WO2023053164A1 - Information processing system, information processing device, information processing method, and program - Google Patents

Information processing system, information processing device, information processing method, and program Download PDF

Info

Publication number
WO2023053164A1
WO2023053164A1 PCT/JP2021/035510 JP2021035510W WO2023053164A1 WO 2023053164 A1 WO2023053164 A1 WO 2023053164A1 JP 2021035510 W JP2021035510 W JP 2021035510W WO 2023053164 A1 WO2023053164 A1 WO 2023053164A1
Authority
WO
WIPO (PCT)
Prior art keywords
distributed file
unit
information processing
information
authentication
Prior art date
Application number
PCT/JP2021/035510
Other languages
French (fr)
Japanese (ja)
Inventor
雄介 道場
清 友村
Original Assignee
エアトラスト株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by エアトラスト株式会社 filed Critical エアトラスト株式会社
Priority to PCT/JP2021/035510 priority Critical patent/WO2023053164A1/en
Publication of WO2023053164A1 publication Critical patent/WO2023053164A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G06F21/35—User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data

Definitions

  • the present invention relates to an information processing system, an information processing device, an information processing method, and a program.
  • login authentication is performed to authenticate that the user is an authorized user.
  • the individual ID assigned to the mobile terminal is registered in the server, and the server registers the individual ID sent from the mobile terminal with the server.
  • a login authentication system that performs login authentication by determining whether or not a given individual ID matches (see Patent Document 1).
  • An information processing system of the present invention is an information processing system in which a mobile terminal device, an information processing device, and a management device are communicably connected, and comprises a distributed processing section, a first storage section, and a second storage section. , a first communication unit, a second communication unit, a third communication unit, a fourth communication unit, a first restoration processing unit, a login authentication unit, a second restoration processing unit, and a third storage unit Prepare.
  • the distribution processing unit distributes the authentication information to the first distributed file and the second distributed file by the secret sharing method, and distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method.
  • the first storage unit stores the first distributed file and the third distributed file in the mobile terminal device.
  • the second storage unit stores the second distributed file and the fourth distributed file in the management device.
  • the first communication unit transmits the first distributed file and the third distributed file stored in the first storage unit from the mobile terminal device to the information processing device by short-range wireless communication.
  • the second communication unit receives the first distributed file and the third distributed file from the mobile terminal device through the short-range wireless communication.
  • the third communication unit transmits the second distributed file and the fourth distributed file stored in the second storage unit from the management device to the information processing device via a network.
  • the fourth communication unit receives the second distributed file and the fourth distributed file from the management device via the network.
  • the first restoration processing unit restores the authentication information using the first distributed file received by the second communication unit and the second distributed file received by the fourth communication unit.
  • the login authentication unit performs login authentication of the information processing device using the authentication information restored by the first restoration processing unit.
  • the second restoration processing unit restores the third distributed file received by the second communication unit and the third distributed file received by the fourth communication unit in response to login processing to the information processing device being performed. 4 distributed files to restore the user profile.
  • the third storage unit stores the user profile restored by the second restoration processing unit.
  • user data can be used even when a user logs into any one of a plurality of information processing devices, and user data can be protected more reliably.
  • FIG. 1 is a block diagram showing the configuration of an information processing system according to an embodiment of the present invention
  • FIG. 1 is a block diagram showing the configuration of an information processing device according to an embodiment of the present invention
  • FIG. 1 is a block diagram showing the functional configuration of an information processing system according to an embodiment of the present invention
  • FIG. 7 is a flowchart showing an example of distributed file saving processing of the information processing system according to the embodiment of the present invention
  • It is a flow chart which shows authentication processing concerning an embodiment of the present invention.
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention;
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention;
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention;
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention.
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention.
  • FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention;
  • 4 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention;
  • FIG. 4 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention;
  • FIG. 4 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention;
  • FIG. 1 is a block diagram showing the configuration of an information processing system according to an embodiment of the present invention.
  • the information processing system 1 of FIG. 1 has a server 2, PCs (Personal Computers) 4-1 to 4-n (where n is an integer equal to or greater than 2), and a smart phone 5.
  • FIG. The server 2 is an example of a management device
  • the PCs 4-1 to 4-n are examples of information processing devices
  • the smart phone 5 is an example of a portable terminal device.
  • Server 2, PCs 4-1 to 4-n, and smart phone 5 are connected to network 3 and can communicate with each other. Since PCs 4-1 to 4-n operate in the same manner, they will be collectively referred to as PC 4 in the following description.
  • the PC 4 and smartphone 5 can communicate with each other via short-range wireless communication 6.
  • Bluetooth registered trademark
  • the short-range wireless communication 6 is communication limited to short-range wireless communication with a range of several meters.
  • Each of the server 2, the PC 4, and the smart phone 5 may be any other information processing device. It is desirable that the smartphone 5 be a device that the user U can carry.
  • the smartphone 5 is a mobile phone terminal having a call function, and has a microphone and a speaker inside.
  • the network 3 may be any network such as the Internet, wired or wireless. In this embodiment, large-sized data such as user profiles are transmitted via the network 3 . For this reason, the network 3 is preferably a network capable of high-speed and large-capacity communication, and may be, for example, a network configured by the fifth generation mobile communication system (5G).
  • 5G fifth generation mobile communication system
  • the PC 4 and the smartphone 5 communicate with each other via short-range wireless communication 6, which is Bluetooth (registered trademark), but the present invention is not limited to this.
  • the PC 4 and the smartphone 5 may communicate with each other using any other short-range wireless communication technology.
  • a plurality of each of the server 2 and the smartphone 5 may be provided.
  • a plurality of servers 2 may be provided, and a plurality of smart phones 5 may be provided for one PC 4 .
  • FIG. 2 is a block diagram showing the configuration of the information processing device according to the embodiment of the present invention.
  • the information processing device 10 in FIG. 2 is an example of the configuration of the server 2, the PC 4, and the smart phone 5 shown in FIG.
  • Each of the server 2, the PC 4, and the smartphone 5 may have the entire configuration of the information processing device 10 in FIG. may have a configuration.
  • the information processing device 10 has a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, and a ROM (Read Only Memory) 13.
  • the CPU 11 executes programs stored in the ROM 13 and programs such as an OS (Operating System) and applications loaded from the external memory to the RAM 12 when the external device 17 is an external memory.
  • the CPU 11 implements each functional unit described later by executing a program stored in a readable storage medium such as the RAM 12 and the ROM 13 .
  • a RAM 12 is a main memory of the CPU 11 and functions as a work area and the like.
  • the information processing device 10 has an internal bus 20 .
  • CPU 11 , RAM 12 and ROM 13 are each connected to internal bus 20 . Components connected to the internal bus 20 can communicate with each other via the internal bus 20 .
  • the information processing device 10 has an input/output controller 14 and an input/output device 15 .
  • the input/output controller 14 controls the input/output device 15 .
  • the input/output controller 14 is connected to the internal bus 20 .
  • the input/output device 15 is, for example, a keyboard, pointing device (mouse, touch pad, touch panel, trackball, etc.), display, or the like.
  • the information processing device 10 has a device controller 16 and an external device 17 .
  • the device controller 16 controls the external device 17 .
  • Device controller 16 is connected to internal bus 20 .
  • the external device 17 is various devices such as an external memory, an external microphone, an external speaker, or an external camera.
  • the information processing device 10 has a network interface 18 .
  • the network interface 18 is connected to the network 3 and executes communication control processing with other devices connected to the network 3 .
  • Network interface 18 is connected to internal bus 20 .
  • the information processing device 10 has a short-range wireless communication interface 19 .
  • the short-range wireless communication interface 19 executes communication control processing with other devices by the short-range wireless communication 6 .
  • the short-range wireless communication interface 19 is connected to the internal bus 20 .
  • FIG. 3 is a block diagram showing the functional configuration of the information processing system according to the embodiment of the present invention.
  • the information processing system 1 includes a server 2 , a PC 4 and a smart phone 5 .
  • the smartphone 5 has a short-range wireless communication control unit 501 , a validity confirmation unit 502 , a user authentication unit 503 , a switch control unit 504 , an input/output control unit 505 and a storage unit 506 .
  • Near-field wireless communication control unit 501, validity confirmation unit 502, user authentication unit 503, switch control unit 504, and input/output control unit 505 are realized by CPU 11 installed as hardware in smartphone 5 executing a program. be done.
  • the storage unit 506 is implemented by a memory such as the RAM 12 or ROM installed in the smartphone 5 as hardware.
  • the short-range wireless communication control unit 501 communicates with the PC 4 by the short-range wireless communication 6 when the short-range wireless communication connection is turned on by the switch control unit 504, which will be described later.
  • the validity confirmation unit 502 confirms the validity of the smartphone 5 and the validity of the user. Specifically, the validity confirmation unit 502 executes the following preprocessing and validity confirmation processing.
  • the user U registers smartphone information, which is information about the smartphone 5 , in the server 2 together with user information when activating a service related to the information processing system 1 at the time of initial registration.
  • the smartphone information is, for example, device information such as IMEI (International Mobile Equipment Identifier), but is not limited to this.
  • the validity confirmation unit 502 sends user information and smartphone information (for example, information input by the user U from the input/output device 15 and information stored in the ROM 13) to the server 2 via the network 3. Send.
  • the server 2 that has received these pieces of information registers the received information in the storage unit 203 .
  • the user U operates the input/output device 15 of the smartphone 5 for which preprocessing has been completed, and activates the application related to the information processing system 1 on the smartphone 5 .
  • the user authentication unit 503 performs personal authentication of the user U using the smartphone 5 .
  • the validity confirmation unit 502 sends the server 2 to the smartphone. Send information and user information.
  • the server 2 collates the information transmitted from the smartphone 5 with the information registered in the storage unit 203 at the initial registration of the preprocessing.
  • the server 2 When the information transmitted from the smartphone 5 matches the information registered in the storage unit 203 as a collation result, the server 2 returns OK to the smartphone 5 . On the other hand, when the information transmitted from the smartphone 5 and the information registered in the storage unit 203 do not match as a result of matching, the server 2 returns NG to the smartphone 5 .
  • the validity confirmation unit 502 determines that the validity has been confirmed when OK is received, and determines that the validity has not been confirmed when NG is received.
  • the storage unit 506 of the smartphone 5 stores the first distributed file F1 and the third distributed file F3.
  • the first distributed file F1 is a distributed file on the smartphone 5 side obtained by performing secret sharing processing on the authentication information D2.
  • the authentication information D2 is information for the user U carrying the smartphone 5 to log in to the PC4.
  • the third distributed file F3 is a distributed file on the smartphone 5 side obtained by performing secret sharing processing on the user profile D3.
  • User profile D3 includes user data, including files created by user U, and configuration files for the operating system and application software executed on PC4. Details of processing using the first distributed file F1 and the third distributed file F3 will be described later.
  • the user authentication unit 503 performs biometric authentication such as fingerprint, iris, face, or vein. Further, the user authentication unit 503 acquires the current location information of the smartphone 5 using, for example, a GPS receiver, and determines that the person has been authenticated when the acquired location information indicates a predetermined location. good too. Further, the user authentication unit 503 may have means for receiving permission from an administrator (for example, a boss), and may determine that personal authentication has been performed when the administrator has given permission. Further, the user authentication unit 503 may determine that the person has been authenticated when the one-time password issued each time is entered correctly. Further, the user authentication unit 503 may perform personal authentication by executing any one or more of the authentication processes described above.
  • the switch control unit 504 switches on/off the short-range wireless communication connection with the PC 4.
  • an application related to the information processing system 1 can be activated on the smart phone 5 .
  • the input/output device 15 of the smartphone 5 displays a screen for accepting an input for switching on/off of the short-range wireless communication connection.
  • the switch control unit 504 switches ON/OFF of the short-range wireless communication connection according to the input from the user U on this screen. That is, according to the switch control unit 504 , the user U can manually switch on/off the short-range wireless communication connection regardless of the distance between the smartphone 5 and the PC 4 .
  • the input/output control unit 505 reads data from the storage unit 506 and writes data to the storage unit 506 .
  • the input/output control unit 505 stores the first distributed file F1 and the third distributed file F3 previously received from the PC 4 in the storage unit 506 .
  • the input/output control unit 505 may receive the distributed file from the PC 4 via the network 3 or may receive the distributed file from the PC 4 via the short-range wireless communication 6 .
  • the input/output control unit 505 reads the first distributed file F1 from the storage unit 506 and transmits it to the PC 4 via the short-range wireless communication 6 at the time of login authentication, which will be described later in detail. Also, after the login authentication is performed, the input/output control unit 505 reads the third distributed file F3 from the storage unit 506 and transmits it to the PC 4 via the short-range wireless communication 6 . Here, the input/output control unit 505 outputs the first distributed file F1 or the third distributed file F3 to the short-range wireless communication control unit 501, thereby transmitting the first distributed file F1 or the third distributed file F3 to the PC4. do.
  • the server 2 has a control section 201 , a communication section 202 and a storage section 203 .
  • the control unit 201 and the communication unit 202 are implemented by the CPU 11 installed as hardware in the server 2 executing a program.
  • the storage unit 203 is realized by using a memory such as the RAM 12 or ROM installed in the server 2 as hardware.
  • the control unit 201 reads data from the storage unit 203 and writes data to the storage unit 203 .
  • the control unit 201 stores the second distributed file F2 and the fourth distributed file F4 received from the PC 4 in advance in the storage unit 203 .
  • the control unit 201 receives the second distributed file F2 and the fourth distributed file F4 from the PC 4 via the network 3 .
  • the second distributed file F2 is a distributed file on the server 2 side obtained by performing secret sharing processing on the authentication information D2.
  • the fourth distributed file F4 is a distributed file on the server 2 side obtained by performing secret sharing processing on the user profile D3. Details of processing using the second distributed file F2 and the fourth distributed file F4 will be described later.
  • the control unit 201 reads the second distributed file F2 from the storage unit 203 and transmits it to the PC 4 via the network 3 at the time of login authentication, which will be described later in detail. Further, after login authentication is performed, the control unit 201 reads the fourth distributed file F4 from the storage unit 203 and transmits it to the PC 4 via the network 3 . Here, the control unit 201 transmits the second distributed file F2 or the fourth distributed file F4 to the PC4 by outputting the second distributed file F2 or the fourth distributed file F4 to the communication unit 202 .
  • the communication unit 202 communicates with other devices such as the PC 4 via the network 3.
  • the storage unit 203 stores the second distributed file F2 and the fourth distributed file F4 as described above.
  • the second distributed file F2 and the fourth distributed file F4 are associated with the identification information of the smartphone 5 and stored in the storage unit 203 .
  • the storage unit 203 also stores the following information in addition to the second distributed file F2 and the fourth distributed file F4.
  • (1) User information (2) Usage information (3) Log management information (4) Tenant management information (5) Contract information
  • the control unit 201 executes the following processes. (1) Processing of user information in storage unit 203 (registration, update, deletion, reference, etc.) (2) Processing (searching, referencing, etc.) for usage status information in the storage unit 203 (3) Processing for log management information in storage unit 203 (search, reference, etc.) (4) Processing for tenant management information in the storage unit 203 (registration, update, deletion, reference, etc.) (5) Processing for contract information in storage unit 203 (registration, update, deletion, reference, etc.)
  • the PC 4 includes a communication unit 401, a distance measurement unit 402, a pairing state grasping unit 403, a lock control unit 404, a distributed processing unit 405, a short-range wireless communication control unit 406, an input/output control unit 407, a first restoration processing unit 408, It has a login authentication unit 409 , a second restoration processing unit 410 , a log acquisition unit 411 and a storage unit 412 .
  • Communication unit 401, distance measurement unit 402, pairing state grasping unit 403, lock control unit 404, distributed processing unit 405, short-range wireless communication control unit 406, input/output control unit 407, first restoration processing unit 408, login authentication unit 409, the second restoration processing unit 410, and the log acquisition unit 411 are implemented by the CPU 11 installed as hardware in the PC 4 executing programs.
  • the storage unit 412 is implemented using a memory such as a RAM 12 or a ROM installed in the PC 4 as hardware.
  • the communication unit 401 communicates with other devices such as the server 2 via the network 3.
  • the distance measurement unit 402 measures the distance between the PC 4 and the smartphone 5 based on the radio wave intensity [dBm] of the short-range wireless communication 6. For example, the distance measurement unit 402 measures the radio field strength [dBm] of the short-range wireless communication 6, and measures the distance D between the PC 4 and the smartphone 5 using the Friis transmission formula. It should be noted that as the distance between the PC 4 and the smartphone 5 increases, the radio wave intensity [dBm] of the short-range wireless communication 6 decreases.
  • the pairing state grasping unit 403 grasps the pairing state of the short-range wireless communication 6 (whether it is currently connected or not).
  • the lock control unit 404 locks the PC 4 to make it unusable.
  • the first threshold Th1 may be 3 [m].
  • the lock control unit 404 unlocks the PC 4 and makes it available.
  • the second threshold Th2 may be 1 [m].
  • the operability for the user U may deteriorate due to repeated switching between locking and unlocking of the PC 4 . This is because the radio wave intensity of the short-range wireless communication 6 fluctuates under the influence of the radio wave environment. Therefore, in the present embodiment, the second threshold Th2 is smaller than the first threshold Th1.
  • the distributed processing unit 405 performs anonymization processing in the secret sharing technology.
  • Anonymization processing is processing for distributing target data. Any method of known secret sharing technology may be used as the data distribution method.
  • the distributed processing of the distributed processing unit 405 distributes the original data to m distributed files by threshold distribution, and uses any k (m>k) distributed files among the m distributed files to reproduce the original data. Data may be restored.
  • the distributed processing of the distributed processing unit 405 distributes the original data to m distributed files by AONT (All or Nothing Transform), and restores the original data using all m distributed files. can be anything.
  • the storage unit 412 stores setting information D1.
  • the setting information D1 includes the following information. (1) Information on the storage location where the distributed file is stored after the secret sharing processing by the distribution processing unit 405 (storage location (directory/folder) on the server 2 side and storage location (directory/folder) on the smartphone 5 side) (2) Server 2 connection information (URL (Uniform Resource Locator), port number, etc.) (3) Connection information with smartphone 5 via short-range wireless communication 6 (device information of smartphone 5, link key, etc.)
  • the storage unit 412 stores authentication information D2.
  • the authentication information D2 is information for the user U carrying the smartphone 5 to log into the PC4.
  • the distributed processing unit 405 distributes the authentication information D2 and acquires the first distributed file F1 on the smartphone 5 side and the second distributed file F2 on the server 2 side.
  • the first distributed file F1 and the second distributed file F2 are separate files.
  • the short-range wireless communication control unit 406 communicates with the smartphone 5 by short-range wireless communication 6.
  • the input/output control unit 407 reads data from the storage unit 412 and writes data to the storage unit 412 .
  • the input/output control unit 407 reads the user profile D3 from the storage unit 412 and writes the user profile D3 to the storage unit 412 . Details of the user profile D3 will be described later.
  • the first restoration processing unit 408 executes restoration processing of the authentication information D2 for which the secret sharing processing has been performed by the distribution processing unit 405. That is, the first restoration processing unit 408 restores the authentication information D2 using the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2 .
  • the login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication processing by, for example, the Credential Provider.
  • the second restoration processing unit 410 executes restoration processing of the user profile D3 for which secret sharing processing has been performed by the distribution processing unit 405. That is, the second restoration processing unit 410 restores the user profile D3 using the third distributed file F3 received from the smartphone 5 and the fourth distributed file F4 received from the server 2 .
  • the log acquisition unit 411 records events occurring in each process of the PC 4 as logs. This is recorded, for example, as an event log.
  • the log acquisition unit 411 transmits the recorded log to the server 2 via the network 3 .
  • the log acquisition unit 411 transmits the log to the server 2 by outputting the log to the communication unit 401 .
  • FIG. 4 is a flowchart showing an example of distributed file saving processing of the information processing system according to the embodiment of the present invention.
  • the information processing system 1 performs user registration (step S401). Specifically, the user U inputs user information using the input/output device 15 of the smartphone 5 or the input/output device 15 of the PC 4 .
  • the PC 4 that receives the input of the user information creates authentication information D2 associated with the input user information and stores the authentication information D2 in the storage unit 412 .
  • the PC 4 that receives the input of the user information stores the input user information as the setting information D1.
  • the PC 4 that receives the input of the user information transmits the input user information to the server 2 .
  • the server 2 that has received the user information from the PC 4 stores the received user information in the storage unit 203 .
  • the information processing system 1 distributes the authentication information D2 saved in step S401 by the distribution processing unit 405, and acquires the first distributed file F1 on the smartphone 5 side and the second distributed file F2 on the server 2 side (step S402).
  • the information processing system 1 executes pairing of the smartphone 5 and the PC 4 for short-range wireless communication 6 (step S403).
  • a link key is generated by this pairing, and the smartphone 5 and the PC 4 perform encrypted communication using this link key.
  • the information processing system 1 transmits the first distributed file F1 on the smartphone 5 side from the PC 4 to the smartphone 5 via the short-range wireless communication 6 paired in step S403.
  • the information processing system 1 also transmits the second distributed file F2 on the server 2 side from the PC 4 to the server 2 via the network 3 (step S404).
  • the smartphone 5 that has received the first distributed file F1 stores the first distributed file F1 in the storage unit 506 .
  • the server 2 that has received the second distributed file F2 stores the second distributed file F2 in the storage unit 203 .
  • FIG. 5 is a flow chart showing authentication processing according to an embodiment of the present invention.
  • more secure login authentication is made possible by performing the following three-stage authentication.
  • the information processing system 1 executes personal authentication processing (step S501). Specifically, the user authentication unit 503 of the smartphone 5 authenticates whether or not an authorized user U is operating the smartphone 5 based on pre-registered biometric information (fingerprint information, iris information, face information, etc.). . If the user authentication unit 503 succeeds in authentication, the switch control unit 504 permits the use of the short-range wireless communication 6, and proceeds to step S502. On the other hand, if the user authentication unit 503 fails authentication, the switch control unit 504 rejects the use of the short-range wireless communication 6, and terminates the processing according to this flowchart.
  • biometric information fingerprint information, iris information, face information, etc.
  • the information processing system 1 executes device authentication processing (step S502). Specifically, the short-range wireless communication control unit 501 of the smartphone 5 attempts connection with the short-range wireless communication control unit 406 of the PC 4 via the short-range wireless communication 6 . The information processing system 1 determines that device authentication has succeeded if this connection succeeds, and determines that device authentication has failed if this connection fails. If device authentication is successful, the process proceeds to step S503. If the device authentication fails, the processing according to this flowchart ends.
  • the information processing system 1 executes login authentication processing (step S503).
  • the first distributed file F1 on the smartphone 5 side is read from the storage unit 506 and transmitted to the PC 4 via the short-range wireless communication 6 .
  • the second distributed file F2 on the server 2 side is read from the storage unit 203 and transmitted to the PC 4 via the network 3 .
  • the first restoration processing unit 408 restores the authentication information D2 by executing restoration processing using the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2 .
  • the login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to execute login authentication processing.
  • the login authentication unit 409 executes login of the user U to the PC 4 .
  • the login authentication unit 409 rejects the login of the user U to the PC 4 .
  • FIG. 5 are diagrams for explaining the login processing of the PC according to the embodiment of the present invention.
  • distributed files obtained by performing secret sharing processing on the authentication information D2 used for login are distributed and stored in the server 2 and the smartphone 5 .
  • the smartphone 5 stores the first distributed file F1
  • the server 2 stores the second distributed file F2. If the PC 4 and the smartphone 5 are outside the range of the short-range wireless communication 6 (out of communication range), the first distributed file F1 and the second distributed file F2 are distributed and saved in the smartphone 5 and the server 2, respectively.
  • the information used (authentication information D2) is rendered meaningless by secret sharing processing. Therefore, even if the smartphone 5 is lost, the authentication information D2 will not be leaked.
  • the short-range wireless communication control unit 406 of the PC 4 and the short-range wireless communication control unit 501 of the smartphone 5 perform the short-range wireless communication. Run the process to establish 6.
  • the first distributed file F1 saved in the smartphone 5 is transmitted to the PC 4, and the second distributed file F2 saved in the server 2 is transferred to the PC 4. sent.
  • the authentication information D2 is restored by arranging the first distributed file F1 and the second distributed file F2. This enables the user U to log in to the PC 4 using the smart phone 5 .
  • the short-range wireless communication 6 is disconnected when the smartphone 5 carried by the user U moves out of the range of the short-range wireless communication 6.
  • FIG. 11 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention. The processing shown in this sequence diagram is executed when the PC 4 and the smartphone 5 are within the range of the short-range wireless communication 6 .
  • the input/output control unit 505 of the smartphone 5 reads the first distributed file F1 from the storage unit 506 and outputs the read first distributed file F1 to the short-range wireless communication control unit 501.
  • the short-range wireless communication control unit 501 transmits the first distributed file F1 output from the input/output control unit 505 to the PC 4 via the short-range wireless communication 6 (step S1101). At this time, the short-range wireless communication control unit 501 also transmits identification information for identifying the smartphone 5 .
  • the short-range wireless communication control unit 406 of the PC 4 When the short-range wireless communication control unit 406 of the PC 4 receives the first distributed file F1 and the identification information of the smartphone 5 from the smartphone 5, the communication unit 401 sends a transmission request for the second distributed file F2 to the server 2 via the network 3. (step S1102). At this time, the communication unit 401 also transmits the identification information of the smartphone 5 received from the smartphone 5 .
  • the control unit 201 stores the second distributed file F2 corresponding to the received identification information of the smartphone 5 in the storage unit. 203 and outputs the read second distributed file F2 to the communication unit 202 .
  • the communication unit 202 transmits the second distributed file F2 output from the control unit 201 to the PC 4 via the network 3 (step S1103).
  • the first restoration processing unit 408 restores the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2. is used to restore the authentication information D2 (step S1104). This restores the authentication information D2.
  • the login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication processing for the PC 4 (step S1105).
  • the login authentication unit 409 executes login of the user U who owns the smart phone 5 to the PC 4 .
  • the login authentication unit 409 rejects the login of the user U who owns the smart phone 5 to the PC 4 .
  • the short-range wireless communication control unit 406 of the PC 4 transmits a transmission request for the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6 (step S1106).
  • the short-range wireless communication control unit 501 of the smartphone 5 receives a transmission request for the third distributed file F3 from the PC 4, the input/output control unit 505 reads the third distributed file F3 from the storage unit 506, and the read third distributed file F3 is output to short-range wireless communication control section 501 .
  • the short-range wireless communication control unit 501 transmits the third distributed file F3 output from the input/output control unit 505 to the PC 4 via the short-range wireless communication 6 (step S1107).
  • the communication unit 401 transmits a transmission request for the fourth distributed file F4 to the server 2 via the network 3 (step S1108). ). At this time, the communication unit 401 also transmits the identification information of the smartphone 5 .
  • the control unit 201 stores the fourth distributed file F4 corresponding to the received identification information of the smartphone 5 in the storage unit. 203 and outputs the read fourth distributed file F4 to the communication unit 202 .
  • the communication unit 202 transmits the fourth distributed file F4 output from the control unit 201 to the PC 4 via the network 3 (step S1109).
  • the second restoration processing unit 410 restores the third distributed file F3 received from the smartphone 5 and the fourth distributed file F4 received from the server 2. is used to restore the user profile D3 (step S1110). This restores the user profile D3.
  • the storage unit 412 stores the user profile D3 restored by the second restoration processing unit 410 (step S1111).
  • User profile D ⁇ b>3 stored in storage unit 412 includes user data including files created by user U who owns smartphone 5 , and setting files for the operating system and application software executed by PC 4 .
  • the user U can use the user data and applications using the PC4.
  • a series of processes of the PC 4 shown in FIG. 11 are executed in the plurality of PCs 4-1 to 4-n shown in FIG. Therefore, even if the user U who owns the smart phone 5 logs into any of the plurality of PCs 4-1 to 4-n, the user profile D3 corresponding to the logged-in user U can be restored to the PC. Also, the authentication information D2 and the user profile D3 are encrypted by secret sharing processing and distributed to the server 2 and the smartphone 5 . Therefore, according to the present invention, the user data can be used even if the user U logs into any one of the plurality of PCs 4-1 to 4-n, and the user data can be protected more reliably. be able to.
  • FIG. 12 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention. The processing shown in this sequence diagram is executed following the processing shown in FIG.
  • the distribution processing unit 405 of the PC 4 performs secret sharing processing on the user profile D3 stored in the storage unit 412. I do. Accordingly, the distributed processing unit 405 generates a third distributed file F3 on the smartphone 5 side and a fourth distributed file F4 on the server 2 side (step S1202).
  • the short-range wireless communication control unit 406 of the PC 4 transmits the third distributed file F3 generated by the distributed processing unit 405 to the smartphone 5 via the short-range wireless communication 6 (step S1203).
  • the short-range wireless communication control unit 501 of the smartphone 5 receives the third distributed file F3 from the PC 4, the input/output control unit 505 stores the received third distributed file F3 in the storage unit 506 (step S1204).
  • the short-range wireless communication control unit 501 transmits a storage completion notification to the PC 4 via the short-range wireless communication 6 (step S1205).
  • Step S1206 When the short-range wireless communication control unit 406 of the PC 4 receives the storage completion notification from the smartphone 5, the communication unit 401 transmits the fourth distributed file F4 generated by the distributed processing unit 405 to the server 2 via the network 3. (Step S1206).
  • the control unit 201 stores the received fourth distributed file F4 in the storage unit 203 (step S1207).
  • the communication unit 202 transmits a storage completion notification to the PC 4 via the network 3 (step S1208).
  • the input/output control section 407 deletes the user profile D3 from the storage section 412 (step S1209). In this way, the user profile D3 is erased from the storage unit 412 of the PC 4 while the secret sharing process is performed on the user profile D3. This makes it possible to protect user data more reliably.
  • the information processing system 1 of this embodiment is a system in which the smartphone 5, the PC 4, and the server 2 are communicably connected.
  • the information processing system 1 includes a distributed processing unit 405, a storage unit 506, a storage unit 203, a short-range wireless communication control unit 501, a short-range wireless communication control unit 406, a communication unit 202, a communication unit 401, A first restoration processing unit 408 , a login authentication unit 409 , a second restoration processing unit 410 and a storage unit 412 are provided.
  • the distribution processing unit 405 distributes the authentication information D2 to the first distributed file F1 and the second distributed file F2 by the secret sharing method, and distributes the user profile D3 to the third distributed file F3 and the fourth distributed file by the secret sharing method.
  • the storage unit 506 stores the first distributed file F1 and the third distributed file F3 in the smart phone 5 .
  • the storage unit 203 stores the second distributed file F2 and the fourth distributed file F4 in the server 2 .
  • the short-range wireless communication control unit 501 transmits the first distributed file F1 and the third distributed file F3 stored in the storage unit 506 from the smartphone 5 to the PC 4 by short-range wireless communication 6 .
  • the short-range wireless communication control unit 406 receives the first distributed file F1 and the third distributed file F3 from the smartphone 5 via the short-range wireless communication 6 .
  • the communication unit 202 transmits the second distributed file F2 and the fourth distributed file F4 stored by the storage unit 203 from the server 2 to the PC 4 via the network 3 .
  • the communication unit 401 receives the second distributed file F2 and the fourth distributed file F4 from the server 2 via the network 3 .
  • the first restoration processing unit 408 restores the authentication information D2 using the first distributed file F1 received by the short-range wireless communication control unit 406 and the second distributed file F2 received by the communication unit 401 .
  • the login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication of the PC4.
  • the second restoration processing unit 410 restores the third distributed file F3 received by the short-range wireless communication control unit 406 and the fourth distributed file F4 received by the communication unit 401 in response to the login processing to the PC 4 being performed. to restore the user profile D3.
  • Storage unit 412 stores user profile D3 restored by second restoration processing unit 410 .
  • the user data can be used even if the user U logs into any one of the plurality of PCs 4-1 to 4-n, and the user data can be protected more reliably. can.
  • the distribution processing unit 405 distributes the user profile D3 to the third distributed file F3 and the fourth distributed file F4 by the secret sharing method
  • the short-range wireless communication control unit 406 transmits the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6, and the communication unit 401 transmits the fourth distributed file F4 to the server 2 via the network 3, and stores it.
  • a unit 412 deletes the user profile D3. This makes it possible to protect user data more reliably.
  • the lock control unit 404 controls whether to lock the PC 4 based on the radio wave intensity of the short-range wireless communication 6.
  • the distributed processing unit 405 distributes the user profile D3 to the third distributed file F3 and the fourth distributed file F4 by the secret sharing method, and performs short-range wireless communication control.
  • the unit 406 may transmit the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6, and the communication unit 401 may transmit the fourth distributed file F4 to the server 2 via the network 3.
  • the storage unit 203 of the server 2 stores not only the second distributed file F2 and the fourth distributed file F4, but also smartphone information, user information, etc., but the present invention is not limited to this.
  • the second distributed file F2, the fourth distributed file F4, and other information may be stored in separate servers.
  • a program for realizing all or part of the functions of the server 2, the PC 4, and the smartphone 5 in this embodiment is recorded on a computer-readable recording medium, and the program recorded on this recording medium is transferred to the computer system. All or part of the processing performed by the server 2, the PC 4, and the smartphone 5 may be performed by reading and executing the software.
  • the "computer system” referred to here includes hardware such as an OS and peripheral devices. Also, the “computer system” includes a WWW system provided with a home page providing environment (or display environment).
  • the term “computer-readable recording medium” refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems.
  • “computer-readable recording medium” means a volatile memory (RAM) inside a computer system that acts as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. , includes those that hold the program for a certain period of time.
  • RAM volatile memory
  • the program may be transmitted from a computer system storing this program in a storage device or the like to another computer system via a transmission medium or by transmission waves in a transmission medium.
  • the "transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
  • the program may be for realizing part of the functions described above. Further, it may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.
  • the smart phone 5 may execute part of the functions of the PC 4 , and the PC 4 may execute part of the functions of the smart phone 5 .
  • each function of the distance measurement unit 402 and the distributed processing unit 405 may be provided in the smart phone 5 .

