment, the communication system 1 can have the receiving system 2 acquire the second information in advance. Then, the receiving system 2 can decode the first information from the mobile terminal 4 by using the second information acquired in advance. That is, in the present embodiment, the receiving system 2 does not need to communicate with the communication system 1 when communicating with the mobile terminal 4 to decode the first information. Therefore, in the present embodiment, for example, when a plurality of receiving systems 2 communicate with a plurality of mobile terminals 4, signals are transmitted from the plurality of receiving systems 2 to the communication system 1 in a concentrated manner at one time. The situation is unlikely to occur. Therefore, in the present embodiment, the communication system 1 can reduce the load of communication with the receiving system 2. There is an advantage.

(2) Details Hereinafter, the communication system 1 and the integrated communication system 100 according to the present embodiment will be described in detail with reference to FIGS. 1 to 3. The integrated communication system 100 of the present embodiment includes a communication system 1, a plurality of (five in FIG. 1) receiving systems 2, and one or more (one in FIG. 1) relay systems 3. In FIG. 1, in addition to these, a mobile terminal 4 and a network 5 such as the Internet are shown.

Further, although two mobile terminals 4 are shown in FIG. 1, these mobile terminals 4 are the same terminals and are owned by one user A1. In this embodiment, it is assumed that there are not only one mobile terminal 4 but also a plurality of mobile terminals 4. Further, the user A1 owns one mobile terminal 4 for each person. Therefore, in this embodiment, it is assumed that there are a plurality of users A1. In particular, in the present embodiment, it is assumed that there are thousands to tens of thousands of users A1, but it is not intended to limit the number of users A1 targeted by the communication system 1 and the comprehensive communication system 100.

In the present embodiment, the plurality of receiving systems 2 are provided in each of the plurality of specific regions 8 in the inner region 60. For example, when the facility 6 is a factory as shown in FIG. 2, a road intersection, a plaza, a building 81, etc. in the factory are the specific areas 8. In the example shown in FIG. 2, each of the plurality of buildings 81 is a specific area 8. Further, for example, when the facility 6 is an office building as shown in FIG. 3, the corridor, the elevator hall, the entrance hall, the room 83, and the like in the building 63 are the specific areas 8. In addition, one room 83 may be divided into a plurality of specific areas 8. In the example shown in FIG. 3, each of the plurality of rooms 83 is a specific area 8. The specific area 8 may be managed by the owner of the facility 6, or may be managed by a business operator (tenant) rented from the owner of the facility 6.

In the example shown in FIG. 2, the plurality of receiving systems 2 are attached to the walls near the doors 82, which are the entrances and exits of the plurality of buildings 81, respectively. Further, in the example shown in FIG. 3, the plurality of receiving systems 2 are attached to the walls near the doors 84, which are the entrances and exits of the plurality of rooms 83, respectively. Of course, the purpose is not to limit the position of the receiving system 2, and the receiving system 2 may be provided at a position where it can communicate with the mobile terminal 4 in the specific area 8.

Further, in the present embodiment, one or more relay systems 3 are provided in each of one or more gates 7 of the facility 6. In the example shown in FIG. 2, a plurality of (here, four) gates 7 are provided at the entrance and exit of the site 62, and a partition 72 is provided between the gates 7. The relay system 3 is attached to each of the plurality of (here, three) partitions 72. That is, the relay system 3 does not have to correspond one-to-one with the gate 7, and may correspond to a plurality of gates 7. Further, in the example shown in FIG. 3, a door 73 is provided as a gate 7 at the entrance / exit of the building 63. The relay system 3 is attached to the wall near the door 73. Of course, the purpose is not to limit the position of the relay system 3, and the relay system 3 may be provided at a position where it can communicate with the mobile terminal 4 in the outer region 61.

The communication system 1 includes a first communication unit 11, a second communication unit 12, a processing unit 13, a first storage unit 101, and a second storage unit 102. In this embodiment, the communication system 1 is a server. The communication system 1 mainly includes, for example, a computer system (including a microcomputer) including a processor and a memory. That is, the computer system functions as the communication system 1 by executing an appropriate program on the processor.

The first communication unit 11 acquires the request information from the mobile terminal 4 by communicating with the mobile terminal 4 in the outer region 61 via the relay system 3 and the network 5. The first communication unit 11 outputs the acquired request information to the processing unit 13. The request information includes identification information (ID: Identification) (that is, identification information of the user A1) of the mobile terminal 4 from which the request information is transmitted.

Further, when the first information is input from the processing unit 13, the first communication unit 11 outputs the input first information to the mobile terminal 4 via the network 5 and the relay system 3. The first information is data encrypted using the key information corresponding to the second information. In the present embodiment, for example, when a common key cryptosystem is adopted, the first information is encrypted using the common key. Further, for example, when a public key cryptosystem is adopted, the first information is encrypted using a private key. The first information includes the identification information of the mobile terminal 4 from which the request information is transmitted, the access authority, and the electronic signature.

