Information query system and information query method

Abstract

The present invention provides an information query system and an information query method, which safely disclose appropriate information corresponding to whether a user is conscious or not. When the server determines that the verification of consciousness confirmation information indicating that the user is conscious is successful and that the biometric authentication based on the biometric information of the user between the terminal and the server is successful, the server sends the disclosure object information with the authority to receive disclosure when the user is conscious to the terminal. When the verification of consciousness confirmation information is not determined to be successful and it is determined that the first biometric authentication and the biometric authentication of the agent based on the biometric information of the agent between the terminal and the server are successful, the server sends the disclosure object information with the authority to receive disclosure when the user is not conscious to the terminal.

Description

Technical Field

[0001] The invention relates to an information query system and an information query method. Background Art

[0002] As the background technology of the present invention, there is Japanese Patent Publication No. 2004-357843 (Patent Document 1). In the publication, it is recorded that "In the command center, emergency information such as the citizen's medical history, medication status, and undesired treatment methods, the citizen's fingerprint information, the fingerprint information of the emergency team members and doctors who read the emergency information, and the doctors on duty at the designated emergency hospital and their medical fields are databased. Based on the patient's fingerprint, the patient's emergency information is obtained from the database. Based on the fingerprint of the emergency medical personnel, it is checked whether the emergency medical personnel has the right to browse the emergency information. In addition, based on the fingerprint of the doctor stationed at the command center or the doctor located outside the command center, it is checked whether the doctor has the right to read the emergency information. Then, the doctor with the right to read checks the patient's emergency information and instructs the emergency team members with the right to read the most suitable life-saving treatment and transportation destination hospital for the patient." (Refer to the abstract).

[0003] In the technology described in Patent Document 1, the right of emergency personnel and doctors to view emergency information for citizens (users) does not take into account whether the citizens are conscious. For users, sometimes the information that can be disclosed is different depending on whether they are conscious or not. Therefore, one embodiment of the present invention safely discloses appropriate information corresponding to whether the user is conscious or not.

[0004] Patent Document 1: Japanese Patent Application Publication No. 2004-357843 Summary of the invention

[0005] In order to solve the above-mentioned problems, one embodiment of the present invention adopts the following structure. An information inquiry system includes a terminal and a server, the server retaining user disclosure object information and authority information, the authority information indicating the authority to receive disclosure corresponding to whether the user has consciousness for each type of the disclosure object information, the terminal acquiring first biometric information of the user and acquiring second biometric information of an agent, the server receiving a data acquisition request based on consciousness confirmation information indicating that the user has consciousness from the terminal, and when it is determined based on the data acquisition request that the verification of the consciousness confirmation information is successful and when it is determined that the first biometric authentication of the user between the terminal and the server based on the first biometric information is successful, the server transmits to the terminal information that the authority to receive disclosure indicated by the authority information when the user has consciousness, which is included in the disclosure object information, and when it is determined that the verification of the consciousness confirmation information is not successful and when it is determined that the first biometric authentication and the second biometric authentication of the agent between the terminal and the server based on the second biometric information are successful, the server transmits to the terminal information that the authority to receive disclosure indicated by the authority information when the user has no consciousness, which is included in the disclosure object information.

[0006] According to one aspect of the present invention, it is possible to safely disclose appropriate information in accordance with whether or not the user is aware of the information.

[0007] The following description of the embodiments will make other problems, structures, and effects clear. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a block diagram showing a configuration example of the information inquiry system in the first embodiment.

[0009] Figure 2 This is a block diagram showing an example of the hardware configuration of each device included in the information inquiry system in the first embodiment.

[0010] Figure 3 This is a flowchart showing an example of a user information registration process included in the initial registration process in the first embodiment.

[0011] Figure 4 This is a flowchart showing an example of lifeguard information registration processing included in the initial registration processing in the first embodiment.

[0012] Figure 5 This is a flowchart showing an example of a user medical information registration process included in the initial registration process in the first embodiment.

[0013] Fig. 6AThis is an explanatory diagram showing an example of screen transition when authority is transferred using the standard classification in the first embodiment.

[0014] Figure 6B This is an explanatory diagram showing an example of screen transition when authority is transferred using the standard classification in the first embodiment.