Abstract

A first reconstruction processing unit (408) reconstructs authentication information (D2) by using a first distributed file (F1) received from a mobile terminal device (5) and a second distributed file (F2) received from a management device (2). A login authentication unit (409) authenticates a login for an information processing device (4) by using the authentication information (D2) reconstructed by the first reconstruction processing unit (408). In response to a login to the information processing device (4), a second reconstruction processing unit (410) reconstructs a user profile (D3) by using a third distributed file (F3) received from the mobile terminal device (5) and a fourth distributed file (F4) received from the management device (2). A storage unit (412) stores the user profile (D3) reconstructed by the second reconstruction processing unit (410).

Description

情報処理システム、情報処理装置、情報処理方法、およびプログラムInformation processing system, information processing device, information processing method, and program
　本発明は、情報処理システム、情報処理装置、情報処理方法、およびプログラムに関する。 The present invention relates to an information processing system, an information processing device, an information processing method, and a program.
　従来、情報処理装置やアプリケーションをユーザーが利用可能な状態にするために、ユーザーがログインすることが知られている。このログインにおいては、正当なユーザーであることを認証するログイン認証が行われる。例えば、ユーザーが携帯端末からサーバにログインする際のログイン認証において、携帯端末に割り当てられた個体ＩＤをサーバに登録しておき、サーバにおいて、携帯端末から送信されてきた個体ＩＤとサーバに登録してある個体ＩＤとが一致するか否かを判定することで、ログイン認証を行うログイン認証システムが知られている（特許文献１参照）。 Conventionally, it is known that users log in to make information processing devices and applications available to users. In this login, login authentication is performed to authenticate that the user is an authorized user. For example, in login authentication when a user logs into a server from a mobile terminal, the individual ID assigned to the mobile terminal is registered in the server, and the server registers the individual ID sent from the mobile terminal with the server. There is known a login authentication system that performs login authentication by determining whether or not a given individual ID matches (see Patent Document 1).
特開２００５－１６５４１８号公報JP-A-2005-165418
　しかしながら、従来のログイン認証システムでは、ユーザーによって作成されたファイルなどのユーザーデータを使用するためには、そのユーザーデータを格納している特定の情報処理装置にログインする必要があり、他の情報処理装置を用いてユーザーデータを使用することができなかった。また、情報処理装置に格納されているユーザーデータは暗号化されていないため、ユーザーデータの保護がセキュリティ上十分ではなかった。 However, in the conventional login authentication system, in order to use user data such as files created by the user, it is necessary to log in to a specific information processing device that stores the user data. User data could not be used with the device. In addition, since the user data stored in the information processing device is not encrypted, the protection of the user data is insufficient in terms of security.
　本発明の情報処理システムは、携帯端末装置と、情報処理装置と、管理装置とが通信可能に接続された情報処理システムであって、分散処理部と、第１記憶部と、第２記憶部と、第１通信部と、第２通信部と、第３通信部と、第４通信部と、第１復元処理部と、ログイン認証部と、第２復元処理部と、第３記憶部とを備える。前記分散処理部は、認証情報を秘密分散法にて第１分散ファイルおよび第２分散ファイルに分散するとともに、ユーザープロファイルを前記秘密分散法にて第３分散ファイルおよび第４分散ファイルに分散する。前記第１記憶部は、前記第１分散ファイルおよび前記第３分散ファイルを前記携帯端末装置に記憶する。前記第２記憶部は、前記第２分散ファイルおよび前記第４分散ファイルを前記管理装置に記憶する。前記第１通信部は、前記第１記憶部によって記憶された前記第１分散ファイルおよび前記第３分散ファイルを、近距離無線通信によって前記携帯端末装置から前記情報処理装置に送信する。前記第２通信部は、前記近距離無線通信によって前記携帯端末装置から前記第１分散ファイルおよび前記第３分散ファイルを受信する。前記第３通信部は、前記第２記憶部によって記憶された前記第２分散ファイルおよび前記第４分散ファイルを、ネットワークを介して前記管理装置から前記情報処理装置に送信する。前記第４通信部は、前記ネットワークを介して前記管理装置から前記第２分散ファイルおよび前記第４分散ファイルを受信する。前記第１復元処理部は、前記第２通信部によって受信された前記第１分散ファイルと前記第４通信部によって受信された前記第２分散ファイルとを用いて、前記認証情報を復元する。前記ログイン認証部は、前記第１復元処理部によって復元された前記認証情報を用いて、前記情報処理装置のログイン認証を行う。前記第２復元処理部は、前記情報処理装置に対するログイン処理が行われたことに応じて、前記第２通信部によって受信された前記第３分散ファイルと前記第４通信部によって受信された前記第４分散ファイルとを用いて、前記ユーザープロファイルを復元する。前記第３記憶部は、前記第２復元処理部によって復元された前記ユーザープロファイルを記憶する。 An information processing system of the present invention is an information processing system in which a mobile terminal device, an information processing device, and a management device are communicably connected, and comprises a distributed processing section, a first storage section, and a second storage section. , a first communication unit, a second communication unit, a third communication unit, a fourth communication unit, a first restoration processing unit, a login authentication unit, a second restoration processing unit, and a third storage unit Prepare. The distribution processing unit distributes the authentication information to the first distributed file and the second distributed file by the secret sharing method, and distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method. The first storage unit stores the first distributed file and the third distributed file in the mobile terminal device. The second storage unit stores the second distributed file and the fourth distributed file in the management device. The first communication unit transmits the first distributed file and the third distributed file stored in the first storage unit from the mobile terminal device to the information processing device by short-range wireless communication. The second communication unit receives the first distributed file and the third distributed file from the mobile terminal device through the short-range wireless communication. The third communication unit transmits the second distributed file and the fourth distributed file stored in the second storage unit from the management device to the information processing device via a network. The fourth communication unit receives the second distributed file and the fourth distributed file from the management device via the network. The first restoration processing unit restores the authentication information using the first distributed file received by the second communication unit and the second distributed file received by the fourth communication unit. The login authentication unit performs login authentication of the information processing device using the authentication information restored by the first restoration processing unit. The second restoration processing unit restores the third distributed file received by the second communication unit and the third distributed file received by the fourth communication unit in response to login processing to the information processing device being performed. 4 distributed files to restore the user profile. The third storage unit stores the user profile restored by the second restoration processing unit.
　本発明の更なる特徴及び態様は、添付図面を参照し、以下に述べる実施形態の詳細な説明から明らかとなるであろう。 Further features and aspects of the present invention will become apparent from the detailed description of the embodiments set forth below, with reference to the accompanying drawings.
　本発明によれば、ユーザーが複数の情報処理装置のうちのいずれの情報処理装置にログインしてもユーザーデータを使用することができるとともに、ユーザーデータをより確実に保護することができる。 According to the present invention, user data can be used even when a user logs into any one of a plurality of information processing devices, and user data can be protected more reliably.
本発明の実施形態に係る情報処理システムの構成を示すブロック図である。1 is a block diagram showing the configuration of an information processing system according to an embodiment of the present invention; FIG. 本発明の実施形態に係る情報処理装置の構成を示すブロック図である。1 is a block diagram showing the configuration of an information processing device according to an embodiment of the present invention; FIG. 本発明の実施形態に係る情報処理システムの機能構成を示すブロック図である。1 is a block diagram showing the functional configuration of an information processing system according to an embodiment of the present invention; FIG. 本発明の実施形態に係る情報処理システムの分散ファイル保存処理の一例を示すフローチャートである。7 is a flowchart showing an example of distributed file saving processing of the information processing system according to the embodiment of the present invention; 本発明の実施形態に係る認証処理を示すフローチャートである。It is a flow chart which shows authentication processing concerning an embodiment of the present invention. 本発明の実施形態に係るＰＣのログイン処理を説明するための図である。FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention; 本発明の実施形態に係るＰＣのログイン処理を説明するための図である。FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention; 本発明の実施形態に係るＰＣのログイン処理を説明するための図である。FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention; 本発明の実施形態に係るＰＣのログイン処理を説明するための図である。FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention; 本発明の実施形態に係るＰＣのログイン処理を説明するための図である。FIG. 4 is a diagram for explaining login processing of the PC according to the embodiment of the present invention; 本発明の実施形態に係る情報処理システムによって行われる処理を示すシーケンス図である。4 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention; FIG. 本発明の実施形態に係る情報処理システムによって行われる処理を示すシーケンス図である。4 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention; FIG.
　以下、本発明に係る情報処理システムについて、図面を参照しながら詳細に説明する。なお、以下に示す実施形態は本発明に係るシステムの好適な具体例であり、一般的なハードウェア、ソフトウェア構成に即した種々の限定を付している場合がある。しかしながら、本発明の技術的範囲は、特に本発明を限定する記載がない限り、これらの態様に限定されるものではない。また、以下に示す実施形態における構成要素は、適宜、既存の構成要素等との置き換えが可能であり、かつ、他の既存の構成要素との組み合わせを含む様々なバリエーションが可能である。したがって、以下に示す実施形態の記載をもって、特許請求の範囲に記載された発明の内容を限定するものではない。 The information processing system according to the present invention will be described in detail below with reference to the drawings. It should be noted that the embodiments shown below are preferred specific examples of the system according to the present invention, and may have various limitations in line with general hardware and software configurations. However, the technical scope of the present invention is not limited to these aspects unless otherwise specified. In addition, the constituent elements in the embodiments shown below can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the embodiments shown below does not limit the content of the invention described in the claims.
　図１は、本発明の実施形態に係る情報処理システムの構成を示すブロック図である。図１の情報処理システム１は、サーバ２、ＰＣ（Personal Computer）４－１～４－ｎ（ｎ：２以上の整数）、およびスマートフォン５を有する。サーバ２は管理装置の一例であり、ＰＣ４－１～４－ｎは情報処理装置の一例であり、スマートフォン５は携帯端末装置の一例である。サーバ２、ＰＣ４－１～４－ｎ、およびスマートフォン５は、ネットワーク３に接続され、相互に通信することが可能である。なお、ＰＣ４－１～４－ｎは同様の動作を行うため、以降の説明においては、これらをまとめてＰＣ４として説明する。 FIG. 1 is a block diagram showing the configuration of an information processing system according to an embodiment of the present invention. The information processing system 1 of FIG. 1 has a server 2, PCs (Personal Computers) 4-1 to 4-n (where n is an integer equal to or greater than 2), and a smart phone 5. FIG. The server 2 is an example of a management device, the PCs 4-1 to 4-n are examples of information processing devices, and the smart phone 5 is an example of a portable terminal device. Server 2, PCs 4-1 to 4-n, and smart phone 5 are connected to network 3 and can communicate with each other. Since PCs 4-1 to 4-n operate in the same manner, they will be collectively referred to as PC 4 in the following description.
　ＰＣ４とスマートフォン５とは近距離無線通信６で相互に通信することが可能である。本実施形態では、近距離無線通信６の一例として、Ｂｌｕｅｔｏｏｔｈ（登録商標）を用いる。近距離無線通信６は、無線の到達距離が数メートル程度の近距離に限定した通信である。サーバ２、ＰＣ４、およびスマートフォン５のそれぞれは、他の如何なる情報処理装置であってもよい。スマートフォン５は、ユーザーＵが携帯可能な装置であることが望ましい。なお、スマートフォン５は通話機能を有する携帯電話端末であり、内部にマイクロフォンとスピーカを有している。 The PC 4 and smartphone 5 can communicate with each other via short-range wireless communication 6. In this embodiment, Bluetooth (registered trademark) is used as an example of the short-range wireless communication 6 . The short-range wireless communication 6 is communication limited to short-range wireless communication with a range of several meters. Each of the server 2, the PC 4, and the smart phone 5 may be any other information processing device. It is desirable that the smartphone 5 be a device that the user U can carry. Note that the smartphone 5 is a mobile phone terminal having a call function, and has a microphone and a speaker inside.
　ネットワーク３は、インターネット、有線、無線など如何なるネットワークであってもよい。本実施形態においては、ネットワーク３を介してユーザープロファイル等のサイズの大きなデータが送信される。このため、ネットワーク３は、高速かつ大容量の通信が可能なネットワークであることが好ましく、例えば第５世代移動通信システム（５Ｇ）によって構成されるネットワークであってよい。 The network 3 may be any network such as the Internet, wired or wireless. In this embodiment, large-sized data such as user profiles are transmitted via the network 3 . For this reason, the network 3 is preferably a network capable of high-speed and large-capacity communication, and may be, for example, a network configured by the fifth generation mobile communication system (5G).
　本実施形態においては、ＰＣ４とスマートフォン５とはＢｌｕｅｔｏｏｔｈ（登録商標）である近距離無線通信６で相互に通信するが、本発明はこれに限られるものではない。例えば、ＰＣ４とスマートフォン５とは、他の如何なる近距離無線通信技術によって相互に通信するものであってもよい。 In the present embodiment, the PC 4 and the smartphone 5 communicate with each other via short-range wireless communication 6, which is Bluetooth (registered trademark), but the present invention is not limited to this. For example, the PC 4 and the smartphone 5 may communicate with each other using any other short-range wireless communication technology.
　情報処理システム１において、サーバ２およびスマートフォン５のそれぞれは、複数設けられてもよい。例えば、情報処理システム１において、複数のサーバ２が設けられてもよく、１台のＰＣ４に対して複数のスマートフォン５が設けられてもよい。 In the information processing system 1, a plurality of each of the server 2 and the smartphone 5 may be provided. For example, in the information processing system 1 , a plurality of servers 2 may be provided, and a plurality of smart phones 5 may be provided for one PC 4 .
　図２は、本発明の実施形態に係る情報処理装置の構成を示すブロック図である。図２の情報処理装置１０は、図１に示したサーバ２、ＰＣ４、およびスマートフォン５の構成の一例である。サーバ２、ＰＣ４、およびスマートフォン５のそれぞれは、図２の情報処理装置１０のすべての構成を有してもよいし、一部の構成を有してもよいし、図２に記載した以外の構成を有してもよい。 FIG. 2 is a block diagram showing the configuration of the information processing device according to the embodiment of the present invention. The information processing device 10 in FIG. 2 is an example of the configuration of the server 2, the PC 4, and the smart phone 5 shown in FIG. Each of the server 2, the PC 4, and the smartphone 5 may have the entire configuration of the information processing device 10 in FIG. may have a configuration.
　情報処理装置１０は、ＣＰＵ（Central Processing Unit）１１、ＲＡＭ（Random Access Memory）１２、およびＲＯＭ（Read Only Memory）１３を有する。ＣＰＵ１１は、ＲＯＭ１３内に記憶されたプログラムや、外部デバイス１７が外部メモリである場合にこの外部メモリからＲＡＭ１２にロードされたＯＳ（オペレーションシステム）やアプリケーション等のプログラムを実行する。ＣＰＵ１１は、ＲＡＭ１２やＲＯＭ１３などの読み取り可能な記憶媒体に格納されたプログラムを実行することにより、後述する各機能部を実現する。ＲＡＭ１２は、ＣＰＵ１１のメインメモリであり、ワークエリア等として機能する。情報処理装置１０は、内部バス２０を有する。ＣＰＵ１１、ＲＡＭ１２、およびＲＯＭ１３のそれぞれは、内部バス２０に接続される。内部バス２０に接続された各構成同士は、内部バス２０を介して相互に通信が可能である。 The information processing device 10 has a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, and a ROM (Read Only Memory) 13. The CPU 11 executes programs stored in the ROM 13 and programs such as an OS (Operating System) and applications loaded from the external memory to the RAM 12 when the external device 17 is an external memory. The CPU 11 implements each functional unit described later by executing a program stored in a readable storage medium such as the RAM 12 and the ROM 13 . A RAM 12 is a main memory of the CPU 11 and functions as a work area and the like. The information processing device 10 has an internal bus 20 . CPU 11 , RAM 12 and ROM 13 are each connected to internal bus 20 . Components connected to the internal bus 20 can communicate with each other via the internal bus 20 .