In the present embodiment, an expiration date such as an output date and time is set in the first information. For example, the processing unit 13 sets an expiration date for the first information when creating the first information as described later. Therefore, for example, when the expiration date of the first information is exceeded, the first information becomes invalid. In the present embodiment, if the expiration date of the first information is exceeded, the receiving system 2 fails to authenticate the first information. Therefore, the user A1 may enter the specific area 8 even if he / she has the access authority. Can not.

Further, the first communication unit 11 has an acquisition unit 111. The acquisition unit 111 is configured to acquire the third information from the mobile terminal 4 by communicating with the mobile terminal 4 in the inner region 60 via the relay system 3 and the network 5. For example, the acquisition unit 111 acquires the third information by communicating with the mobile terminal 4 when the user A1 passes through the gate 7 and exits to the outer region 61. The acquisition unit 111 outputs the acquired third information to the processing unit 13. The third information is associated with each of the plurality of specific regions 8 in the inner region 60. The third information includes, for example, information such as the date and time when the authentication with the mobile terminal 4 is performed, the attributes of the specific area 8 (for example, if the specific area 8 is the room 83, the room number, etc.). That is, the third information includes information about the specific area 8 that the user A1 has entered.

In the present embodiment, as will be described later, when the receiving system 2 provided in each of the plurality of specific areas 8 succeeds in authenticating the first information of the mobile terminal 4, the third information is created in the mobile terminal 4. Output to. That is, there are a plurality of receiving systems 2, each of which is provided in a plurality of specific areas 8. Then, the third information is output from each of the plurality of receiving systems 2 to the mobile terminal 4. In other words, the mobile terminal 4 is configured to acquire the third information in one or more specific areas 8 out of the plurality of specific areas 8.

When the second information is input from the processing unit 13, the second communication unit 12 communicates with the receiving system 2 in the inner region 60 via the network 5 to output the second information to the receiving system 2. To do. The second information is key information for decrypting the first information. In the present embodiment, for example, when a common key cryptosystem is adopted, the second information is a common key. In this case, the second information output to the receiving system 2 is the same as the common key possessed by the communication system 1. Further, for example, when a public key cryptosystem is adopted, the second information is a public key. In this case, the public key, which is the second information output to the receiving system 2, and the private key held by the communication system 1 are different keys.

In the present embodiment, the second information is updated, for example, at regular time intervals (for example, in the morning, one day, one week), and is output from the communication system 1 to the plurality of receiving systems 2. The update of the second information is automatically performed, for example, by the processor of the communication system 1 executing a program stored in the memory. Of course, the second information may be updated manually by, for example, the administrator of the communication system 1.

The connection between the first communication unit 11 and each of the one or more relay systems 3 may be, for example, a wired connection, a wireless connection, or a connection form via a repeater or the like. It may be. Similarly, the connection between the second communication unit 12 and each of the plurality of receiving systems 2 may be, for example, a wired connection, a wireless connection, or via a repeater or the like. It may be a connection form.

When the request information from the mobile terminal 4 is input, the processing unit 13 authenticates the identification information included in the request information. Specifically, the processing unit 13 lists the identification information of the mobile terminal 4 that is the source of the request information and the identification information of the plurality of mobile terminals 4 stored in the first storage unit 101 (that is, a plurality of identification information). (List of identification information for user A1) is collated. If the identification information of the source mobile terminal 4 is included in the list, the processing unit 13 determines that the authentication is successful, and includes the identification information of the source mobile terminal 4, the corresponding access authority, and the electronic signature. The data is encrypted to create the first information. Then, the processing unit 13 transmits the first information from the first communication unit 11 to the transmission source mobile terminal 4. That is, the processing unit 13 is configured to authenticate the identification information, and if the authentication is successful, the first communication unit 11 outputs the first information to the mobile terminal 4 that is the source of the request information. .. On the other hand, if the identification information of the transmission source mobile terminal 4 is not included in the list, the processing unit 13 determines that the authentication has failed, and for example, transmits notification information indicating that the authentication has failed from the first communication unit 11. It is transmitted to the original mobile terminal 4.

The first storage unit 101 and the second storage unit 102 each include a rewritable non-volatile memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory). The first storage unit 101 stores a database in which identification information about a plurality of mobile terminals 4 and access authority are associated with each other. The second storage unit 102 stores a database of second information about the plurality of receiving systems 2.

The receiving system 2 is provided in the inner region 60, and includes a communication unit 21 and an authentication unit 22. The communication unit 21 receives the second information from the communication system 1 by communicating with the second communication unit 12 of the communication system 1 via the network 5. The communication unit 21 outputs the received second information to the authentication unit 22. That is, the receiving system 2 is provided in the inner region 60 of the inner region 60 and the outer region 61 of the facility 6 separated by the gate 7, and receives the second information from the communication system 1.

Further, the communication unit 21 acquires the first information from the mobile terminal 4 by wirelessly communicating with the mobile terminal 4 in the inner region 60. The communication unit 21 outputs the acquired first information to the authentication unit 22. The method of wireless communication with the mobile terminal 4 is short-range wireless communication such as Bluetooth (registered trademark) and NFC (Near Field Communication). In addition, the wireless communication method may be, for example, Wi-Fi (registered trademark) or specified low power wireless communication.