[0015] Figure 6C This is an explanatory diagram showing an example of screen transition when authority is transferred by selecting information individually in the first embodiment.

[0016] Figure 7 This is a sequence diagram showing an example of information inquiry processing when the user (injured or sick person) is conscious during first aid in the first embodiment.

[0017] Fig. 8A This is a sequence diagram showing an example of information inquiry processing when the user (injured or sick person) is unconscious during first aid in the first embodiment.

[0018] Figure 8B This is a sequence diagram showing an example of information inquiry processing when the user (injured or sick person) is unconscious during first aid in the first embodiment.

[0019] Fig. 9A This is an explanatory diagram showing an example of screen transition of the rights transfer registration content confirmation screen in the first embodiment.

[0020] Fig. 9B This is an explanatory diagram showing an example of screen transition of the rights transfer registration content confirmation screen in the first embodiment.

[0021] Fig. 9C This is an explanatory diagram showing an example of screen transition of the information presentation consent screen in the first embodiment. DETAILED DESCRIPTION

[0022] Hereinafter, an embodiment of the present invention will be described in detail based on the accompanying drawings. In this embodiment, the same structure is marked with the same figure mark in principle, and repeated description is omitted. In addition, it should be noted that this embodiment is only an example for implementing the present invention and does not limit the technical scope of the present invention.

[0023] [Example 1]

[0024] Figure 1 2 is a block diagram showing a configuration example of an information inquiry system. The information inquiry system includes a terminal 100, a user information management server 200, a lifeguard information management server 300, and a medical information management server 400 connected via a network such as the Internet.

[0025] The terminal 100 includes, for example, a UID acquisition unit 101, a PIN (Personal Identification Number) acquisition unit 102, a biometric information acquisition unit 103, a key generation unit 104, a public key certificate generation unit 105, a registration request unit 106, an authority transfer registration unit 107, a data acquisition request unit 108, an authentication unit 109 and a signature unit 110, which are all functional units.

[0026] The UID acquisition unit 101 acquires a UID which is an ID that uniquely identifies an individual. The PIN acquisition unit 102 acquires a PIN. The biometric information acquisition unit 103 acquires biometric information. The key generation unit 104 generates a key pair of a public key and a private key based on the biometric information acquired by the biometric information acquisition unit 103 .

[0027] The public key certificate generation unit 105 generates a public key certificate corresponding to the key pair generated by the key generation unit 104. The registration request unit 106 requests the user information management server 200, the lifeguard information management server 300, and the medical information management server 400 to register information. The authority transfer registration unit 107 registers information related to the authority to accept disclosure of disclosure target information (and information related to the transfer of the authority to accept disclosure), wherein the disclosure target information includes the medical information and qualification information of the user.

[0028] The data acquisition request unit 108 requests the user information management server 200 and the lifeguard information management server 300 to acquire data. The authentication unit 109 performs authentication between the terminal 100 and the user information management server 200 and between the terminal 100 and the lifeguard information management server 300. The signature unit 110 adds a signature to the data received from the user information management server 200.

[0029] The user information management server 200 includes, for example, a data management unit 201, a PIN verification unit 202, and an authentication unit 203, all of which are functional units. In addition, the user information management server 200 holds, for example, one or more wallets 221.

[0030] The data management unit 201 manages the data held by the user information management server 200. The PIN verification unit 202 verifies the PIN received from the terminal 100. The authentication unit 203 performs authentication between the terminal 100 and the user information management server 200. The wallet 221 is associated with the UID of each user and holds data such as the medical information of the user. In other words, the wallet 221 is a data storage area on an auxiliary storage device determined for each user, and is used to store data registered in the user information management server 200 from the terminal 100, data registered in the user information management server 200 from the medical information management server 400, and the like.

[0031] The lifeguard information management server 300 includes, for example, a data management unit 301 and an authentication unit 302, both of which are functional units. In addition, the lifeguard information management server 300 holds, for example, one or more wallets 321.