　情報処理装置１０は、入出力コントローラ１４および入出力装置１５を有する。入出力コントローラ１４は、入出力装置１５を制御する。入出力コントローラ１４は、内部バス２０に接続される。入出力装置１５は、例えばキーボード、ポインティングデバイス（マウス、タッチパッド、タッチパネル、トラックボールなど）、またはディスプレイなどである。 The information processing device 10 has an input/output controller 14 and an input/output device 15 . The input/output controller 14 controls the input/output device 15 . The input/output controller 14 is connected to the internal bus 20 . The input/output device 15 is, for example, a keyboard, pointing device (mouse, touch pad, touch panel, trackball, etc.), display, or the like.
　情報処理装置１０は、デバイスコントローラ１６および外部デバイス１７を有する。デバイスコントローラ１６は、外部デバイス１７を制御する。デバイスコントローラ１６は、内部バス２０に接続される。外部デバイス１７は、外部メモリ、外部マイク、外部スピーカ、または外部カメラなどの各種デバイスである。 The information processing device 10 has a device controller 16 and an external device 17 . The device controller 16 controls the external device 17 . Device controller 16 is connected to internal bus 20 . The external device 17 is various devices such as an external memory, an external microphone, an external speaker, or an external camera.
　情報処理装置１０は、ネットワークインターフェース１８を有する。ネットワークインターフェース１８は、ネットワーク３に接続されて、ネットワーク３に接続された他の機器との通信制御処理を実行する。ネットワークインターフェース１８は、内部バス２０に接続される。 The information processing device 10 has a network interface 18 . The network interface 18 is connected to the network 3 and executes communication control processing with other devices connected to the network 3 . Network interface 18 is connected to internal bus 20 .
　情報処理装置１０は、近距離無線通信インターフェース１９を有する。近距離無線通信インターフェース１９は、近距離無線通信６による他の機器との通信制御処理を実行する。近距離無線通信インターフェース１９は、内部バス２０に接続される。 The information processing device 10 has a short-range wireless communication interface 19 . The short-range wireless communication interface 19 executes communication control processing with other devices by the short-range wireless communication 6 . The short-range wireless communication interface 19 is connected to the internal bus 20 .
　図３は、本発明の実施形態に係る情報処理システムの機能構成を示すブロック図である。図３に示されるように、情報処理システム１は、サーバ２と、ＰＣ４と、スマートフォン５とを備える。 FIG. 3 is a block diagram showing the functional configuration of the information processing system according to the embodiment of the present invention. As shown in FIG. 3 , the information processing system 1 includes a server 2 , a PC 4 and a smart phone 5 .
　まず、スマートフォン５の機能構成について説明する。スマートフォン５は、近距離無線通信制御部５０１、有効性確認部５０２、ユーザー認証部５０３、スイッチ制御部５０４、入出力制御部５０５、および記憶部５０６を有する。近距離無線通信制御部５０１、有効性確認部５０２、ユーザー認証部５０３、スイッチ制御部５０４、および入出力制御部５０５は、スマートフォン５にハードウェアとして搭載されるＣＰＵ１１がプログラムを実行することにより実現される。記憶部５０６は、スマートフォン５にハードウェアとして搭載されるＲＡＭ１２またはＲＯＭ等のメモリにより実現される。 First, the functional configuration of the smartphone 5 will be explained. The smartphone 5 has a short-range wireless communication control unit 501 , a validity confirmation unit 502 , a user authentication unit 503 , a switch control unit 504 , an input/output control unit 505 and a storage unit 506 . Near-field wireless communication control unit 501, validity confirmation unit 502, user authentication unit 503, switch control unit 504, and input/output control unit 505 are realized by CPU 11 installed as hardware in smartphone 5 executing a program. be done. The storage unit 506 is implemented by a memory such as the RAM 12 or ROM installed in the smartphone 5 as hardware.
　近距離無線通信制御部５０１は、後述するスイッチ制御部５０４によって近距離無線通信接続がオンされている場合に、近距離無線通信６によりＰＣ４と通信する。 The short-range wireless communication control unit 501 communicates with the PC 4 by the short-range wireless communication 6 when the short-range wireless communication connection is turned on by the switch control unit 504, which will be described later.
　有効性確認部５０２は、スマートフォン５の有効性とユーザーの有効性の確認を行う。有効性確認部５０２は、具体的には、以下の事前処理および有効性確認処理を実行する。 The validity confirmation unit 502 confirms the validity of the smartphone 5 and the validity of the user. Specifically, the validity confirmation unit 502 executes the following preprocessing and validity confirmation processing.
　（事前処理）
　ユーザーＵは、情報処理システム１に係るサービスの初期登録時のアクティベーションの際に、ユーザー情報と共に、スマートフォン５の情報であるスマートフォン情報をサーバ２に登録する。スマートフォン情報は、例えば、ＩＭＥＩ（International Mobile Equipment Identifier）などのデバイス情報であるが、これに限られない。具体的には、有効性確認部５０２は、ユーザー情報およびスマートフォン情報（例えば、入出力装置１５からユーザーＵが入力した情報やＲＯＭ１３に記憶してある情報）を、ネットワーク３を介してサーバ２に送信する。これらの情報を受信したサーバ２は、受信した情報を記憶部２０３に登録する。 (pretreatment)
The user U registers smartphone information, which is information about the smartphone 5 , in the server 2 together with user information when activating a service related to the information processing system 1 at the time of initial registration. The smartphone information is, for example, device information such as IMEI (International Mobile Equipment Identifier), but is not limited to this. Specifically, the validity confirmation unit 502 sends user information and smartphone information (for example, information input by the user U from the input/output device 15 and information stored in the ROM 13) to the server 2 via the network 3. Send. The server 2 that has received these pieces of information registers the received information in the storage unit 203 .
　（有効性確認処理）
（１）ユーザーＵは、事前処理が済んだスマートフォン５の入出力装置１５を操作して、情報処理システム１に係るアプリケーションをスマートフォン５で起動する。このアプリケーションの起動により、ユーザー認証部５０３は、スマートフォン５を使用するユーザーＵの本人認証を実行する。
（２）ユーザー認証部５０３により、本人認証（例えば、スマートフォン５による生体認証）が正常に行われ、スマートフォン５を操作するユーザーＵが認証されると、有効性確認部５０２は、サーバ２にスマートフォン情報およびユーザー情報を送信する。
（３）サーバ２は、スマートフォン５から送信されてきた情報を、事前処理の初期登録時に記憶部２０３に登録された情報と照合する。
（４）サーバ２は、照合結果として、スマートフォン５から送信されてきた情報と記憶部２０３に登録された情報とが一致した場合には、スマートフォン５にＯＫを返送する。一方、サーバ２は、照合結果として、スマートフォン５から送信されてきた情報と記憶部２０３に登録された情報とが一致しない場合には、スマートフォン５にＮＧを返送する。
（５）有効性確認部５０２は、ＯＫを受信した場合には有効性が確認されたと判断し、ＮＧを受信した場合には有効性が確認されなかったと判断する。 (Validity confirmation process)
(1) The user U operates the input/output device 15 of the smartphone 5 for which preprocessing has been completed, and activates the application related to the information processing system 1 on the smartphone 5 . By starting this application, the user authentication unit 503 performs personal authentication of the user U using the smartphone 5 .
(2) When the user authentication unit 503 successfully authenticates the person (for example, biometric authentication by the smartphone 5) and authenticates the user U who operates the smartphone 5, the validity confirmation unit 502 sends the server 2 to the smartphone. Send information and user information.
(3) The server 2 collates the information transmitted from the smartphone 5 with the information registered in the storage unit 203 at the initial registration of the preprocessing.
(4) When the information transmitted from the smartphone 5 matches the information registered in the storage unit 203 as a collation result, the server 2 returns OK to the smartphone 5 . On the other hand, when the information transmitted from the smartphone 5 and the information registered in the storage unit 203 do not match as a result of matching, the server 2 returns NG to the smartphone 5 .
(5) The validity confirmation unit 502 determines that the validity has been confirmed when OK is received, and determines that the validity has not been confirmed when NG is received.
　スマートフォン５の記憶部５０６は、第１分散ファイルＦ１および第３分散ファイルＦ３を記憶している。第１分散ファイルＦ１は、認証情報Ｄ２に対して秘密分散処理を行うことにより得られたスマートフォン５側の分散ファイルである。認証情報Ｄ２は、スマートフォン５を携帯しているユーザーＵがＰＣ４にログインするための情報である。第３分散ファイルＦ３は、ユーザープロファイルＤ３に対して秘密分散処理を行うことにより得られたスマートフォン５側の分散ファイルである。ユーザープロファイルＤ３は、ユーザーＵによって作成されたファイルを含むユーザーデータと、ＰＣ４で実行されるオペレーティングシステムおよびアプリケーションソフトウェアの設定ファイルとを含む。なお、第１分散ファイルＦ１および第３分散ファイルＦ３を用いた処理の詳細については後述する。 The storage unit 506 of the smartphone 5 stores the first distributed file F1 and the third distributed file F3. The first distributed file F1 is a distributed file on the smartphone 5 side obtained by performing secret sharing processing on the authentication information D2. The authentication information D2 is information for the user U carrying the smartphone 5 to log in to the PC4. The third distributed file F3 is a distributed file on the smartphone 5 side obtained by performing secret sharing processing on the user profile D3. User profile D3 includes user data, including files created by user U, and configuration files for the operating system and application software executed on PC4. Details of processing using the first distributed file F1 and the third distributed file F3 will be described later.
　ユーザー認証部５０３は、指紋、虹彩、顔、または静脈などの生体認証を実行する。また、ユーザー認証部５０３は、例えばＧＰＳ受信機を用いてスマートフォン５の現在の位置情報を取得し、取得した位置情報が予め定められた位置を示す場合に、本人認証が行われたと判定してもよい。また、ユーザー認証部５０３は、例えば管理者（例えば上司）による許可を受け付ける手段を有し、管理者が許可した場合に、本人認証が行われたと判定してもよい。また、ユーザー認証部５０３は、その都度発行されるワンタイムパスワードが正しく入力された場合に、本人認証が行われたと判定してもよい。また、ユーザー認証部５０３は、上記の認証処理のうちのいずれか複数を実行することにより、本人認証を行ってもよい。 The user authentication unit 503 performs biometric authentication such as fingerprint, iris, face, or vein. Further, the user authentication unit 503 acquires the current location information of the smartphone 5 using, for example, a GPS receiver, and determines that the person has been authenticated when the acquired location information indicates a predetermined location. good too. Further, the user authentication unit 503 may have means for receiving permission from an administrator (for example, a boss), and may determine that personal authentication has been performed when the administrator has given permission. Further, the user authentication unit 503 may determine that the person has been authenticated when the one-time password issued each time is entered correctly. Further, the user authentication unit 503 may perform personal authentication by executing any one or more of the authentication processes described above.
　スイッチ制御部５０４は、ＰＣ４との近距離無線通信接続のオン／オフを切り替える。ユーザー認証部５０３によりユーザーＵが認証された場合、情報処理システム１に係るアプリケーションがスマートフォン５で起動可能となる。情報処理システム１に係るアプリケーションがスマートフォン５で起動すると、スマートフォン５の入出力装置１５は、近距離無線通信接続のオン／オフの切り替えの入力を受け付ける画面を表示する。スイッチ制御部５０４は、この画面におけるユーザーＵからの入力に応じて近距離無線通信接続のオン／オフを切り替える。すなわち、スイッチ制御部５０４によれば、ユーザーＵは、スマートフォン５とＰＣ４との距離によらず、手動で近距離無線通信接続のオン／オフを切り替えることができる。 The switch control unit 504 switches on/off the short-range wireless communication connection with the PC 4. When the user U is authenticated by the user authentication unit 503 , an application related to the information processing system 1 can be activated on the smart phone 5 . When the application related to the information processing system 1 is activated on the smartphone 5, the input/output device 15 of the smartphone 5 displays a screen for accepting an input for switching on/off of the short-range wireless communication connection. The switch control unit 504 switches ON/OFF of the short-range wireless communication connection according to the input from the user U on this screen. That is, according to the switch control unit 504 , the user U can manually switch on/off the short-range wireless communication connection regardless of the distance between the smartphone 5 and the PC 4 .
　入出力制御部５０５は、記憶部５０６からのデータの読み出しや、記憶部５０６へのデータの書き込みを行う。例えば、入出力制御部５０５は、事前にＰＣ４から受信した第１分散ファイルＦ１および第３分散ファイルＦ３を記憶部５０６に記憶する。このとき、入出力制御部５０５は、ネットワーク３を介してＰＣ４から分散ファイルを受信してもよいし、近距離無線通信６を介してＰＣ４から分散ファイルを受信してもよい。 The input/output control unit 505 reads data from the storage unit 506 and writes data to the storage unit 506 . For example, the input/output control unit 505 stores the first distributed file F1 and the third distributed file F3 previously received from the PC 4 in the storage unit 506 . At this time, the input/output control unit 505 may receive the distributed file from the PC 4 via the network 3 or may receive the distributed file from the PC 4 via the short-range wireless communication 6 .
　入出力制御部５０５は、詳しくは後述するログイン認証に際して、第１分散ファイルＦ１を記憶部５０６から読み出し、近距離無線通信６を介してＰＣ４に送信する。また、ログイン認証が行われた後、入出力制御部５０５は、第３分散ファイルＦ３を記憶部５０６から読み出し、近距離無線通信６を介してＰＣ４に送信する。ここで、入出力制御部５０５は、第１分散ファイルＦ１または第３分散ファイルＦ３を近距離無線通信制御部５０１に出力することにより、第１分散ファイルＦ１または第３分散ファイルＦ３をＰＣ４に送信する。 The input/output control unit 505 reads the first distributed file F1 from the storage unit 506 and transmits it to the PC 4 via the short-range wireless communication 6 at the time of login authentication, which will be described later in detail. Also, after the login authentication is performed, the input/output control unit 505 reads the third distributed file F3 from the storage unit 506 and transmits it to the PC 4 via the short-range wireless communication 6 . Here, the input/output control unit 505 outputs the first distributed file F1 or the third distributed file F3 to the short-range wireless communication control unit 501, thereby transmitting the first distributed file F1 or the third distributed file F3 to the PC4. do.
　次に、サーバ２の機能構成について説明する。サーバ２は、制御部２０１、通信部２０２、および記憶部２０３を有する。制御部２０１および通信部２０２は、サーバ２にハードウェアとして搭載されるＣＰＵ１１がプログラムを実行することにより実現される。記憶部２０３は、サーバ２にハードウェアとして搭載されるＲＡＭ１２またはＲＯＭ等のメモリを用いて実現される。 Next, the functional configuration of the server 2 will be explained. The server 2 has a control section 201 , a communication section 202 and a storage section 203 . The control unit 201 and the communication unit 202 are implemented by the CPU 11 installed as hardware in the server 2 executing a program. The storage unit 203 is realized by using a memory such as the RAM 12 or ROM installed in the server 2 as hardware.
　制御部２０１は、記憶部２０３からのデータの読み出しや、記憶部２０３へのデータの書き込みを行う。例えば、制御部２０１は、事前にＰＣ４から受信した第２分散ファイルＦ２および第４分散ファイルＦ４を記憶部２０３に記憶する。このとき、制御部２０１は、ネットワーク３を介してＰＣ４から第２分散ファイルＦ２および第４分散ファイルＦ４を受信する。第２分散ファイルＦ２は、認証情報Ｄ２に対して秘密分散処理を行うことにより得られたサーバ２側の分散ファイルである。第４分散ファイルＦ４は、ユーザープロファイルＤ３に対して秘密分散処理を行うことにより得られたサーバ２側の分散ファイルである。なお、第２分散ファイルＦ２および第４分散ファイルＦ４を用いた処理の詳細については後述する。 The control unit 201 reads data from the storage unit 203 and writes data to the storage unit 203 . For example, the control unit 201 stores the second distributed file F2 and the fourth distributed file F4 received from the PC 4 in advance in the storage unit 203 . At this time, the control unit 201 receives the second distributed file F2 and the fourth distributed file F4 from the PC 4 via the network 3 . The second distributed file F2 is a distributed file on the server 2 side obtained by performing secret sharing processing on the authentication information D2. The fourth distributed file F4 is a distributed file on the server 2 side obtained by performing secret sharing processing on the user profile D3. Details of processing using the second distributed file F2 and the fourth distributed file F4 will be described later.
　制御部２０１は、詳しくは後述するログイン認証に際して、第２分散ファイルＦ２を記憶部２０３から読み出し、ネットワーク３を介してＰＣ４に送信する。また、ログイン認証が行われた後、制御部２０１は、第４分散ファイルＦ４を記憶部２０３から読み出し、ネットワーク３を介してＰＣ４に送信する。ここで、制御部２０１は、第２分散ファイルＦ２または第４分散ファイルＦ４を通信部２０２に出力することにより、第２分散ファイルＦ２または第４分散ファイルＦ４をＰＣ４に送信する。 The control unit 201 reads the second distributed file F2 from the storage unit 203 and transmits it to the PC 4 via the network 3 at the time of login authentication, which will be described later in detail. Further, after login authentication is performed, the control unit 201 reads the fourth distributed file F4 from the storage unit 203 and transmits it to the PC 4 via the network 3 . Here, the control unit 201 transmits the second distributed file F2 or the fourth distributed file F4 to the PC4 by outputting the second distributed file F2 or the fourth distributed file F4 to the communication unit 202 .