As an example, when the receiving system 2 is composed of a non-contact type card reader, the communication unit 21 of the receiving system 2 is connected to the mobile terminal 4 when the user A1 holds the mobile terminal 4 over the card reader. The first information is acquired from the mobile terminal 4 by wireless communication with the mobile terminal 4.

The authentication unit 22 has, for example, a computer system (including a microcomputer) including a processor and a memory as a main configuration. That is, the computer system functions as the authentication unit 22 by executing an appropriate program on the processor. The authentication unit 22 stores the second information input from the communication unit 21. Further, when the first information is input from the communication unit 21, the authentication unit 22 authenticates the first information. Specifically, the authentication unit 22 decodes the first information using the second information stored in advance. Then, the authentication unit 22 inspects whether or not the identification information, the access authority, and the electronic signature included in the decrypted first information are valid. When the identification information, the access authority, and the electronic signature are all valid, the authentication unit 22 determines that the authentication is successful, and the communication unit 21 outputs a permission signal to the switchgear 23. On the other hand, if at least one of the identification information, the access authority, and the electronic signature is invalid, the authentication unit 22 determines that the authentication has failed, and for example, the communication unit 21 sends notification information indicating that the authentication has failed. It is transmitted to the mobile terminal 4.

The opening / closing device 23 is a device that opens / closes the doors 82 and 84 provided in the specific area 8. The door referred to here may be either a hinged door type or a sliding door type. The opening / closing device 23 may open / close the doors 82, 84 including the automatic door, or may open / close the door by unlocking the electric lock provided on the doors 82, 84. Upon receiving the permission signal, the switchgear 23 opens the doors 82 and 84. As a result, the user A1 can enter the specific area 8. When the user A1 enters the specific area 8, or when a certain period of time has elapsed after the opening / closing device 23 opens the doors 82 and 84, the authentication unit 22 outputs a closing signal from the communication unit 21 to the opening / closing device 23. Upon receiving the closing signal, the opening / closing device 23 closes the doors 82 and 84. The switchgear 23 may be included in the receiving system 2 or may be separate from the receiving system 2. Further, in FIGS. 2 and 3, the switchgear 23 is not shown.

That is, in the present embodiment, the receiving system 2 is an entrance / exit management system that is provided in each of the plurality of specific areas 8 in the inner area 60 and manages entry / exit to / from the corresponding specific area 8. The receiving system 2 is also a lock management system provided in each of the plurality of doors 82 and 84 in the inner region 60 and managing the locking and unlocking of the corresponding doors 82 and 84. The first information includes access authority as information on whether or not to enter and exit the corresponding specific area 8 and as information on whether or not to lock and unlock the corresponding doors 82 and 84.

The relay system 3 is provided at the gate 7 and acquires request information from the mobile terminal 4 by wirelessly communicating with the mobile terminal 4 in the outer region 61. Then, the relay system 3 outputs the acquired request information to the communication system 1 by communicating with the communication system 1. That is, the relay system 3 is provided at the gate 7 that separates the inner region 60 and the outer region 61 of the facility 6, and relays the communication between the communication system 1 and the mobile terminal 4. Similar to the receiving system 2, the wireless communication method with the mobile terminal 4 is short-range wireless communication such as Bluetooth (registered trademark) and NFC. In addition, the wireless communication method may be, for example, Wi-Fi (registered trademark) or specified low power wireless communication.

As an example, when the relay system 3 is composed of a beacon terminal, the relay system 3 continuously or intermittently transmits a beacon to a predetermined area around the gate 7, for example. Then, when the mobile terminal 4 enters the predetermined area and receives the beacon, the mobile terminal 4 transmits the request information to the relay system 3. That is, in this case, the user A1 can output the request information to the communication system 1 via the relay system 3 only by entering the predetermined area of the gate 7. Further, as an example, when the relay system 3 is composed of a non-contact type card reader, the relay system 3 wirelessly communicates with the mobile terminal 4 when the user A1 holds the mobile terminal 4 over the card reader. By communicating, the first information is acquired from the mobile terminal 4. That is, in this case, the user A1 can output the request information to the communication system 1 via the relay system 3 by holding the mobile terminal 4 over the card reader installed at the gate 7.

Further, when the first information from the communication system 1 is input, the relay system 3 outputs the first information to the mobile terminal 4 which is the transmission source of the request information. As described above, in the present embodiment, at least one of the request information and the first information is relayed by the relay system 3 provided in the gate 7.

The mobile terminal 4 is a mobile information terminal such as a smartphone. The mobile terminal 4 mainly includes, for example, a computer system (including a microcomputer) having a processor and a memory. The mobile terminal 4 functions as a communication device with at least the receiving system 2 and the relay system 3 (communication system 1 if the relay system 3 is not provided) by installing the dedicated application software and activating the application software. It is configured to be able to communicate with the receiving system 2 and the relay system 3 by using the above-mentioned wireless communication method.