[0032] The data management unit 301 manages the data maintained by the lifeguard information management server 300. The authentication unit 302 performs authentication between the terminal 100 and the lifeguard information management server 300. The wallet 321 is associated with the UID of the emergency lifeguard, respectively, and maintains data such as the information of the emergency lifeguard. That is, the wallet 321 is a data storage area on the auxiliary storage device determined for each lifeguard, which is used to store data registered in the lifeguard information management server 300 from the terminal 100. In addition, in the present embodiment, the emergency lifeguard is also referred to as a lifeguard. The lifeguard is an example of an agent who inquires the user's information from the user information management server 200 as an agent of the user.

[0033] The medical information management server 400 includes, for example, a data management unit 401 and an electronic certificate verification unit 402, both of which are functional units. In addition, the medical information management server 400 holds, for example, qualification data 421 and medical data 422.

[0034] The data management unit 401 manages data held by the medical information management server 400. The electronic certificate verification unit 402 verifies the electronic certificate sent from the terminal 100. The qualification data 421 indicates qualification information of health insurance subscribed by the user, etc. The medical data 422 indicates information related to the medical treatment of the user.

[0035] In addition, some of the devices included in the information query system may also be integrated. Specifically, for example, the user information management server 200 and the lifeguard information management server 300 may be integrated. In addition, communication and authentication between the integrated devices may be omitted. In addition, the lifeguard information management server 300 may not be connected to the medical information management server 400.

[0036] In addition, the information query system may include a plurality of terminals 100. In this case, for example, the user and the lifeguard may each have a terminal 100 such as a smartphone or a tablet computer.

[0037] In addition, the terminal 100 can also be divided into a registration terminal used in the initial registration process described later and an inquiry terminal used in the information inquiry process described later. In this case, for example, the registration terminal is used for initial registration, so it can be a portable terminal such as a smart phone or a tablet computer, or a fixed dedicated terminal set up in a specific place. The inquiry terminal is used in emergency treatment, so it can be a portable terminal such as a smart phone or a tablet computer.

[0038] For example, the registration terminal includes a UID acquisition unit 101, a PIN acquisition unit 102, a biometric information acquisition unit 103, a key generation unit 104, a public key certificate generation unit 105, a registration request unit 106 and an authority transfer registration unit 107, which respectively serve as functional units for executing processes included in the initial registration process, and the query terminal includes a biometric information acquisition unit 103, a key generation unit 104, a data acquisition request unit 108, an authentication unit 109 and a signature unit 110, which respectively execute processes included in the information query process.

[0039] Figure 2 The block diagram shows an example of the hardware structure of each device included in the information inquiry system. The terminal 100, the user information management server 200, the lifeguard information management server 300, and the medical information management server 400 are each composed of a computer 500 having a CPU (Central Processing Unit) 501, a memory 502, an auxiliary storage device 503, an input device 504, a display device 505, and a communication device 506. In addition, the computer 500 constituting the terminal 100 may also have a biosensor 507 and an IC (Integrated Circuit) card reader 508.

[0040] The CPU 501 includes a processor, and executes a program stored in the memory 502. The memory 502 includes a ROM (Read Only Memory) as a nonvolatile storage element and a RAM (Random Access Memory) as a volatile storage element. The ROM stores a fixed program (for example, BIOS (Basic Input / Output System)) and the like. The RAM is a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores the program executed by the CPU 501 and the data used when executing the program.

[0041] The auxiliary storage device 503 is a large-capacity and non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores the program executed by the CPU 501 and the data used when executing the program. That is, the program is read from the auxiliary storage device 503, loaded into the memory 502, and executed by the CPU 501.

[0042] The input device 504 is a device such as a keyboard and a mouse that receives input from an operator. The display device 505 is a device such as a display and a printer that outputs the execution result of the program in a form that the operator can visually recognize. In addition, for example, the input device 504 and the display device 505 may be integrated like a touch panel.

[0043] The communication device 506 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 506 includes a serial interface such as a USB (Universal Serial Bus).

[0044] The biometric sensor 507 is a sensor for obtaining a predetermined type of biometric information. The predetermined type of biometric information is preferably biometric information that can be obtained by others without the user's awareness, and includes, for example, images and moving images obtained by photographing a part of the body such as the face, hand (palm print, vein), finger (fingerprint, vein), etc., using light of any predetermined wavelength such as visible light, infrared light, near infrared light, or X-rays.