　通信部２０２は、ネットワーク３を介してＰＣ４等の他の装置と通信する。 The communication unit 202 communicates with other devices such as the PC 4 via the network 3.
　記憶部２０３は、前述したように、第２分散ファイルＦ２および第４分散ファイルＦ４を記憶している。第２分散ファイルＦ２および第４分散ファイルＦ４は、スマートフォン５の識別情報と関連付けられて記憶部２０３に記憶されている。また、記憶部２０３は、第２分散ファイルＦ２および第４分散ファイルＦ４の他、以下の情報を記憶している。
（１）ユーザー情報
（２）利用状況情報
（３）ログ管理情報
（４）テナント管理情報
（５）契約情報 The storage unit 203 stores the second distributed file F2 and the fourth distributed file F4 as described above. The second distributed file F2 and the fourth distributed file F4 are associated with the identification information of the smartphone 5 and stored in the storage unit 203 . The storage unit 203 also stores the following information in addition to the second distributed file F2 and the fourth distributed file F4.
(1) User information (2) Usage information (3) Log management information (4) Tenant management information (5) Contract information
　制御部２０１は、以下の処理を実行する。
（１）記憶部２０３のユーザー情報に対する処理（登録、更新、削除、参照等）
（２）記憶部２０３の利用状況情報に対する処理（検索、参照等）
（３）記憶部２０３のログ管理情報に対する処理（検索、参照等）
（４）記憶部２０３のテナント管理情報に対する処理（登録、更新、削除、参照等）
（５）記憶部２０３の契約情報に対する処理（登録、更新、削除、参照等） The control unit 201 executes the following processes.
(1) Processing of user information in storage unit 203 (registration, update, deletion, reference, etc.)
(2) Processing (searching, referencing, etc.) for usage status information in the storage unit 203
(3) Processing for log management information in storage unit 203 (search, reference, etc.)
(4) Processing for tenant management information in the storage unit 203 (registration, update, deletion, reference, etc.)
(5) Processing for contract information in storage unit 203 (registration, update, deletion, reference, etc.)
　次に、ＰＣ４の機能構成について説明する。ＰＣ４は、通信部４０１、距離測定部４０２、ペアリング状態把握部４０３、ロック制御部４０４、分散処理部４０５、近距離無線通信制御部４０６、入出力制御部４０７、第１復元処理部４０８、ログイン認証部４０９、第２復元処理部４１０、ログ取得部４１１、および記憶部４１２を有する。通信部４０１、距離測定部４０２、ペアリング状態把握部４０３、ロック制御部４０４、分散処理部４０５、近距離無線通信制御部４０６、入出力制御部４０７、第１復元処理部４０８、ログイン認証部４０９、第２復元処理部４１０、およびログ取得部４１１は、ＰＣ４にハードウェアとして搭載されるＣＰＵ１１がプログラムを実行することにより実現される。記憶部４１２は、ＰＣ４にハードウェアとして搭載されるＲＡＭ１２またはＲＯＭ等のメモリを用いて実現される。 Next, the functional configuration of PC4 will be explained. The PC 4 includes a communication unit 401, a distance measurement unit 402, a pairing state grasping unit 403, a lock control unit 404, a distributed processing unit 405, a short-range wireless communication control unit 406, an input/output control unit 407, a first restoration processing unit 408, It has a login authentication unit 409 , a second restoration processing unit 410 , a log acquisition unit 411 and a storage unit 412 . Communication unit 401, distance measurement unit 402, pairing state grasping unit 403, lock control unit 404, distributed processing unit 405, short-range wireless communication control unit 406, input/output control unit 407, first restoration processing unit 408, login authentication unit 409, the second restoration processing unit 410, and the log acquisition unit 411 are implemented by the CPU 11 installed as hardware in the PC 4 executing programs. The storage unit 412 is implemented using a memory such as a RAM 12 or a ROM installed in the PC 4 as hardware.
　通信部４０１は、ネットワーク３を介してサーバ２等の他の装置と通信する。 The communication unit 401 communicates with other devices such as the server 2 via the network 3.
　距離測定部４０２は、近距離無線通信６の電波強度［ｄＢｍ］に基づいて、ＰＣ４とスマートフォン５との間の距離を測定する。例えば、距離測定部４０２は、近距離無線通信６の電波強度［ｄＢｍ］を測定し、フリスの伝達公式を用いてＰＣ４とスマートフォン５との間の距離Ｄを測定する。なお、ＰＣ４とスマートフォン５との間の距離が長くなるほど、近距離無線通信６の電波強度［ｄＢｍ］は小さくなる。 The distance measurement unit 402 measures the distance between the PC 4 and the smartphone 5 based on the radio wave intensity [dBm] of the short-range wireless communication 6. For example, the distance measurement unit 402 measures the radio field strength [dBm] of the short-range wireless communication 6, and measures the distance D between the PC 4 and the smartphone 5 using the Friis transmission formula. It should be noted that as the distance between the PC 4 and the smartphone 5 increases, the radio wave intensity [dBm] of the short-range wireless communication 6 decreases.
　ペアリング状態把握部４０３は、近距離無線通信６のペアリング状態（現在接続中であるか否か）を把握する。 The pairing state grasping unit 403 grasps the pairing state of the short-range wireless communication 6 (whether it is currently connected or not).
　ロック制御部４０４は、ペアリング状態が未接続の場合、または、ＰＣ４とスマートフォン５との間の距離Ｄが第１閾値Ｔｈ１を超える場合は、ＰＣ４をロックし利用不可能な状態にする。例えば、第１閾値Ｔｈ１は３［ｍ］であってよい。また、ロック制御部４０４は、ペアリング状態が接続中であって、ＰＣ４とスマートフォン５との間の距離Ｄが第２閾値Ｔｈ２未満である場合は、ＰＣ４をアンロックし利用可能な状態にする。例えば、第２閾値Ｔｈ２は１［ｍ］であってよい。 When the pairing state is unconnected, or when the distance D between the PC 4 and the smartphone 5 exceeds the first threshold Th1, the lock control unit 404 locks the PC 4 to make it unusable. For example, the first threshold Th1 may be 3 [m]. Further, when the pairing state is connected and the distance D between the PC 4 and the smartphone 5 is less than the second threshold Th2, the lock control unit 404 unlocks the PC 4 and makes it available. . For example, the second threshold Th2 may be 1 [m].
　もし、第１閾値Ｔｈ１と第２閾値Ｔｈ２とを同じ値に設定すると、ＰＣ４のロックとアンロックの切り替えが繰り返されることによりユーザーＵの操作性が低下する場合がある。これは、電波環境などの影響で近距離無線通信６の電波強度が変動するためである。このため、本実施形態では、第１閾値Ｔｈ１よりも第２閾値Ｔｈ２の方が小さいこととしている。 If the first threshold Th1 and the second threshold Th2 are set to the same value, the operability for the user U may deteriorate due to repeated switching between locking and unlocking of the PC 4 . This is because the radio wave intensity of the short-range wireless communication 6 fluctuates under the influence of the radio wave environment. Therefore, in the present embodiment, the second threshold Th2 is smaller than the first threshold Th1.
　分散処理部４０５は、秘密分散技術における秘匿化処理を行う。秘匿化処理は、対象のデータを分散する処理である。データの分散方法は、既知の秘密分散技術の如何なる方法を用いてもよい。例えば、分散処理部４０５の分散処理は、閾値分散により、元のデータをｍ個の分散ファイルに分散し、ｍ個のうちのいずれかｋ個（ｍ＞ｋ）の分散ファイルを用いて元のデータを復元可能とするものであってもよい。例えば、分散処理部４０５の分散処理は、ＡＯＮＴ（All or Nothing Transform）により、元のデータをｍ個の分散ファイルに分散し、ｍ個すべての分散ファイルを用いて元のデータを復元可能とするものであってもよい。 The distributed processing unit 405 performs anonymization processing in the secret sharing technology. Anonymization processing is processing for distributing target data. Any method of known secret sharing technology may be used as the data distribution method. For example, the distributed processing of the distributed processing unit 405 distributes the original data to m distributed files by threshold distribution, and uses any k (m>k) distributed files among the m distributed files to reproduce the original data. Data may be restored. For example, the distributed processing of the distributed processing unit 405 distributes the original data to m distributed files by AONT (All or Nothing Transform), and restores the original data using all m distributed files. can be anything.
　記憶部４１２には、設定情報Ｄ１が記憶されている。例えば、設定情報Ｄ１は以下の情報を含む。
（１）分散処理部４０５による秘密分散処理後に、分散ファイルを保存する保存先の情報（サーバ２側の保存場所（ディレクトリ／フォルダ）、およびスマートフォン５側の保存場所（ディレクトリ／フォルダ））
（２）サーバ２の接続情報（ＵＲＬ（Uniform Resource Locator）、ポート番号等）
（３）近距離無線通信６によるスマートフォン５との接続情報（スマートフォン５のデバイス情報やリンクキー等） The storage unit 412 stores setting information D1. For example, the setting information D1 includes the following information.
(1) Information on the storage location where the distributed file is stored after the secret sharing processing by the distribution processing unit 405 (storage location (directory/folder) on the server 2 side and storage location (directory/folder) on the smartphone 5 side)
(2) Server 2 connection information (URL (Uniform Resource Locator), port number, etc.)
(3) Connection information with smartphone 5 via short-range wireless communication 6 (device information of smartphone 5, link key, etc.)
　また、記憶部４１２には、認証情報Ｄ２が記憶されている。前述したように、認証情報Ｄ２は、スマートフォン５を携帯しているユーザーＵがＰＣ４にログインするための情報である。分散処理部４０５は、認証情報Ｄ２を分散し、スマートフォン５側の第１分散ファイルＦ１およびサーバ２側の第２分散ファイルＦ２を取得する。第１分散ファイルＦ１と第２分散ファイルＦ２とは別のファイルである。 In addition, the storage unit 412 stores authentication information D2. As described above, the authentication information D2 is information for the user U carrying the smartphone 5 to log into the PC4. The distributed processing unit 405 distributes the authentication information D2 and acquires the first distributed file F1 on the smartphone 5 side and the second distributed file F2 on the server 2 side. The first distributed file F1 and the second distributed file F2 are separate files.
　近距離無線通信制御部４０６は、近距離無線通信６によりスマートフォン５と通信する。 The short-range wireless communication control unit 406 communicates with the smartphone 5 by short-range wireless communication 6.
　入出力制御部４０７は、記憶部４１２からのデータの読み出し、記憶部４１２へのデータの書き込みを行う。例えば、入出力制御部４０７は、記憶部４１２からのユーザープロファイルＤ３の読み出しや、記憶部４１２へのユーザープロファイルＤ３の書き込みを行う。ユーザープロファイルＤ３の詳細については後述する。 The input/output control unit 407 reads data from the storage unit 412 and writes data to the storage unit 412 . For example, the input/output control unit 407 reads the user profile D3 from the storage unit 412 and writes the user profile D3 to the storage unit 412 . Details of the user profile D3 will be described later.
　第１復元処理部４０８は、分散処理部４０５によって秘密分散処理が行われた認証情報Ｄ２の復元処理を実行する。すなわち、第１復元処理部４０８は、スマートフォン５から受信した第１分散ファイルＦ１およびサーバ２から受信した第２分散ファイルＦ２を用いて認証情報Ｄ２を復元する。 The first restoration processing unit 408 executes restoration processing of the authentication information D2 for which the secret sharing processing has been performed by the distribution processing unit 405. That is, the first restoration processing unit 408 restores the authentication information D2 using the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2 .
　ログイン認証部４０９は、第１復元処理部４０８によって復元された認証情報Ｄ２を用いて、例えばCredential Providerによりログイン認証処理を実行する。 The login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication processing by, for example, the Credential Provider.
　第２復元処理部４１０は、分散処理部４０５によって秘密分散処理が行われたユーザープロファイルＤ３の復元処理を実行する。すなわち、第２復元処理部４１０は、スマートフォン５から受信した第３分散ファイルＦ３およびサーバ２から受信した第４分散ファイルＦ４を用いてユーザープロファイルＤ３を復元する。 The second restoration processing unit 410 executes restoration processing of the user profile D3 for which secret sharing processing has been performed by the distribution processing unit 405. That is, the second restoration processing unit 410 restores the user profile D3 using the third distributed file F3 received from the smartphone 5 and the fourth distributed file F4 received from the server 2 .
　ログ取得部４１１は、ＰＣ４の各処理で生じた事柄をログとして記録する。これは、例えばイベントログとして記録される。ログ取得部４１１は、記録したログを、ネットワーク３を介してサーバ２に送信する。ここで、ログ取得部４１１は、通信部４０１にログを出力することにより、ログをサーバ２に送信する。 The log acquisition unit 411 records events occurring in each process of the PC 4 as logs. This is recorded, for example, as an event log. The log acquisition unit 411 transmits the recorded log to the server 2 via the network 3 . Here, the log acquisition unit 411 transmits the log to the server 2 by outputting the log to the communication unit 401 .
　次に、本実施形態において、分散ファイルを保存する処理の一例についてフローチャートを用いて説明する。図４は、本発明の実施形態に係る情報処理システムの分散ファイル保存処理の一例を示すフローチャートである。 Next, an example of processing for saving distributed files in this embodiment will be described using a flowchart. FIG. 4 is a flowchart showing an example of distributed file saving processing of the information processing system according to the embodiment of the present invention.
　まず、情報処理システム１はユーザー登録を行う（ステップＳ４０１）。具体的に、ユーザーＵは、スマートフォン５の入出力装置１５やＰＣ４の入出力装置１５により、ユーザー情報を入力する。ユーザー情報の入力を受けたＰＣ４は、入力されたユーザー情報に対応付けた認証情報Ｄ２を作成し、認証情報Ｄ２を記憶部４１２に保存する。また、ユーザー情報の入力を受けたＰＣ４は、入力されたユーザー情報を設定情報Ｄ１として保存する。また、ユーザー情報の入力を受けたＰＣ４は、入力されたユーザー情報をサーバ２に送信する。ＰＣ４からユーザー情報を受信したサーバ２は、受信したユーザー情報を記憶部２０３に保存する。 First, the information processing system 1 performs user registration (step S401). Specifically, the user U inputs user information using the input/output device 15 of the smartphone 5 or the input/output device 15 of the PC 4 . The PC 4 that receives the input of the user information creates authentication information D2 associated with the input user information and stores the authentication information D2 in the storage unit 412 . Also, the PC 4 that receives the input of the user information stores the input user information as the setting information D1. Also, the PC 4 that receives the input of the user information transmits the input user information to the server 2 . The server 2 that has received the user information from the PC 4 stores the received user information in the storage unit 203 .
　次に、情報処理システム１は、ステップＳ４０１で保存した認証情報Ｄ２を、分散処理部４０５により分散し、スマートフォン５側の第１分散ファイルＦ１およびサーバ２側の第２分散ファイルＦ２を取得する（ステップＳ４０２）。 Next, the information processing system 1 distributes the authentication information D2 saved in step S401 by the distribution processing unit 405, and acquires the first distributed file F1 on the smartphone 5 side and the second distributed file F2 on the server 2 side ( step S402).
　次に、情報処理システム１は、スマートフォン５とＰＣ４の近距離無線通信６のペアリングを実行する（ステップＳ４０３）。このペアリングによりリンクキーが生成され、スマートフォン５とＰＣ４とは、このリンクキーを用いた暗号化通信を行う。 Next, the information processing system 1 executes pairing of the smartphone 5 and the PC 4 for short-range wireless communication 6 (step S403). A link key is generated by this pairing, and the smartphone 5 and the PC 4 perform encrypted communication using this link key.
　次に、情報処理システム１は、ステップＳ４０３でペアリングした近距離無線通信６を介して、スマートフォン５側の第１分散ファイルＦ１を、ＰＣ４からスマートフォン５に送信する。また、情報処理システム１は、ネットワーク３を介して、サーバ２側の第２分散ファイルＦ２を、ＰＣ４からサーバ２に送信する（ステップＳ４０４）。第１分散ファイルＦ１を受信したスマートフォン５は、第１分散ファイルＦ１を記憶部５０６に保存する。第２分散ファイルＦ２を受信したサーバ２は、第２分散ファイルＦ２を記憶部２０３に保存する。 Next, the information processing system 1 transmits the first distributed file F1 on the smartphone 5 side from the PC 4 to the smartphone 5 via the short-range wireless communication 6 paired in step S403. The information processing system 1 also transmits the second distributed file F2 on the server 2 side from the PC 4 to the server 2 via the network 3 (step S404). The smartphone 5 that has received the first distributed file F1 stores the first distributed file F1 in the storage unit 506 . The server 2 that has received the second distributed file F2 stores the second distributed file F2 in the storage unit 203 .
　図５は、本発明の実施形態に係る認証処理を示すフローチャートである。本実施形態においては、下記の三段階の認証を行うことで、よりセキュアなログイン認証を可能にしている。
（１）スマートフォン５の生体認証による本人認証
（２）本人認証を前提とし、近距離無線通信６のリンクキーの照合によるデバイス認証
（３）デバイス認証を前提とし、秘密分散処理により分散された分散ファイルを復元した認証情報によるログイン認証 FIG. 5 is a flow chart showing authentication processing according to an embodiment of the present invention. In this embodiment, more secure login authentication is made possible by performing the following three-stage authentication.
(1) Personal authentication by biometric authentication of the smartphone 5 (2) Device authentication by matching the link key of the short-range wireless communication 6 on the premise of personal authentication (3) Distributed by secret sharing processing on the premise of device authentication Login authentication with the credentials that restored the files