Identification information is assigned to the mobile terminal 4. The identification information is information unique to the mobile terminal 4 and is information for identifying each mobile terminal 4. That is, the identification information is also information for identifying the user A1 who owns the mobile terminal 4. The identification information is stored in a storage unit such as a non-volatile memory of the mobile terminal 4, for example. Further, when the first information is acquired from the communication system 1, the acquired first information is stored in the storage unit of the mobile terminal 4. In addition, when the third information is acquired from the receiving system 2, the acquired third information is stored in the storage unit of the mobile terminal 4.

(3) Operation Hereinafter, an example of the operation of the communication system 1 and the integrated communication system 100 of the present embodiment will be described with reference to FIG. In the following, any one receiving system 2 in the plurality of receiving systems 2, any one relay system 3 in the plurality of relay systems 3, and any one mobile terminal in the plurality of mobile terminals 4. The explanation will be focused on 4. First, the second communication unit 12 of the communication system 1 outputs the second information to the receiving system 2 before the opening of the facility 6, for example (step S101). As a result, the receiving system 2 stores the second information in advance.

After that, the facility 6 opens, and the user A1 who owns the mobile terminal 4 arrives at the gate 7 (step S102). When the user A1 holds the mobile terminal 4 over the relay system 3 or the mobile terminal 4 receives the beacon from the relay system 3, the mobile terminal 4 outputs the request information with the transmission destination as the communication system 1 (step S103). ). The first communication unit 11 of the communication system 1 acquires the request information from the mobile terminal 4 via the relay system 3. Then, the processing unit 13 of the communication system 1 executes the authentication of the identification information included in the request information of the mobile terminal 4 (step S104). If the authentication is successful, the processing unit 13 outputs the first information from the first communication unit 11 to the mobile terminal 4 (step S105). After that, the mobile terminal 4 will store the first information acquired from the communication system 1.

After that, the user A1 passes through the gate 7 and enters the inner region 60, and arrives at the specific region 8 to which the user A1 has the access authority (step S106). When the user A1 holds the mobile terminal 4 over the receiving system 2, the mobile terminal 4 outputs the first information to the receiving system 2 (step S107). When the communication unit 21 of the receiving system 2 acquires the first information, the authentication unit 22 authenticates the first information of the mobile terminal 4 using the second information (step S108). If the authentication is successful, the authentication unit 22 outputs a permission signal to the switchgear 23 (step S109). Then, by opening the doors 82 and 84 by the opening / closing device 23, the user A1 can enter the specific area 8 having the access authority. In the present embodiment, the receiving system 2 outputs the third information to the mobile terminal 4 after the authentication is successful (step S110). Therefore, when the user A1 enters one or more specific areas 8, the mobile terminal 4 stores the third information each time the user A1 enters one or more specific areas 8.

In the present embodiment, the third information is used to grasp the behavior of the user A1. Specifically, the mobile terminal 4 acquires one or more third information corresponding to each of the one or more specific areas 8 when the user A1 visits one or more specific areas 8. Then, when the user A1 passes through the gate 7 and exits from the inner region 60 of the facility 6, the acquisition unit 111 of the communication system 1 communicates with the mobile terminal 4 via the relay system 3 and the network 5. Acquire one or more third information from the mobile terminal 4. Here, one or more third pieces of information are information about one or more specific areas 8. Therefore, the communication system 1 can grasp the history of one or more specific areas 8 visited by the user A1, in other words, the behavior of the user A1 by referring to one or more third information acquired from the mobile terminal 4. It is possible. The acquired third information of one or more may be stored in the database in association with the identification information of the mobile terminal 4 (that is, the identification information of the user A1).

Here, the expiration date may be set in the third information. Then, the mobile terminal 4 may be configured to invalidate the first information when the expiration date of the stored third information has expired. In this case, for example, when the user A1 tries to enter the next specific area 8 after entering an arbitrary specific area 8, when the user A1 heads for the next specific area 8 while making a detour, the user A1 goes to the next specific area 8 and becomes the third in the next specific area 8. 1 Information cannot be authenticated, and it becomes impossible to enter the next specific area 8. That is, in this case, there is an advantage that the user A1 can be encouraged to move to the next specific area 8 without making a detour. The expiration date of the third information is preferably invalidated when the authentication in the next specific area 8 is successful.

(4) Modified Example The above embodiment is only one of various embodiments of the present disclosure. The above-described embodiment can be changed in various ways depending on the design and the like as long as the object of the present disclosure can be achieved. Further, the same function as that of the communication system 1 may be realized by a communication method, a computer program, a recording medium on which the program is recorded, or the like.

The communication method according to one aspect includes a first step and a second step. The first step is data encrypted for the mobile terminal 4 based on the request information from the mobile terminal 4 in the outer region 61 of the inner region 60 and the outer region 61 of the facility 6 separated by the gate 7. This is a step of outputting a certain first information. The second step is a step of outputting the second information, which is the key information for decoding the first information, to the receiving system 2 in the inner region 60. Here, the first step and the second step are in no particular order. That is, the first step may be executed before the second step, or the second step may be executed before the first step.