[0045] In addition, during emergency transportation, it is assumed that the vein or fingerprint cannot be obtained due to an injury to the user's hand or finger, and the iris cannot be obtained due to the user's unconscious closing of the eyes, so it is preferred that the biometric sensor 507 can obtain multiple types of biometric information. In this case, biometric authentication can be performed using one type of biometric information among the multiple types of biometric information.

[0046] The IC card reader 508 reads the IC information loaded in the IC card. In addition, the computer 500 constituting the terminal 100 may also include a function of reading the IC information loaded in the IC card by short-distance wireless communication instead of the IC card reader 508.

[0047] A part or all of the program executed by CPU 501 may be provided to computer 500 from a removable medium (CD-ROM, flash memory, etc.) as a non-transitory storage medium, or provided to computer 500 from an external computer having a non-transitory storage device via a network, and stored in non-volatile auxiliary storage device 503 as a non-transitory storage medium. Therefore, computer 500 may have an interface for reading data from a removable medium.

[0048] Each device included in the information query system is a computer system that is physically on one computer 500, or on multiple computers 500 that are logically or physically constructed. It can operate through a separate thread on the same computer 500, or it can operate on a virtual computer built on multiple physical computer resources.

[0049] The above-mentioned functional units possessed by each device included in the information inquiry system are included in the CPU 501 of the computer 500 constituting the device. For example, the CPU 501 of the computer 500 constituting the terminal 100 functions as the UID acquisition unit 101 by operating in accordance with the UID acquisition program loaded into the memory 502 of the computer 500, and functions as the PIN acquisition unit 102 by operating in accordance with the PIN acquisition program loaded into the memory 502 of the computer 500. The relationship between the CPU 501, the program, and the functional unit is also the same for other functional units possessed by the terminal 100. In addition, the relationship between the CPU 501, the program, and the functional unit is the same for the functional units possessed by the user information management server 200, the lifeguard information management server 300, and the medical information management server 400.

[0050] Furthermore, part or all of the functions implemented by the functional units of each device included in the information inquiry system may be implemented by hardware such as ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array).

[0051] The auxiliary storage device 503 of the computer 500 constituting the user information management server 200 holds the wallet 221. The auxiliary storage device 503 of the computer 500 constituting the lifeguard information management server 300 holds the wallet 321. The auxiliary storage device 503 of the computer 500 constituting the medical information management server 400 holds the qualification data 421 and the medical data 422.

[0052] Furthermore, part or all of the information held by each device included in the information inquiry system may be stored in the memory 502 of the computer 500 constituting the device, or may be stored in an external database connected to the device.

[0053] In addition, in this embodiment, the information used by the information query system does not depend on the data structure and can be represented by any data structure. For example, a data structure appropriately selected from a table, a list, a database or a queue can store the information.

[0054] Below, use Figure 3 to Figure 5 , the initial registration process for registering user information, lifeguard information, and user's medical information separately is described. Figure 3 to Figure 5 In the description, an example is described in which the user and the lifeguard use different terminals 100, but the same terminal 100 may be used.

[0055] Figure 31 is a flowchart showing an example of the user information registration process included in the initial registration process. The UID acquisition unit 101 of the terminal 100 generates a UID that uniquely identifies an individual user (S301).

[0056] Specifically, for example, the UID acquisition unit 101 may acquire the UID by receiving an input of the UID from the user via the input device 504 of the computer 500 constituting the terminal 100, or may acquire the UID by automatically generating the UID by the UID acquisition unit 101. In addition, in order not to assign the same UID to different individuals, the UID acquisition unit 101 may inquire the user information management server 200 whether there is a UID that is duplicated with the UID that has been acquired, or may acquire the UID by requesting the user information management server 200 to generate the UID.

[0057] The PIN acquisition unit 102 acquires the PIN (S302). Specifically, for example, the PIN acquisition unit 102 acquires the PIN by receiving an input of the PIN from the user via the input device 504 of the computer 500 constituting the terminal 100. In addition, the PIN is an example of information (consciousness confirmation information) for confirming whether the user is conscious in the information inquiry process, and the user's voice or the like may be used as the consciousness confirmation information instead of or in addition to the PIN.

[0058] The biometric information acquisition unit 103 acquires the biometric information for registration of the user via the biometric sensor 507 of the computer 500 constituting the terminal 100 ( S303 ).