　まず、情報処理システム１は、本人認証処理を実行する（ステップＳ５０１）。具体的には、スマートフォン５のユーザー認証部５０３は、予め登録した生体情報（指紋情報、虹彩情報、顔情報など）によって、スマートフォン５を正当なユーザーＵが操作しているのか否かを認証する。ユーザー認証部５０３で認証に成功した場合、スイッチ制御部５０４は近距離無線通信６の利用を許容し、ステップＳ５０２に進む。一方、ユーザー認証部５０３で認証に失敗した場合、スイッチ制御部５０４は近距離無線通信６の利用を拒絶し、本フローチャートによる処理を終了する。 First, the information processing system 1 executes personal authentication processing (step S501). Specifically, the user authentication unit 503 of the smartphone 5 authenticates whether or not an authorized user U is operating the smartphone 5 based on pre-registered biometric information (fingerprint information, iris information, face information, etc.). . If the user authentication unit 503 succeeds in authentication, the switch control unit 504 permits the use of the short-range wireless communication 6, and proceeds to step S502. On the other hand, if the user authentication unit 503 fails authentication, the switch control unit 504 rejects the use of the short-range wireless communication 6, and terminates the processing according to this flowchart.
　次に、情報処理システム１は、デバイス認証処理を実行する（ステップＳ５０２）。具体的には、スマートフォン５の近距離無線通信制御部５０１は、近距離無線通信６により、ＰＣ４の近距離無線通信制御部４０６との接続を試みる。情報処理システム１は、この接続に成功すればデバイス認証に成功したと判断し、この接続に失敗すればデバイス認証に失敗したと判断する。デバイス認証に成功した場合は、ステップＳ５０３に進む。デバイス認証に失敗した場合は、本フローチャートによる処理を終了する。 Next, the information processing system 1 executes device authentication processing (step S502). Specifically, the short-range wireless communication control unit 501 of the smartphone 5 attempts connection with the short-range wireless communication control unit 406 of the PC 4 via the short-range wireless communication 6 . The information processing system 1 determines that device authentication has succeeded if this connection succeeds, and determines that device authentication has failed if this connection fails. If device authentication is successful, the process proceeds to step S503. If the device authentication fails, the processing according to this flowchart ends.
　次に、情報処理システム１は、ログイン認証処理を実行する（ステップＳ５０３）。具体的には、スマートフォン５側の第１分散ファイルＦ１は、記憶部５０６から読み出されて近距離無線通信６を介してＰＣ４に送信される。サーバ２側の第２分散ファイルＦ２は、記憶部２０３から読み出されてネットワーク３を介してＰＣ４に送信される。第１復元処理部４０８は、スマートフォン５から受信した第１分散ファイルＦ１と、サーバ２から受信した第２分散ファイルＦ２とを用いて復元処理を実行することにより、認証情報Ｄ２を復元する。ログイン認証部４０９は、第１復元処理部４０８によって復元された認証情報Ｄ２を用いてログイン認証処理を実行する。ログイン認証部４０９で認証に成功した場合、ログイン認証部４０９は、ユーザーＵのＰＣ４へのログインを実行する。一方、ログイン認証部４０９で認証に失敗した場合、ログイン認証部４０９は、ユーザーＵのＰＣ４へのログインを拒絶する。 Next, the information processing system 1 executes login authentication processing (step S503). Specifically, the first distributed file F1 on the smartphone 5 side is read from the storage unit 506 and transmitted to the PC 4 via the short-range wireless communication 6 . The second distributed file F2 on the server 2 side is read from the storage unit 203 and transmitted to the PC 4 via the network 3 . The first restoration processing unit 408 restores the authentication information D2 by executing restoration processing using the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2 . The login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to execute login authentication processing. When the login authentication unit 409 succeeds in authentication, the login authentication unit 409 executes login of the user U to the PC 4 . On the other hand, if the login authentication unit 409 fails authentication, the login authentication unit 409 rejects the login of the user U to the PC 4 .
　（ログイン認証処理）
　次に、図５のステップＳ５０３におけるログイン認証処理を、具体的に説明する。図６～図１０は、本発明の実施形態に係るＰＣのログイン処理を説明するための図である。前述したように、本実施形態では、ログインに用いられる認証情報Ｄ２に対して秘密分散処理を行うことによって得られた分散ファイルを、サーバ２とスマートフォン５に分散して保存している。 (login authentication process)
Next, the login authentication processing in step S503 of FIG. 5 will be specifically described. 6 to 10 are diagrams for explaining the login processing of the PC according to the embodiment of the present invention. As described above, in the present embodiment, distributed files obtained by performing secret sharing processing on the authentication information D2 used for login are distributed and stored in the server 2 and the smartphone 5 .
　図６に示すように、スマートフォン５に第１分散ファイルＦ１が格納されており、サーバ２に第２分散ファイルＦ２が格納されている。ＰＣ４とスマートフォン５が近距離無線通信６の範囲外（通信圏外）であれば、第１分散ファイルＦ１と第２分散ファイルＦ２がスマートフォン５とサーバ２とにそれぞれ分散保存されているため、ログインに用いられる情報（認証情報Ｄ２）は秘密分散処理により無意味化されている。このため、スマートフォン５を紛失したとしても、認証情報Ｄ２が漏えいすることはない。 As shown in FIG. 6, the smartphone 5 stores the first distributed file F1, and the server 2 stores the second distributed file F2. If the PC 4 and the smartphone 5 are outside the range of the short-range wireless communication 6 (out of communication range), the first distributed file F1 and the second distributed file F2 are distributed and saved in the smartphone 5 and the server 2, respectively. The information used (authentication information D2) is rendered meaningless by secret sharing processing. Therefore, even if the smartphone 5 is lost, the authentication information D2 will not be leaked.
　図７に示すように、ＰＣ４とスマートフォン５が近距離無線通信６の範囲内に入ると、ＰＣ４の近距離無線通信制御部４０６およびスマートフォン５の近距離無線通信制御部５０１は、近距離無線通信６を確立するプロセスを実行する。 As shown in FIG. 7, when the PC 4 and the smartphone 5 enter the range of the short-range wireless communication 6, the short-range wireless communication control unit 406 of the PC 4 and the short-range wireless communication control unit 501 of the smartphone 5 perform the short-range wireless communication. Run the process to establish 6.
　図８に示すように、近距離無線通信６が確立した後、スマートフォン５に保存された第１分散ファイルＦ１がＰＣ４に送信されるとともに、サーバ２に保存された第２分散ファイルＦ２がＰＣ４に送信される。そして、第１分散ファイルＦ１および第２分散ファイルＦ２が揃うことにより、認証情報Ｄ２が復元される。これによって、ユーザーＵは、スマートフォン５を用いてＰＣ４にログインすることが可能となる。 As shown in FIG. 8, after the short-range wireless communication 6 is established, the first distributed file F1 saved in the smartphone 5 is transmitted to the PC 4, and the second distributed file F2 saved in the server 2 is transferred to the PC 4. sent. Then, the authentication information D2 is restored by arranging the first distributed file F1 and the second distributed file F2. This enables the user U to log in to the PC 4 using the smart phone 5 .
　図９に示すように、ユーザーＵがスマートフォン５を携帯してＰＣ４から離れる場合、スマートフォン５に格納されている第１分散ファイルＦ１をＰＣ４から削除するとともに、サーバ２に格納されている第２分散ファイルＦ２をＰＣ４から削除する。 As shown in FIG. 9, when the user U leaves the PC 4 while carrying the smartphone 5, the first distributed file F1 stored in the smartphone 5 is deleted from the PC 4, and the second distributed file F1 stored in the server 2 is deleted. Delete file F2 from PC4.
　図１０に示すように、ユーザーＵが携帯したスマートフォン５が近距離無線通信６の範囲から外れることにより、近距離無線通信６が切断される。 As shown in FIG. 10, the short-range wireless communication 6 is disconnected when the smartphone 5 carried by the user U moves out of the range of the short-range wireless communication 6.
　図１１は、本発明の実施形態に係る情報処理システムによって行われる処理を示すシーケンス図である。このシーケンス図に示される処理は、ＰＣ４とスマートフォン５が近距離無線通信６の範囲内に入った場合に実行される。 FIG. 11 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention. The processing shown in this sequence diagram is executed when the PC 4 and the smartphone 5 are within the range of the short-range wireless communication 6 .
　まず、スマートフォン５の入出力制御部５０５は、記憶部５０６から第１分散ファイルＦ１を読み出し、読み出した第１分散ファイルＦ１を近距離無線通信制御部５０１に出力する。近距離無線通信制御部５０１は、入出力制御部５０５から出力された第１分散ファイルＦ１を、近距離無線通信６を介してＰＣ４に送信する（ステップＳ１１０１）。このとき、近距離無線通信制御部５０１は、スマートフォン５を識別するための識別情報についても併せて送信する。 First, the input/output control unit 505 of the smartphone 5 reads the first distributed file F1 from the storage unit 506 and outputs the read first distributed file F1 to the short-range wireless communication control unit 501. The short-range wireless communication control unit 501 transmits the first distributed file F1 output from the input/output control unit 505 to the PC 4 via the short-range wireless communication 6 (step S1101). At this time, the short-range wireless communication control unit 501 also transmits identification information for identifying the smartphone 5 .
　ＰＣ４の近距離無線通信制御部４０６がスマートフォン５から第１分散ファイルＦ１およびスマートフォン５の識別情報を受信すると、通信部４０１は、第２分散ファイルＦ２の送信要求を、ネットワーク３を介してサーバ２に送信する（ステップＳ１１０２）。このとき、通信部４０１は、スマートフォン５から受信したスマートフォン５の識別情報についても送信する。 When the short-range wireless communication control unit 406 of the PC 4 receives the first distributed file F1 and the identification information of the smartphone 5 from the smartphone 5, the communication unit 401 sends a transmission request for the second distributed file F2 to the server 2 via the network 3. (step S1102). At this time, the communication unit 401 also transmits the identification information of the smartphone 5 received from the smartphone 5 .
　サーバ２の通信部２０２がＰＣ４から第２分散ファイルＦ２の送信要求およびスマートフォン５の識別情報を受信すると、制御部２０１は、受信したスマートフォン５の識別情報に対応する第２分散ファイルＦ２を記憶部２０３から読み出し、読み出した第２分散ファイルＦ２を通信部２０２に出力する。通信部２０２は、制御部２０１から出力された第２分散ファイルＦ２を、ネットワーク３を介してＰＣ４に送信する（ステップＳ１１０３）。 When the communication unit 202 of the server 2 receives the transmission request of the second distributed file F2 and the identification information of the smartphone 5 from the PC 4, the control unit 201 stores the second distributed file F2 corresponding to the received identification information of the smartphone 5 in the storage unit. 203 and outputs the read second distributed file F2 to the communication unit 202 . The communication unit 202 transmits the second distributed file F2 output from the control unit 201 to the PC 4 via the network 3 (step S1103).
　ＰＣ４の通信部４０１がサーバ２から第２分散ファイルＦ２を受信すると、第１復元処理部４０８は、スマートフォン５から受信した第１分散ファイルＦ１と、サーバ２から受信した第２分散ファイルＦ２とを用いて、認証情報Ｄ２の復元処理を行う（ステップＳ１１０４）。これによって、認証情報Ｄ２が復元される。 When the communication unit 401 of the PC 4 receives the second distributed file F2 from the server 2, the first restoration processing unit 408 restores the first distributed file F1 received from the smartphone 5 and the second distributed file F2 received from the server 2. is used to restore the authentication information D2 (step S1104). This restores the authentication information D2.
　ログイン認証部４０９は、第１復元処理部４０８によって復元された認証情報Ｄ２を用いて、ＰＣ４のログイン認証処理を行う（ステップＳ１１０５）。ログイン認証部４０９で認証に成功した場合、ログイン認証部４０９は、スマートフォン５を所有するユーザーＵのＰＣ４へのログインを実行する。一方、ログイン認証部４０９で認証に失敗した場合、ログイン認証部４０９は、スマートフォン５を所有するユーザーＵのＰＣ４へのログインを拒絶する。 The login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication processing for the PC 4 (step S1105). When the login authentication unit 409 succeeds in authentication, the login authentication unit 409 executes login of the user U who owns the smart phone 5 to the PC 4 . On the other hand, if the login authentication unit 409 fails authentication, the login authentication unit 409 rejects the login of the user U who owns the smart phone 5 to the PC 4 .
　ＰＣ４へのログインが実行されると、ＰＣ４の近距離無線通信制御部４０６は、第３分散ファイルＦ３の送信要求を、近距離無線通信６を介してスマートフォン５に送信する（ステップＳ１１０６）。 When the login to the PC 4 is executed, the short-range wireless communication control unit 406 of the PC 4 transmits a transmission request for the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6 (step S1106).
　スマートフォン５の近距離無線通信制御部５０１がＰＣ４から第３分散ファイルＦ３の送信要求を受信すると、入出力制御部５０５は、第３分散ファイルＦ３を記憶部５０６から読み出し、読み出した第３分散ファイルＦ３を近距離無線通信制御部５０１に出力する。近距離無線通信制御部５０１は、入出力制御部５０５から出力された第３分散ファイルＦ３を、近距離無線通信６を介してＰＣ４に送信する（ステップＳ１１０７）。 When the short-range wireless communication control unit 501 of the smartphone 5 receives a transmission request for the third distributed file F3 from the PC 4, the input/output control unit 505 reads the third distributed file F3 from the storage unit 506, and the read third distributed file F3 is output to short-range wireless communication control section 501 . The short-range wireless communication control unit 501 transmits the third distributed file F3 output from the input/output control unit 505 to the PC 4 via the short-range wireless communication 6 (step S1107).
　ＰＣ４の近距離無線通信制御部４０６がスマートフォン５から第３分散ファイルＦ３を受信すると、通信部４０１は、第４分散ファイルＦ４の送信要求を、ネットワーク３を介してサーバ２に送信する（ステップＳ１１０８）。このとき、通信部４０１は、スマートフォン５の識別情報についても送信する。 When the short-range wireless communication control unit 406 of the PC 4 receives the third distributed file F3 from the smartphone 5, the communication unit 401 transmits a transmission request for the fourth distributed file F4 to the server 2 via the network 3 (step S1108). ). At this time, the communication unit 401 also transmits the identification information of the smartphone 5 .
　サーバ２の通信部２０２がＰＣ４から第４分散ファイルＦ４の送信要求およびスマートフォン５の識別情報を受信すると、制御部２０１は、受信したスマートフォン５の識別情報に対応する第４分散ファイルＦ４を記憶部２０３から読み出し、読み出した第４分散ファイルＦ４を通信部２０２に出力する。通信部２０２は、制御部２０１から出力された第４分散ファイルＦ４を、ネットワーク３を介してＰＣ４に送信する（ステップＳ１１０９）。 When the communication unit 202 of the server 2 receives the transmission request for the fourth distributed file F4 and the identification information of the smartphone 5 from the PC 4, the control unit 201 stores the fourth distributed file F4 corresponding to the received identification information of the smartphone 5 in the storage unit. 203 and outputs the read fourth distributed file F4 to the communication unit 202 . The communication unit 202 transmits the fourth distributed file F4 output from the control unit 201 to the PC 4 via the network 3 (step S1109).
　ＰＣ４の通信部４０１がサーバ２から第４分散ファイルＦ４を受信すると、第２復元処理部４１０は、スマートフォン５から受信した第３分散ファイルＦ３と、サーバ２から受信した第４分散ファイルＦ４とを用いて、ユーザープロファイルＤ３の復元処理を行う（ステップＳ１１１０）。これによって、ユーザープロファイルＤ３が復元される。 When the communication unit 401 of the PC 4 receives the fourth distributed file F4 from the server 2, the second restoration processing unit 410 restores the third distributed file F3 received from the smartphone 5 and the fourth distributed file F4 received from the server 2. is used to restore the user profile D3 (step S1110). This restores the user profile D3.
　記憶部４１２は、第２復元処理部４１０によって復元されたユーザープロファイルＤ３を記憶する（ステップＳ１１１１）。記憶部４１２に記憶されるユーザープロファイルＤ３は、スマートフォン５を所有するユーザーＵによって作成されたファイルを含むユーザーデータと、ＰＣ４で実行されるオペレーティングシステムおよびアプリケーションソフトウェアの設定ファイルとを含む。ユーザープロファイルＤ３が復元されて記憶部４１２に記憶されることで、ユーザーＵは、ＰＣ４を用いてユーザーデータやアプリケーションを使用することができるようになる。 The storage unit 412 stores the user profile D3 restored by the second restoration processing unit 410 (step S1111). User profile D<b>3 stored in storage unit 412 includes user data including files created by user U who owns smartphone 5 , and setting files for the operating system and application software executed by PC 4 . By restoring the user profile D3 and storing it in the storage unit 412, the user U can use the user data and applications using the PC4.
　図１１に示されるＰＣ４の一連の処理は、図１に示される複数のＰＣ４－１～４－ｎにおいて実行される。このため、スマートフォン５を所有するユーザーＵが複数のＰＣ４－１～４－ｎのうちのどのＰＣにログインしたとしても、ログインしたユーザーＵに対応するユーザープロファイルＤ３をＰＣに復元することができる。また、認証情報Ｄ２およびユーザープロファイルＤ３は、秘密分散処理によって暗号化されてサーバ２とスマートフォン５とに分散されている。このため、本発明によれば、ユーザーＵが複数のＰＣ４－１～４－ｎのうちのいずれのＰＣにログインしてもユーザーデータを使用することができるとともに、ユーザーデータをより確実に保護することができる。 A series of processes of the PC 4 shown in FIG. 11 are executed in the plurality of PCs 4-1 to 4-n shown in FIG. Therefore, even if the user U who owns the smart phone 5 logs into any of the plurality of PCs 4-1 to 4-n, the user profile D3 corresponding to the logged-in user U can be restored to the PC. Also, the authentication information D2 and the user profile D3 are encrypted by secret sharing processing and distributed to the server 2 and the smartphone 5 . Therefore, according to the present invention, the user data can be used even if the user U logs into any one of the plurality of PCs 4-1 to 4-n, and the user data can be protected more reliably. be able to.