The (computer) program according to one aspect is a program for realizing a first function and a second function in a computer. The first function is data encrypted for the mobile terminal 4 based on the request information from the mobile terminal 4 in the outer region 61 of the inner region 60 and the outer region 61 of the facility 6 separated by the gate 7. This is a function to output a certain first information. The second function is a function of outputting the second information, which is the key information for decoding the first information, to the receiving system 2 in the inner region 60.

Hereinafter, modifications of the embodiment are listed. The modifications described below can be applied in combination as appropriate.

The execution subject of the communication system 1 or the communication method in the present disclosure includes a computer system. A computer system mainly consists of a processor and a memory as hardware. When the processor executes the program recorded in the memory of the computer system, the function as the execution subject of the communication system 1 or the communication method in the present disclosure is realized. The program may be pre-recorded in the memory of the computer system, may be provided through a telecommunications line, or may be recorded on a recording medium such as a memory card, optical disk, hard disk drive, etc. that can be read by the computer system. May be provided. A processor in a computer system is composed of one or more electronic circuits including a semiconductor integrated circuit (IC) or a large scale integrated circuit (LSI). A plurality of electronic circuits may be integrated on one chip, or may be distributed on a plurality of chips. The plurality of chips may be integrated in one device, or may be distributed in a plurality of devices.

Further, in the present embodiment, the integrated communication system 100 includes a communication system 1, a receiving system 2, and a relay system 3, but the receiving system 2 and the relay system 3 are indispensable for the integrated communication system 100. Not a configuration. That is, the integrated communication system 100 may include the communication system 1, and at least one of the receiving system 2 and the relay system 3 may not be included in the components of the integrated communication system 100. In other words, the comprehensive communication system 100 may include a communication system 1 and a receiving system 2 except for the relay system 3. Further, the comprehensive communication system 100 may include a communication system 1 and a relay system 3 except for the reception system 2.

Further, in the present embodiment, the communication system 1 is realized by one system, but may be realized by two or more systems. For example, the functions of the first communication unit 11 and the second communication unit 12 may be distributed and provided in the two systems. In addition, for example, the functions of the first communication unit 11, the second communication unit 12, the processing unit 13, the first storage unit 101, and the second storage unit 102 may be distributed and provided in two or more systems. Further, for example, the functions of the first communication unit 11, the second communication unit 12, the processing unit 13, the first storage unit 101, and the second storage unit 102 may be provided in one device that fits in one housing. However, it may be distributed and provided in a plurality of devices. In addition, at least a part of the functions of the communication system 1 may be realized by, for example, the cloud (cloud computing).

In the present embodiment, the first communication unit 11 of the communication system 1 is configured to acquire the request information from the mobile terminal 4 in the outer region 61, but the purpose is not limited to this. For example, the first communication unit 11 may acquire the request information from the mobile terminal 4 at the gate 7.

In the present embodiment, the first communication unit 11 of the communication system 1 may output the third information when the first information is output to the mobile terminal 4 which is the transmission source of the request information. That is, in this case, the gate 7 is also the specific area 8. In this case, for example, when the user A1 tries to enter the next specific area 8 after passing through the gate 7, when he / she heads for the next specific area 8 while making a detour, the user A1 finds the first information in the next specific area 8. Without being able to authenticate, you will not be able to enter the next specific area 8. That is, in this case, there is an advantage that the user A1 can be encouraged to go to the specific area 8 without detouring.

In the present embodiment, since the receiving system 2 authenticates the first information using the second information, the second communication unit 12 of the communication system 1 allows the user A1 to store the second information in the receiving system 2 in advance. It is preferable to output the second information before passing through the gate 7. For example, when the facility 6 is a facility to which the user A1 (employee) belongs, such as a factory, an office building, or a theme park, the second communication unit 12 outputs the second information before the start of the facility 6. preferable. In addition, even after the user A1 has passed through the gate 7, the second communication unit 12 sends the second information to the receiving system 2 corresponding to the specific area 8 before the user A1 reaches the specific area 8. It suffices to output.

In the present embodiment, the authentication unit 22 of the receiving system 2 examines whether the identification information, access authority, and electronic signature of the mobile terminal 4 included in the decrypted first information are valid to obtain the first information. Authentication is being performed, but it is not limited to this. For example, the authentication unit 22 may authenticate the first information depending on whether or not the first information can be decrypted using at least the second information. In this case, the authentication unit 22 determines that the authentication is successful if the first information can be decrypted, and determines that the authentication has failed if the first information cannot be decrypted.

In the present embodiment, the receiving system 2 creates the third information and outputs it to the mobile terminal 4, but the purpose is not limited to this. For example, the receiving system 2 may be configured to output a signal requesting the third information to the communication system 1 when the authentication of the first information is successful. In this case, when the communication system 1 receives the signal from the receiving system 2, it creates the third information corresponding to the receiving system 2 (in other words, the specific area 8), and sends the created third information to the receiving system 2. Output to. Then, when the receiving system 2 acquires the third information from the communication system 1, the acquired third information may be output to the mobile terminal 4 which is the transmission source of the first information.