[0059] The key generation unit 104 generates a key pair of a private key and a public key from the biometric information obtained in step S303 using a predetermined algorithm (S304). RSA, DSA (Digital Signature Algorithm) and the like are examples of the predetermined algorithm. In addition, Fuzzy Extractor, Fuzzy Signature and the like are also examples of the predetermined algorithm. However, when the key generation unit 104 uses an algorithm such as Fuzzy Extractor, in addition to the key pair, auxiliary information is generated, and the generated auxiliary information is used for the generation of the private key in the information query process described later.

[0060] The public key certificate generation unit 105 generates a public key certificate (S305). A public key certificate is a certificate generated by giving a biometric signature to the public key included in the key pair, and is used for signature verification (self-signature verification) using a private key generated based on biometric information. In step S305, for example, the public key certificate generation unit 105 can generate a self-certificate as a public key certificate based on the private key generated in step S304, or can obtain a public key certificate from a certification authority connected to the terminal 100.

[0061] The registration request unit 106 transmits the UID acquired in step S301 , the PIN acquired in step S302 , and the public key certificate generated in step S305 to the user information management server 200 ( S306 ).

[0062] The data management unit 201 of the user information management server 200 generates a wallet 221 corresponding to the UID received in step S306, associates the UID, PIN, and public key certificate received in step S306, and registers them in the generated wallet 221 (S307).

[0063] In addition, in step S307, the data management unit 201 generates data indexes corresponding to various types of qualification information and medical information in the wallet 221. The generated data index is, for example, predetermined. Here, the data index refers to information used to determine the type of data. The data index of the data included in the qualification data 421 includes, for example, the user's address, name, date of birth, emergency contact information, and the insured number of health insurance, and the data index of the data included in the medical data 422 includes, for example, the user's family doctor, medication information, diseases being treated, allergies, and medical history.

[0064] The data management unit 201 notifies the terminal 100 of the registration result in step S307 (S308). The notified registration result may be displayed on the display device 505 of the computer 500 constituting the terminal 100, for example.

[0065] In addition, when auxiliary information is generated in step S304, in step S306, the registration request unit 106 sends the auxiliary information to the user information management server 200, and in step S307, the data management unit 201 also associates the auxiliary information with the UID and registers it to the generated wallet 221.

[0066] In the above example, the PIN is registered in the user information management server 200. However, if the user can use the terminal 100 used in the initial registration process in the information inquiry process, such as when the user holds the terminal 100 separately, the PIN may be registered in the auxiliary storage device 503 of the terminal 100. In this case, the PIN may not be sent to the user information management server 200 in step S306, and the PIN may not be registered in the wallet 221 in step S307.

[0067] In addition, as described above, the biometric information acquisition unit 103 preferably acquires multiple types of biometric information of the user. In this case, the processing of step S304 and step S305 is performed for each of the multiple types of biometric information, and the public key certificate corresponding to each of the multiple types of biometric information is sent in step S306. In step S307, the public key certificate corresponding to each of the multiple types of biometric information is associated with the UID and registered in the wallet 221.

[0068] The authority transfer registration unit 107 obtains information (authority transfer information) related to the transfer of authority to receive information disclosure when the user is unconscious during emergency treatment (S309) through the user's input to the input device 504. In step S309, the authority transfer information registration screen described later is displayed on the display device 505 of the computer 500 constituting the terminal 100, and the authority transfer information is obtained through the authority transfer information registration screen.

[0069] In addition, when the user is unconscious during first aid, it is impossible to consent to the disclosure of medical information etc. based on the user's intention during information query processing, which will be described in detail later. Therefore, by pre-registering authority transfer information, wherein the authority transfer information indicates the prior consent for the disclosure of medical information etc., even if the user is unconscious during first aid, part or all of the medical information etc. can be disclosed to lifeguards etc.

[0070] The authority transfer information indicates the authority to be disclosed for each data type (each data index) corresponding to whether or not the user is conscious. Specifically, for example, the authority transfer information indicates information that can be disclosed only when the user is conscious (i.e., information that only the user has the authority to be disclosed), information that can be disclosed only when the disclosure conditions are met (even if the user is unconscious during first aid) (i.e., information that the authority to be disclosed is transferred from the user when the disclosure conditions are met), and information that can be disclosed as long as the user and the lifeguard are in the same place (even if the user is unconscious during first aid) (information that not only the user but also the lifeguard has the authority to be disclosed).