　図１２は、本発明の実施形態に係る情報処理システムによって行われる処理を示すシーケンス図である。このシーケンス図に示される処理は、図１１に示される処理に続いて実行される。 FIG. 12 is a sequence diagram showing processing performed by the information processing system according to the embodiment of the present invention. The processing shown in this sequence diagram is executed following the processing shown in FIG.
　まず、ユーザーＵがＰＣ４の入出力装置１５を用いてログアウトの指示を入力すると（ステップＳ１２０１）、ＰＣ４の分散処理部４０５は、記憶部４１２に記憶されているユーザープロファイルＤ３に対して秘密分散処理を行う。これによって、分散処理部４０５は、スマートフォン５側の第３分散ファイルＦ３と、サーバ２側の第４分散ファイルＦ４とを生成する（ステップＳ１２０２）。 First, when the user U inputs a logout instruction using the input/output device 15 of the PC 4 (step S1201), the distribution processing unit 405 of the PC 4 performs secret sharing processing on the user profile D3 stored in the storage unit 412. I do. Accordingly, the distributed processing unit 405 generates a third distributed file F3 on the smartphone 5 side and a fourth distributed file F4 on the server 2 side (step S1202).
　ＰＣ４の近距離無線通信制御部４０６は、分散処理部４０５によって生成された第３分散ファイルＦ３を、近距離無線通信６を介してスマートフォン５に送信する（ステップＳ１２０３）。 The short-range wireless communication control unit 406 of the PC 4 transmits the third distributed file F3 generated by the distributed processing unit 405 to the smartphone 5 via the short-range wireless communication 6 (step S1203).
　スマートフォン５の近距離無線通信制御部５０１がＰＣ４から第３分散ファイルＦ３を受信すると、入出力制御部５０５は、受信した第３分散ファイルＦ３を記憶部５０６に記憶する（ステップＳ１２０４）。第３分散ファイルＦ３の記憶処理が完了すると、近距離無線通信制御部５０１は、近距離無線通信６を介してＰＣ４に記憶完了通知を送信する（ステップＳ１２０５）。 When the short-range wireless communication control unit 501 of the smartphone 5 receives the third distributed file F3 from the PC 4, the input/output control unit 505 stores the received third distributed file F3 in the storage unit 506 (step S1204). When the storage processing of the third distributed file F3 is completed, the short-range wireless communication control unit 501 transmits a storage completion notification to the PC 4 via the short-range wireless communication 6 (step S1205).
　ＰＣ４の近距離無線通信制御部４０６がスマートフォン５から記憶完了通知を受信すると、通信部４０１は、分散処理部４０５によって生成された第４分散ファイルＦ４を、ネットワーク３を介してサーバ２に送信する（ステップＳ１２０６）。 When the short-range wireless communication control unit 406 of the PC 4 receives the storage completion notification from the smartphone 5, the communication unit 401 transmits the fourth distributed file F4 generated by the distributed processing unit 405 to the server 2 via the network 3. (Step S1206).
　サーバ２の通信部２０２がＰＣ４から第４分散ファイルＦ４を受信すると、制御部２０１は、受信した第４分散ファイルＦ４を記憶部２０３に記憶する（ステップＳ１２０７）。第４分散ファイルＦ４の記憶処理が完了すると、通信部２０２は、ネットワーク３を介してＰＣ４に記憶完了通知を送信する（ステップＳ１２０８）。 When the communication unit 202 of the server 2 receives the fourth distributed file F4 from the PC 4, the control unit 201 stores the received fourth distributed file F4 in the storage unit 203 (step S1207). When the storage processing of the fourth distributed file F4 is completed, the communication unit 202 transmits a storage completion notification to the PC 4 via the network 3 (step S1208).
　ＰＣ４の通信部４０１がサーバ２から記憶完了通知を受信すると、入出力制御部４０７は、記憶部４１２からユーザープロファイルＤ３を消去する（ステップＳ１２０９）。このように、ユーザープロファイルＤ３に対して秘密分散処理が行われるとともに、ＰＣ４の記憶部４１２からユーザープロファイルＤ３が消去される。これによって、ユーザーデータをより確実に保護することができる。 When the communication section 401 of the PC 4 receives the storage completion notification from the server 2, the input/output control section 407 deletes the user profile D3 from the storage section 412 (step S1209). In this way, the user profile D3 is erased from the storage unit 412 of the PC 4 while the secret sharing process is performed on the user profile D3. This makes it possible to protect user data more reliably.
　例えば、ＰＣ４のログアウト処理の際、第２分散ファイルＦ２および第４分散ファイルＦ４をサーバ２に送信せず、ＰＣ４の記憶部４１２に残しておくことも考えられる。しかしながら、この場合、第２分散ファイルＦ２および第４分散ファイルＦ４を格納しているＰＣ４を紛失してしまうと、ユーザーＵはＰＣ４にログインできなくなってしまう。一方、本実施形態によれば、第２分散ファイルＦ２および第４分散ファイルＦ４はサーバ２に格納されているため、いずれかのＰＣ４を紛失してしまっても、他のＰＣ４にログインしてユーザーデータを使用することが可能となる。 For example, it is conceivable to leave the second distributed file F2 and the fourth distributed file F4 in the storage unit 412 of the PC4 without sending them to the server 2 during the logout process of the PC4. However, in this case, if the PC4 storing the second distributed file F2 and the fourth distributed file F4 is lost, the user U cannot log in to the PC4. On the other hand, according to this embodiment, since the second distributed file F2 and the fourth distributed file F4 are stored in the server 2, even if one of the PCs 4 is lost, the user can log in to the other PC 4 and data can be used.
　以上説明したように、本実施形態の情報処理システム１は、スマートフォン５と、ＰＣ４と、サーバ２とが通信可能に接続されたシステムである。情報処理システム１は、分散処理部４０５と、記憶部５０６と、記憶部２０３と、近距離無線通信制御部５０１と、近距離無線通信制御部４０６と、通信部２０２と、通信部４０１と、第１復元処理部４０８と、ログイン認証部４０９と、第２復元処理部４１０と、記憶部４１２とを備える。分散処理部４０５は、認証情報Ｄ２を秘密分散法にて第１分散ファイルＦ１および第２分散ファイルＦ２に分散するとともに、ユーザープロファイルＤ３を秘密分散法にて第３分散ファイルＦ３および第４分散ファイルＦ４に分散する。記憶部５０６は、第１分散ファイルＦ１および第３分散ファイルＦ３をスマートフォン５に記憶する。記憶部２０３は、第２分散ファイルＦ２および第４分散ファイルＦ４をサーバ２に記憶する。近距離無線通信制御部５０１は、記憶部５０６によって記憶された第１分散ファイルＦ１および第３分散ファイルＦ３を、近距離無線通信６によってスマートフォン５からＰＣ４に送信する。近距離無線通信制御部４０６は、近距離無線通信６によってスマートフォン５から第１分散ファイルＦ１および第３分散ファイルＦ３を受信する。通信部２０２は、記憶部２０３によって記憶された第２分散ファイルＦ２および第４分散ファイルＦ４を、ネットワーク３を介してサーバ２からＰＣ４に送信する。通信部４０１は、ネットワーク３を介してサーバ２から第２分散ファイルＦ２および第４分散ファイルＦ４を受信する。第１復元処理部４０８は、近距離無線通信制御部４０６によって受信された第１分散ファイルＦ１と通信部４０１によって受信された第２分散ファイルＦ２とを用いて、認証情報Ｄ２を復元する。ログイン認証部４０９は、第１復元処理部４０８によって復元された認証情報Ｄ２を用いて、ＰＣ４のログイン認証を行う。第２復元処理部４１０は、ＰＣ４に対するログイン処理が行われたことに応じて、近距離無線通信制御部４０６によって受信された第３分散ファイルＦ３と通信部４０１によって受信された第４分散ファイルＦ４とを用いて、ユーザープロファイルＤ３を復元する。記憶部４１２は、第２復元処理部４１０によって復元されたユーザープロファイルＤ３を記憶する。 As described above, the information processing system 1 of this embodiment is a system in which the smartphone 5, the PC 4, and the server 2 are communicably connected. The information processing system 1 includes a distributed processing unit 405, a storage unit 506, a storage unit 203, a short-range wireless communication control unit 501, a short-range wireless communication control unit 406, a communication unit 202, a communication unit 401, A first restoration processing unit 408 , a login authentication unit 409 , a second restoration processing unit 410 and a storage unit 412 are provided. The distribution processing unit 405 distributes the authentication information D2 to the first distributed file F1 and the second distributed file F2 by the secret sharing method, and distributes the user profile D3 to the third distributed file F3 and the fourth distributed file by the secret sharing method. Disperse to F4. The storage unit 506 stores the first distributed file F1 and the third distributed file F3 in the smart phone 5 . The storage unit 203 stores the second distributed file F2 and the fourth distributed file F4 in the server 2 . The short-range wireless communication control unit 501 transmits the first distributed file F1 and the third distributed file F3 stored in the storage unit 506 from the smartphone 5 to the PC 4 by short-range wireless communication 6 . The short-range wireless communication control unit 406 receives the first distributed file F1 and the third distributed file F3 from the smartphone 5 via the short-range wireless communication 6 . The communication unit 202 transmits the second distributed file F2 and the fourth distributed file F4 stored by the storage unit 203 from the server 2 to the PC 4 via the network 3 . The communication unit 401 receives the second distributed file F2 and the fourth distributed file F4 from the server 2 via the network 3 . The first restoration processing unit 408 restores the authentication information D2 using the first distributed file F1 received by the short-range wireless communication control unit 406 and the second distributed file F2 received by the communication unit 401 . The login authentication unit 409 uses the authentication information D2 restored by the first restoration processing unit 408 to perform login authentication of the PC4. The second restoration processing unit 410 restores the third distributed file F3 received by the short-range wireless communication control unit 406 and the fourth distributed file F4 received by the communication unit 401 in response to the login processing to the PC 4 being performed. to restore the user profile D3. Storage unit 412 stores user profile D3 restored by second restoration processing unit 410 .
　本実施形態によれば、ユーザーＵが複数のＰＣ４－１～４－ｎのうちのいずれのＰＣにログインしてもユーザーデータを使用することができるとともに、ユーザーデータをより確実に保護することができる。 According to this embodiment, the user data can be used even if the user U logs into any one of the plurality of PCs 4-1 to 4-n, and the user data can be protected more reliably. can.
　また、本実施形態において、ＰＣ４に対するログアウト指示が行われたことに応じて、分散処理部４０５は、ユーザープロファイルＤ３を秘密分散法にて第３分散ファイルＦ３および第４分散ファイルＦ４に分散し、近距離無線通信制御部４０６は、近距離無線通信６によってスマートフォン５に第３分散ファイルＦ３を送信し、通信部４０１は、ネットワーク３を介してサーバ２に第４分散ファイルＦ４を送信し、記憶部４１２は、ユーザープロファイルＤ３を消去する。これによって、ユーザーデータをより確実に保護することができる。 Further, in this embodiment, in response to a logout instruction to the PC 4, the distribution processing unit 405 distributes the user profile D3 to the third distributed file F3 and the fourth distributed file F4 by the secret sharing method, The short-range wireless communication control unit 406 transmits the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6, and the communication unit 401 transmits the fourth distributed file F4 to the server 2 via the network 3, and stores it. A unit 412 deletes the user profile D3. This makes it possible to protect user data more reliably.
　なお、前述したように、ロック制御部４０４は、近距離無線通信６の電波強度に基づいて、ＰＣ４をロックするか否かを制御する。ロック制御部４０４によってＰＣ４がロックされたことに応じて、分散処理部４０５は、ユーザープロファイルＤ３を秘密分散法にて第３分散ファイルＦ３および第４分散ファイルＦ４に分散し、近距離無線通信制御部４０６は、近距離無線通信６によってスマートフォン５に第３分散ファイルＦ３を送信し、通信部４０１は、ネットワーク３を介してサーバ２に第４分散ファイルＦ４を送信してもよい。これによって、スマートフォン５を所有するユーザーＵがＰＣ４から離れてＰＣ４がロックされた場合であっても、ユーザーデータをより確実に保護することができる。 As described above, the lock control unit 404 controls whether to lock the PC 4 based on the radio wave intensity of the short-range wireless communication 6. In response to the PC 4 being locked by the lock control unit 404, the distributed processing unit 405 distributes the user profile D3 to the third distributed file F3 and the fourth distributed file F4 by the secret sharing method, and performs short-range wireless communication control. The unit 406 may transmit the third distributed file F3 to the smartphone 5 via the short-range wireless communication 6, and the communication unit 401 may transmit the fourth distributed file F4 to the server 2 via the network 3. Thereby, even if the user U who owns the smart phone 5 leaves the PC 4 and the PC 4 is locked, the user data can be protected more reliably.
　本実施形態において、サーバ２の記憶部２０３は、第２分散ファイルＦ２および第４分散ファイルＦ４の他、スマートフォン情報やユーザー情報等についても記憶していることとしたが、これに限られない。例えば、第２分散ファイルＦ２および第４分散ファイルＦ４と、それ以外の情報とを、別々のサーバに記憶するようにしてもよい。 In the present embodiment, the storage unit 203 of the server 2 stores not only the second distributed file F2 and the fourth distributed file F4, but also smartphone information, user information, etc., but the present invention is not limited to this. For example, the second distributed file F2, the fourth distributed file F4, and other information may be stored in separate servers.
　また、本実施形態におけるサーバ２、ＰＣ４、およびスマートフォン５の機能の全てまたは一部を実現するためのプログラムをコンピュータ読み取り可能な記録媒体に記録して、この記録媒体に記録されたプログラムをコンピュータシステムに読み込ませ、実行することによりサーバ２、ＰＣ４、およびスマートフォン５が行う処理の全てまたは一部を行ってもよい。なお、ここでいう「コンピュータシステム」とは、ＯＳや周辺機器等のハードウェアを含むものとする。また、「コンピュータシステム」は、ホームページ提供環境（あるいは表示環境）を備えたＷＷＷシステムも含むものとする。また、「コンピュータ読み取り可能な記録媒体」とは、フレキシブルディスク、光磁気ディスク、ＲＯＭ、ＣＤ－ＲＯＭ等の可搬媒体、コンピュータシステムに内蔵されるハードディスク等の記憶装置のことをいう。さらに「コンピュータ読み取り可能な記録媒体」とは、インターネット等のネットワークや電話回線等の通信回線を介してプログラムが送信された場合のサーバやクライアントとなるコンピュータシステム内部の揮発性メモリ（ＲＡＭ）のように、一定時間プログラムを保持しているものも含むものとする。 Also, a program for realizing all or part of the functions of the server 2, the PC 4, and the smartphone 5 in this embodiment is recorded on a computer-readable recording medium, and the program recorded on this recording medium is transferred to the computer system. All or part of the processing performed by the server 2, the PC 4, and the smartphone 5 may be performed by reading and executing the software. It should be noted that the "computer system" referred to here includes hardware such as an OS and peripheral devices. Also, the "computer system" includes a WWW system provided with a home page providing environment (or display environment). The term "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems. In addition, "computer-readable recording medium" means a volatile memory (RAM) inside a computer system that acts as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. , includes those that hold the program for a certain period of time.
　また、上記プログラムは、このプログラムを記憶装置等に格納したコンピュータシステムから、伝送媒体を介して、あるいは、伝送媒体中の伝送波により他のコンピュータシステムに伝送されてもよい。ここで、プログラムを伝送する「伝送媒体」は、インターネット等のネットワーク（通信網）や電話回線等の通信回線（通信線）のように情報を伝送する機能を有する媒体のことをいう。また、上記プログラムは、前述した機能の一部を実現するためのものであってもよい。さらに、前述した機能をコンピュータシステムにすでに記録されているプログラムとの組み合わせで実現できるもの、いわゆる差分ファイル（差分プログラム）であってもよい。 Also, the program may be transmitted from a computer system storing this program in a storage device or the like to another computer system via a transmission medium or by transmission waves in a transmission medium. Here, the "transmission medium" for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be for realizing part of the functions described above. Further, it may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.
　また、上記実施形態において、ＰＣ４の機能の一部をスマートフォン５で実行してもよいし、スマートフォン５の機能の一部をＰＣ４で実行してもよい。例えば、距離測定部４０２および分散処理部４０５の各機能を、スマートフォン５に設けてもよい。 Also, in the above embodiment, the smart phone 5 may execute part of the functions of the PC 4 , and the PC 4 may execute part of the functions of the smart phone 5 . For example, each function of the distance measurement unit 402 and the distributed processing unit 405 may be provided in the smart phone 5 .
　以上、本発明を実施するための形態について実施形態を用いて説明したが、本発明はこうした実施形態に何等限定されるものではなく、本発明の要旨を逸脱しない範囲内において種々の変形および置換を加えることができる。 As described above, the mode for carrying out the present invention has been described using the embodiments, but the present invention is not limited to such embodiments at all, and various modifications and replacements can be made without departing from the scope of the present invention. can be added.
　１　　　情報処理システム
　２　　　サーバ（管理装置）
　３　　　ネットワーク
　４　　　ＰＣ（情報処理装置）
　５　　　スマートフォン（携帯端末装置）
　６　　　近距離無線通信
　２０１　制御部
　２０２　通信部
　２０３　記憶部
　４０１　通信部
　４０４　ロック制御部
　４０５　分散処理部
　４０６　近距離無線通信制御部
　４０８　第１復元処理部
　４０９　ログイン認証部
　４１０　第２復元処理部
　４１２　記憶部
　５０１　近距離無線通信制御部
　５０３　ユーザー認証部
　５０６　記憶部
　Ｕ　　　ユーザー 1 information processing system 2 server (management device)
3 network 4 PC (information processing device)
5 Smartphone (mobile terminal device)
6 short-range wireless communication 201 control unit 202 communication unit 203 storage unit 401 communication unit 404 lock control unit 405 distributed processing unit 406 short-range wireless communication control unit 408 first restoration processing unit 409 login authentication unit 410 second restoration processing unit 412 storage Unit 501 Near Field Communication Control Unit 503 User Authentication Unit 506 Storage Unit U User