In the present embodiment, the receiving system 2 is a lock management system and an entry / exit management system, but the present invention is not limited to this. For example, the receiving system 2 may be composed only of the lock management system or may be composed only of the entry / exit management system.

In the present embodiment, the relay system 3 may be configured to manage entry and exit from the gate 7 to the inner region 60 based on the request information from the mobile terminal 4. For example, when the relay system 3 receives the request information from the mobile terminal 4 and relays the first information to the mobile terminal 4, the user A1 who owns the mobile terminal 4 moves from the gate 7 to the inner region 60. It is judged that the person will enter, and the judgment result is stored. In this way, the relay system 3 can manage the user A1 who has entered the inner region 60 from the gate 7.

In the present embodiment, the mobile terminal 4 communicates with the communication system 1 via the relay system 3 and the network 5, but the present invention is not limited to this. For example, the mobile terminal 4 may be configured to communicate with the communication system 1 via the network 5 without going through the relay system 3. In this case, the user A1 communicates with the communication system 1 via the network 5 by the mobile terminal 4 before arriving at the gate 7 (for example, when he / she is in the train used for commuting), so that the first information can be obtained. It is also possible to obtain. In this case, the mobile terminal 4 is connected to the network 5 via the mobile phone network (carrier network) provided by the telecommunications carrier. The mobile phone network includes, for example, a 3G (third generation) line, an LTE (Long Term Evolution) line, and the like. In addition, the mobile terminal 4 may be connected to the network 5 via a public wireless LAN (Local Area Network).

In the present embodiment, the mobile terminal 4 is a smartphone, but the purpose is not limited to this. The mobile terminal 4 may be, for example, a tablet terminal, a personal computer, or the like. In addition, the mobile terminal 4 can be worn directly by the user A1 or as a personal belonging of the user A1 such as a bag, such as a key chain type, an employee ID card type, a name tag type, a glasses type, or a watch type wearable terminal. It may be a structure to be attached.

(Summary)
As described above, the communication system (1) according to the first aspect includes a first communication unit (11) and a second communication unit (12). The first communication unit (11) is requested information from the mobile terminal (4) in the outer region (61) of the inner region (60) and the outer region (61) of the facility (6) separated by the gate (7). The first information, which is the encrypted data, is output to the mobile terminal (4) based on the above. The second communication unit (12) supplies the second information, which is the key information for decoding the first information, to the receiving system (2) capable of communicating with the mobile terminal (4) in the inner region (60). Output.

According to this aspect, the communication system (1) outputs the first information to the mobile terminal (4) and outputs the second information to the receiving system (2). Therefore, according to this aspect, since the receiving system (2) has already stored the second information when decoding the first information, the mobile terminal (2) does not communicate with the communication system (1). It is possible to decode the first information from 4). Therefore, according to this aspect, even when there are a large number of users (A1) who own the mobile terminal (4), the second information is simultaneously transmitted from the plurality of receiving systems (2) to the communication system (1). By requesting, the situation that communication traffic suddenly increases does not occur. That is, according to this aspect, when the receiving system (2) communicates with the mobile terminal (4), it also communicates with the communication system (1), as compared with the receiving system (2) of the communication system (1). There is an advantage that the communication load of the system can be reduced.

In the communication system (1) according to the second aspect, in the first aspect, at least one of the request information and the first information is relayed by the relay system (3) provided in the gate (7).

According to this aspect, the mobile terminal (4) can communicate with the communication system (1) via the relay system (3) even if the configuration cannot directly communicate with the communication system (1). .. Therefore, according to this aspect, there is an advantage that the degree of freedom of the communication method of the mobile terminal (4) is improved.

The communication system (1) according to the third aspect further includes a processing unit (13) in the first or second aspect. The request information includes identification information of the mobile terminal (4) from which the request information is transmitted. The processing unit (13) authenticates the identification information, and when the authentication is successful, the first communication unit (11) outputs the first information to the mobile terminal (4) that is the source of the request information. It is configured.

According to this aspect, since the first information is output after confirming whether the mobile terminal (4) from which the request information is transmitted is reliable, it is output to an unrelated third party such as a suspicious person. There is an advantage that it is possible to prevent the output of the first information.

In the communication system (1) according to the fourth aspect, an expiration date is set for the first information in any one of the first to third aspects.

According to this aspect, it is possible to prevent a third party such as a suspicious person from entering the specific area (8) without access authority by using the first information acquired by some method in the past. There are advantages.

In the communication system (1) according to the fifth aspect, in any one of the first to fourth aspects, the third information is associated with each of the plurality of specific areas (8) in the inner area (60). ing. The mobile terminal (4) is configured to acquire the third information in one or more specific areas (8) among the plurality of specific areas (8).

According to this aspect, for example, by setting an expiration date in the third information, the user (A1) who has acquired the third information in an arbitrary specific area (8) moves to the next specific area 8 without detouring. It has the advantage of being able to encourage you to go.

The communication system (1) according to the sixth aspect further includes an acquisition unit (111) for acquiring the third information from the mobile terminal (4) in the inner region (60) in the fifth aspect.

According to this aspect, by referring to one or more third information acquired from the mobile terminal (4), the history of one or more specific areas (8) visited by the user (A1), in other words, the user (A1). There is an advantage that it becomes possible to grasp the behavior of.

In the communication system (1) according to the seventh aspect, in the fifth or sixth aspect, there are a plurality of receiving systems (2), each of which is provided in a plurality of specific areas (8). The third information is output from each of the plurality of receiving systems (2) to the mobile terminal (4).

According to this aspect, each of the plurality of receiving systems (2) can output the third information to the mobile terminal (4) without communicating with the communication system (1). Therefore, according to this aspect, there is an advantage that the load of communication between the communication system (1) and the receiving system (2) is unlikely to increase when the third information is output to the mobile terminal (4). ..

In the communication system (1) according to the eighth aspect, in any one of the first to seventh aspects, the receiving system (2) is provided in each of the plurality of specific areas (8) in the inner area (60). It is configured to manage entry and exit to the corresponding specific area (8). The first information includes information on whether or not to enter or leave the corresponding specific area (8).

According to this aspect, there is an advantage that it becomes possible to manage a user (A1) who has entered each of the plurality of specific areas (8) or has exited from each of the plurality of specific areas (8).

In the communication system (1) according to the ninth aspect, in any one of the first to seventh aspects, the receiving system (2) is attached to each of the plurality of doors (82, 84) in the inner region (60). It is a lock management system provided to manage the locking and unlocking of the corresponding doors (82,84). The first information includes information on whether the corresponding doors (82,84) can be locked and unlocked.

According to this aspect, there is an advantage that it becomes possible to manage the user (A1) who has locked or unlocked the doors (82,84).

In the communication system (1) according to the tenth aspect, in the second aspect, the relay system (3) manages entry and exit from the gate (7) to the inner region (60) based on the request information. It is configured in.

According to this aspect, there is an advantage that it becomes possible to manage a user (A1) who has entered the inner region (60) from the gate (7) or has exited from the inner region (60).

The comprehensive communication system (100) according to the eleventh aspect includes the communication system (1) of any one of the first to tenth aspects and the relay system (3). The relay system (3) is provided at the gate (7) and relays the communication between the mobile terminal (4) and the first communication unit (11).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The comprehensive communication system (100) according to the twelfth aspect includes the communication system (1) of any one of the first to tenth aspects and a plurality of receiving systems (2). Each of the plurality of receiving systems (2) is provided in the inner region (60) and acquires the second information from the second communication unit (12).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The relay system (3) according to the thirteenth aspect is provided at a gate (7) that separates an inner region (60) and an outer region (61) of the facility (6), and is provided with a communication system (1) and a mobile phone. The communication with the terminal (4) is relayed. The communication system (1) includes a first communication unit (11) and a second communication unit (12). The first communication unit (11) outputs the first information, which is encrypted data, to the mobile terminal (4) based on the request information from the mobile terminal (4) in the outer region (61). .. The second communication unit (12) outputs the second information, which is the key information for decoding the first information, to the receiving system (2) in the inner region (60).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The receiving system (2) according to the fourteenth aspect is provided in the inner region (60) of the inner region (60) and the outer region (61) of the facility (6) separated by the gate (7), and communicates with each other. The second information is received from the system (1). The communication system (1) includes a first communication unit (11) and a second communication unit (12). The first communication unit (11) outputs the first information, which is encrypted data, to the mobile terminal (4) based on the request information from the mobile terminal (4) in the outer region (61). .. The second communication unit (12) outputs the second information, which is the key information for decoding the first information, to the receiving system (2) in the inner region (60).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The communication method according to the fifteenth aspect includes a first step and a second step. The first step is based on the request information from the mobile terminal (4) in the outer region (61) of the inner region (60) and the outer region (61) of the facility (6) separated by the gate (7). This is a step of outputting the first information, which is encrypted data, to the mobile terminal (4). The second step is a step of outputting the second information, which is the key information for decoding the first information, to the receiving system (2) in the inner region (60).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The program according to the sixteenth aspect is a program for realizing the first function and the second function in the computer. The first function is based on the request information from the mobile terminal (4) in the outer region (61) of the inner region (60) and the outer region (61) of the facility (6) separated by the gate (7). This is a function of outputting the first information, which is encrypted data, to the mobile terminal (4). The second function is a function of outputting the second information, which is the key information for decoding the first information, to the receiving system (2) in the inner region (60).

According to this aspect, communication with the receiving system (2) of the communication system (1) is compared with the case where the receiving system (2) also communicates with the communication system (1) when communicating with the mobile terminal (4). There is an advantage that the load of the system can be reduced.

The configurations according to the second to tenth aspects are not essential configurations for the communication system (1) and can be omitted as appropriate.

Not limited to the above aspects, various configurations (including modifications) of the communication system 1 according to the embodiment can be appropriately embodied by a communication method and a (computer) program.