Claims (8)

  1. 　携帯端末装置と、情報処理装置と、管理装置とが通信可能に接続された情報処理システムであって、
    　認証情報を秘密分散法にて第１分散ファイルおよび第２分散ファイルに分散するとともに、ユーザープロファイルを前記秘密分散法にて第３分散ファイルおよび第４分散ファイルに分散する分散処理部と、
    　前記第１分散ファイルおよび前記第３分散ファイルを前記携帯端末装置に記憶する第１記憶部と、
    　前記第２分散ファイルおよび前記第４分散ファイルを前記管理装置に記憶する第２記憶部と、
    　前記第１記憶部によって記憶された前記第１分散ファイルおよび前記第３分散ファイルを、近距離無線通信によって前記携帯端末装置から前記情報処理装置に送信する第１通信部と、
    　前記近距離無線通信によって前記携帯端末装置から前記第１分散ファイルおよび前記第３分散ファイルを受信する第２通信部と、
    　前記第２記憶部によって記憶された前記第２分散ファイルおよび前記第４分散ファイルを、ネットワークを介して前記管理装置から前記情報処理装置に送信する第３通信部と、
    　前記ネットワークを介して前記管理装置から前記第２分散ファイルおよび前記第４分散ファイルを受信する第４通信部と、
    　前記第２通信部によって受信された前記第１分散ファイルと前記第４通信部によって受信された前記第２分散ファイルとを用いて、前記認証情報を復元する第１復元処理部と、
    　前記第１復元処理部によって復元された前記認証情報を用いて、前記情報処理装置のログイン認証を行うログイン認証部と、
    　前記情報処理装置に対するログイン処理が行われたことに応じて、前記第２通信部によって受信された前記第３分散ファイルと前記第４通信部によって受信された前記第４分散ファイルとを用いて、前記ユーザープロファイルを復元する第２復元処理部と、
    　前記第２復元処理部によって復元された前記ユーザープロファイルを記憶する第３記憶部と、
    　を備える情報処理システム。     An information processing system in which a mobile terminal device, an information processing device, and a management device are communicably connected,
    a distribution processing unit that distributes the authentication information to the first distributed file and the second distributed file by the secret sharing method, and distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method;
    a first storage unit that stores the first distributed file and the third distributed file in the mobile terminal device;
    a second storage unit that stores the second distributed file and the fourth distributed file in the management device;
    a first communication unit that transmits the first distributed file and the third distributed file stored in the first storage unit from the mobile terminal device to the information processing device by short-range wireless communication;
    a second communication unit that receives the first distributed file and the third distributed file from the mobile terminal device by the short-range wireless communication;
    a third communication unit that transmits the second distributed file and the fourth distributed file stored in the second storage unit from the management device to the information processing device via a network;
    a fourth communication unit that receives the second distributed file and the fourth distributed file from the management device via the network;
    a first restoration processing unit that restores the authentication information using the first distributed file received by the second communication unit and the second distributed file received by the fourth communication unit;
    a login authentication unit that performs login authentication of the information processing device using the authentication information restored by the first restoration processing unit;
    using the third distributed file received by the second communication unit and the fourth distributed file received by the fourth communication unit in response to a login process performed on the information processing device, a second restoration processing unit that restores the user profile;
    a third storage unit that stores the user profile restored by the second restoration processing unit;
    An information processing system comprising
  2. 　前記ユーザープロファイルは、ユーザーによって作成されたファイルを含むユーザーデータと、前記情報処理装置で実行されるオペレーティングシステムおよびアプリケーションソフトウェアの設定ファイルとを含む、
    　請求項１記載の情報処理システム。     The user profile includes user data, including files created by the user, and configuration files for the operating system and application software executed on the information processing device.
    The information processing system according to claim 1.
  3. 　前記情報処理装置に対するログアウト指示が行われたことに応じて、
    　前記分散処理部は、前記ユーザープロファイルを前記秘密分散法にて前記第３分散ファイルおよび前記第４分散ファイルに分散し、
    　前記第２通信部は、前記近距離無線通信によって前記携帯端末装置に前記第３分散ファイルを送信し、
    　前記第４通信部は、前記ネットワークを介して前記管理装置に前記第４分散ファイルを送信し、
    　前記第３記憶部は、前記ユーザープロファイルを消去する、
    　請求項１記載の情報処理システム。     In response to a logout instruction to the information processing device,
    The distribution processing unit distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method,
    The second communication unit transmits the third distributed file to the mobile terminal device by the short-range wireless communication,
    The fourth communication unit transmits the fourth distributed file to the management device via the network,
    the third storage erases the user profile;
    The information processing system according to claim 1.
  4. 　生体情報を用いて、前記携帯端末装置を使用するユーザーを認証するユーザー認証部を更に有し、
    　前記ユーザー認証部により前記ユーザーが認証された場合、前記携帯端末装置および前記情報処理装置は、前記近距離無線通信で互いに接続する
    　請求項１記載の情報処理システム。     further comprising a user authentication unit that authenticates a user using the mobile terminal device using biometric information;
    2. The information processing system according to claim 1, wherein when the user is authenticated by the user authentication unit, the mobile terminal device and the information processing device are connected to each other through the short-range wireless communication.
  5. 　前記近距離無線通信の電波強度に基づいて、前記情報処理装置をロックするか否かを制御するロック制御部を更に備え、
    　前記ロック制御部によって前記情報処理装置がロックされたことに応じて、
    　前記分散処理部は、前記ユーザープロファイルを前記秘密分散法にて前記第３分散ファイルおよび前記第４分散ファイルに分散し、
    　前記第２通信部は、前記近距離無線通信によって前記携帯端末装置に前記第３分散ファイルを送信し、
    　前記第４通信部は、前記ネットワークを介して前記管理装置に前記第４分散ファイルを送信する、
    　請求項１記載の情報処理システム。     further comprising a lock control unit that controls whether to lock the information processing device based on the radio field intensity of the short-range wireless communication;
    In response to the information processing device being locked by the lock control unit,
    The distribution processing unit distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method,
    The second communication unit transmits the third distributed file to the mobile terminal device by the short-range wireless communication,
    wherein the fourth communication unit transmits the fourth distributed file to the management device via the network;
    The information processing system according to claim 1.
  6. 　携帯端末装置と、管理装置とに通信可能に接続された情報処理装置であって、
    　認証情報を秘密分散法にて第１分散ファイルおよび第２分散ファイルに分散するとともに、ユーザープロファイルを前記秘密分散法にて第３分散ファイルおよび第４分散ファイルに分散する分散処理部と、
    　近距離無線通信によって前記携帯端末装置から前記第１分散ファイルおよび前記第３分散ファイルを受信する第１通信部と、
    　ネットワークを介して前記管理装置から前記第２分散ファイルおよび前記第４分散ファイルを受信する第２通信部と、
    　前記第１通信部によって受信された前記第１分散ファイルと前記第２通信部によって受信された前記第２分散ファイルとを用いて、前記認証情報を復元する第１復元処理部と、
    　前記第１復元処理部によって復元された前記認証情報を用いて、前記情報処理装置のログイン認証を行うログイン認証部と、
    　前記情報処理装置に対するログイン処理が行われたことに応じて、前記第１通信部によって受信された前記第３分散ファイルと前記第２通信部によって受信された前記第４分散ファイルとを用いて、前記ユーザープロファイルを復元する第２復元処理部と、
    　前記第２復元処理部によって復元された前記ユーザープロファイルを記憶する記憶部と、
    　を備える情報処理装置。     An information processing device communicably connected to a mobile terminal device and a management device,
    a distribution processing unit that distributes the authentication information to the first distributed file and the second distributed file by the secret sharing method, and distributes the user profile to the third distributed file and the fourth distributed file by the secret sharing method;
    a first communication unit that receives the first distributed file and the third distributed file from the mobile terminal device by short-range wireless communication;
    a second communication unit that receives the second distributed file and the fourth distributed file from the management device via a network;
    a first restoration processing unit that restores the authentication information using the first distributed file received by the first communication unit and the second distributed file received by the second communication unit;
    a login authentication unit that performs login authentication of the information processing device using the authentication information restored by the first restoration processing unit;
    using the third distributed file received by the first communication unit and the fourth distributed file received by the second communication unit in response to a login process performed on the information processing device, a second restoration processing unit that restores the user profile;
    a storage unit that stores the user profile restored by the second restoration processing unit;
    Information processing device.
  7. 　携帯端末装置と、管理装置とに通信可能に接続された情報処理装置によって実行される情報処理方法であって、
    　認証情報を秘密分散法にて第１分散ファイルおよび第２分散ファイルに分散するとともに、ユーザープロファイルを前記秘密分散法にて第３分散ファイルおよび第４分散ファイルに分散する分散処理工程と、
    　近距離無線通信によって前記携帯端末装置から前記第１分散ファイルおよび前記第３分散ファイルを受信する第１通信工程と、
    　ネットワークを介して前記管理装置から前記第２分散ファイルおよび前記第４分散ファイルを受信する第２通信工程と、
    　前記第１通信工程によって受信された前記第１分散ファイルと前記第２通信工程によって受信された前記第２分散ファイルとを用いて、前記認証情報を復元する第１復元処理工程と、
    　前記第１復元処理工程によって復元された前記認証情報を用いて、前記情報処理装置のログイン認証を行うログイン認証工程と、
    　前記情報処理装置に対するログイン処理が行われたことに応じて、前記第１通信工程によって受信された前記第３分散ファイルと前記第２通信工程によって受信された前記第４分散ファイルとを用いて、前記ユーザープロファイルを復元する第２復元処理工程と、
    　前記第２復元処理工程によって復元された前記ユーザープロファイルを記憶する記憶工程と、
    　を備える情報処理方法。     An information processing method executed by an information processing device communicably connected to a mobile terminal device and a management device,
    a distribution processing step of distributing the authentication information to the first distributed file and the second distributed file by the secret sharing method, and distributing the user profile to the third distributed file and the fourth distributed file by the secret sharing method;
    a first communication step of receiving the first distributed file and the third distributed file from the mobile terminal device by short-range wireless communication;
    a second communication step of receiving the second distributed file and the fourth distributed file from the management device via a network;
    a first restoration processing step of restoring the authentication information using the first distributed file received by the first communication step and the second distributed file received by the second communication step;
    a login authentication step of performing login authentication of the information processing device using the authentication information restored by the first restoration processing step;
    using the third distributed file received by the first communication step and the fourth distributed file received by the second communication step in response to the login processing to the information processing device being performed, a second restoration processing step of restoring the user profile;
    a storage step of storing the user profile restored by the second restoration processing step;
    An information processing method comprising:
  8. 　コンピュータに、請求項７記載の情報処理方法を実行させるためのプログラム。 A program for causing a computer to execute the information processing method according to claim 7.
PCT/JP2021/035510 2021-09-28 2021-09-28 Information processing system, information processing device, information processing method, and program WO2023053164A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/JP2021/035510 WO2023053164A1 (en) 2021-09-28 2021-09-28 Information processing system, information processing device, information processing method, and program