1 Communication system 11 1st communication unit 111 Acquisition unit 12 2nd communication unit 13 Processing unit 2 Reception system 3 Relay system 4 Mobile terminal 6 Facility 60 Inner area 61 Outer area 7 Gate 8 Specific area 82,84 Door 100 Comprehensive communication system

Claims (16)

A processing unit that performs the first authentication using the identification information included in the request information from the mobile terminal in the outer area of the inner area and the outer area of the facility separated by the gate.
When the processing unit succeeds in the authentication by the first authentication, the first communication unit that outputs the first information which is the encrypted data to the mobile terminal and the first communication unit.
A receiving system capable of communicating with the mobile terminal in the inner region is provided with a second communication unit that outputs second information that is key information for decoding the first information.
When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information.
The second communication unit is a communication system that outputs the second information before the processing unit performs the first authentication. The communication system according to claim 1, wherein at least one of the request information and the first information is relayed by a relay system provided at the gate. Further equipped with a processing unit
The request information includes identification information of the mobile terminal that is the source of the request information.
The processing unit executes authentication of the identification information, and when the authentication is successful, the processing unit is configured to output the first information from the first communication unit to the mobile terminal that is the source of the request information. The communication system according to claim 1 or 2. The communication system according to any one of claims 1 to 3, wherein an expiration date is set in the first information. Third information is associated with each of the plurality of specific areas in the inner area.
The communication system according to any one of claims 1 to 4, wherein the mobile terminal is configured to acquire the third information in one or more specific areas among the plurality of specific areas. The communication system according to claim 5, further comprising an acquisition unit for acquiring the third information from the mobile terminal in the inner region. There are a plurality of receiving systems, each of which is provided in the plurality of specific areas.
The communication system according to claim 5 or 6, wherein the third information is output from each of the plurality of receiving systems to the mobile terminal. The receiving system is provided in each of the plurality of specific areas in the inner area, and is configured to manage entry and exit to the corresponding specific area.
The communication system according to any one of claims 1 to 7, wherein the first information includes information on whether or not to enter or leave the corresponding specific area. The receiving system is a lock management system provided for each of a plurality of doors in the inner region and managing the locking and unlocking of the corresponding doors.
The communication system according to any one of claims 1 to 7, wherein the first information includes information on whether or not the corresponding door can be locked and unlocked. The communication system according to claim 2, wherein the relay system is configured to manage entry and exit from the gate to the inner region based on the request information. The communication system according to any one of claims 1 to 10.
A comprehensive communication system provided at the gate and comprising a relay system for relaying communication between the mobile terminal and the first communication unit. The communication system according to any one of claims 1 to 10.
A comprehensive communication system including a plurality of receiving systems provided in the inner region and acquiring the second information from the second communication unit. It is located at the gate that separates the inner and outer areas of the facility.
A processing unit that performs the first authentication using the identification information included in the request information from the mobile terminal in the outer region, and a first communication that outputs the first information that is encrypted data to the mobile terminal. A communication system including a unit and a second communication unit that outputs second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. , A relay system that relays communication with the mobile terminal.
At least one of the request information and the first information is relayed,
When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information.
The second communication unit is a relay system that outputs the second information before the processing unit performs the first authentication. It is provided in the inner area of the inner area and the outer area of the facility separated by the gate.
A processing unit that performs the first authentication using the identification information included in the request information from the mobile terminal in the outer region, and when the processing unit succeeds in the authentication by the first authentication, the mobile terminal is encrypted. For the first communication unit that outputs the first information that is data and the receiving system that can communicate with the mobile terminal in the inner region, the second information that is the key information for decoding the first information is transmitted. The second information is received from the communication system including the second communication unit for output, and the second information is received.
When the first information is received from the mobile terminal, the second authentication for authenticating the mobile terminal is performed using the first information and the second information.
The second communication unit is a receiving system that outputs the second information before the processing unit performs the first authentication. A processing step of performing the first authentication using the identification information included in the request information from the mobile terminal in the outer area of the inner area and the outer area of the facility separated by the gate, and
When the processing step succeeds in the authentication by the first authentication, the first communication step for outputting the first information which is the encrypted data to the mobile terminal and the first communication step.
It has a second communication step of outputting second information which is key information for decoding the first information to a receiving system capable of communicating with the mobile terminal in the inner region.
When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information.
The second communication step is a communication method for outputting the second information before the processing step performs the first authentication. On the computer
A processing function that performs the first authentication using the identification information included in the request information from the mobile terminal in the outer area of the inner area and the outer area of the facility separated by the gate, and
When the processing function succeeds in the authentication by the first authentication, the first communication function that outputs the first information which is the encrypted data to the mobile terminal and the first communication function.
A program for realizing a second communication function for outputting second information, which is key information for decoding the first information, to a receiving system capable of communicating with the mobile terminal in the inner region. There,
When the receiving system receives the first information from the mobile terminal, the receiving system performs a second authentication for authenticating the mobile terminal using the first information and the second information.
The second communication function is a program that outputs the second information before the processing function performs the first authentication.

Images