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2021/035510 WO2023053164A1 (en) 2021-09-28 2021-09-28 Information processing system, information processing device, information processing method, and program

Publications (1)

Publication Number Publication Date
WO2023053164A1 true WO2023053164A1 (en) 2023-04-06

Family

ID=85781460

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2021/035510 WO2023053164A1 (en) 2021-09-28 2021-09-28 Information processing system, information processing device, information processing method, and program

Country Status (1)

Country Link
WO (1) WO2023053164A1 (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004234633A (en) * 2003-01-06 2004-08-19 Sony Corp System and server for authentication, terminal, portable storage medium, method and program for authentication, authentication information registration, information transmission, and information transmission/receipt, storage medium, and device and method for information processing
JP2005339133A (en) * 2004-05-26 2005-12-08 Nippon Telegr & Teleph Corp <Ntt> System for shared personal computer and management method for it
WO2021048996A1 (en) * 2019-09-13 2021-03-18 エアトラスト株式会社 Information processing system, information processing device, authentication method, and program
WO2021059491A1 (en) * 2019-09-27 2021-04-01 エアトラスト株式会社 Information processing system, information processing method, and program

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004234633A (en) * 2003-01-06 2004-08-19 Sony Corp System and server for authentication, terminal, portable storage medium, method and program for authentication, authentication information registration, information transmission, and information transmission/receipt, storage medium, and device and method for information processing
JP2005339133A (en) * 2004-05-26 2005-12-08 Nippon Telegr & Teleph Corp <Ntt> System for shared personal computer and management method for it
WO2021048996A1 (en) * 2019-09-13 2021-03-18 エアトラスト株式会社 Information processing system, information processing device, authentication method, and program
WO2021059491A1 (en) * 2019-09-27 2021-04-01 エアトラスト株式会社 Information processing system, information processing method, and program

Similar Documents

Publication Publication Date Title
US10645581B2 (en) Method and apparatus for remote portable wireless device authentication
JP5167835B2 (en) User authentication system, method, program, and medium
US20140075493A1 (en) System and method for location-based protection of mobile data
US20060075230A1 (en) Apparatus and method for authenticating access to a network resource using multiple shared devices
US20070177740A1 (en) Encryption key distribution system, key distribution server, locking terminal, viewing terminal, encryption key distribution method, and computer-readable medium
CN104662870A (en) Data security management system
CN104303481A (en) Method and apparatus for remote portable wireless device authentication
US11403380B2 (en) Method for managing fingerprint and system thereof
KR100834270B1 (en) Method and system for providing virtual private network services based on mobile communication and mobile terminal for the same
CN105325021B (en) Method and apparatus for remote portable wireless device authentication
JP7105495B2 (en) Segmented key authenticator
JP4698481B2 (en) Worker management method, information processing apparatus, worker terminal, and program used therefor
KR101278926B1 (en) Social verification login system being possible to verify user and providing method thereof
CN107888608A (en) A kind of encryption system for protecting computer software
JP6829341B1 (en) Information processing systems, information processing methods, and programs
JP4556636B2 (en) Dynamic organization management system, dynamic organization management method, dynamic organization management device, and dynamic organization management program
KR101133210B1 (en) Mobile Authentication System and Central Control System
WO2023053164A1 (en) Information processing system, information processing device, information processing method, and program
JP4709109B2 (en) Authentication system, mobile communication terminal, authentication device, and program
WO2022162857A1 (en) Information processing system, information processing method, and program
US11954195B2 (en) Multi-level authentication for shared device
CN108668260B (en) SIM card data self-destruction method, SIM card, device and server
CN108268796B (en) Offline management method and device based on offline password
KR101495766B1 (en) System and method for remote security management
KR101357367B1 (en) Method and system for managing authentication information using SE

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21959217

Country of ref document: EP

Kind code of ref document: A1