[0071] The disclosure conditions include, for example, conditions related to the user's symptoms during emergency treatment and conditions related to the person who transfers the authority to receive disclosure. That is, for example, when the user is unconscious during emergency treatment, the user's medical information is disclosed within a scope corresponding to the user's symptoms and at least one of the persons who request (agree) to disclose (the user's medical information).

[0072] The authority transfer registration unit 107 sends the authority transfer information obtained in step S309 to the user information management server 200 (S310). The data management unit 201 of the user information management server 200 associates the authority transfer information received in step S310 with the UID and registers it in the wallet 221 generated in step S307 (S311). In addition, in step S311, the authority transfer information registered in step S311 (information related to the authority to be disclosed indicated by the authority transfer information) is registered in correspondence with each data index of the wallet 221.

[0073] In addition, for predetermined types of data, disclosure conditions can be predetermined without requiring the input of permission transfer information. Specifically, for example, as types of data, disclosure conditions can be predetermined for the user's name, date of birth, address, emergency contact information, family doctor, medical conditions, common medications, and allergies, such as being able to be disclosed to a lifeguard without the user's awareness.

[0074] The data management unit 201 notifies the terminal 100 of the registration result in step S311 (S312). The key generation unit 104 of the terminal 100 deletes the private key of the key pair generated in step S304 (S313).

[0075] Figure 4 This is a flowchart showing an example of the lifeguard information registration process included in the initial registration process. The UID acquisition unit 101 of the terminal 100 generates a UID that uniquely identifies the lifeguard (S401). The method of obtaining the UID in step S401 is the same as the method of obtaining the UID in step S301. However, when the user information management server 200 and the lifeguard information management server 300 are integrated, the UID of the lifeguard needs to be set to not be repeated with the UID of either the user or the lifeguard.

[0076] The biometric information acquisition unit 103 acquires the biometric information for registration of the lifeguard via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S402). The type of the biometric information for registration of the user and the type of the biometric information for registration of the lifeguard may be the same or different.

[0077] The key generation unit 104 generates a key pair of a private key and a public key from the biometric information acquired in step S402 using a predetermined algorithm (S403). The key pair generation method in step S403 is the same as the key pair generation method in step S304 except that the biometric information for registration of the lifeguard is used.

[0078] The public key certificate generation unit 105 generates a public key certificate (S404). The method of generating the public key certificate in step S404 is the same as the method of generating the public key certificate in step S304, except that it is a public key certificate associated with the lifeguard's key pair.

[0079] The registration request unit 106 sends the UID obtained in step S401 and the public key certificate generated in step S404 to the lifeguard information management server 300 (S405). The data management unit 301 of the lifeguard information management server 300 generates a wallet 321 corresponding to the UID received in step S405, and associates the UID and public key certificate received in step S405 and registers them in the generated wallet 321 (S406). The data management unit 301 notifies the terminal 100 of the registration result in step S406 (S407). The notified registration result can be displayed on the display device 505 of the computer 500 constituting the terminal 100, for example. The key generation unit 104 of the terminal 100 deletes the private key of the key pair generated in step S403 (S408).

[0080] In addition, when auxiliary information is generated in step S403, in step S405, the registration request unit 106 sends the auxiliary information to the lifeguard information management server 300. In step S406, the data management unit 301 also associates the auxiliary information with the UID and registers it in the generated wallet 321.

[0081] In addition, in the lifeguard information registration process, the lifeguard's PIN can be set and stored in the wallet 321 in the same manner as the user information registration process. In addition, in the lifeguard information registration process, the lifeguard's name and qualification data can be registered in the wallet 321 together (a data index corresponding to the data is generated and associated with the data index).

[0082] Figure 5 This is a flowchart showing an example of a user medical information registration process included in the initial registration process. The registration request unit 106 reads the information of the IC chip of the user's personal number card via the IC card reader 508 of the computer 500 constituting the terminal 100 (S501). The IC chip of the personal number card stores an electronic certificate for user authentication.

[0083] The registration request unit 106 receives input of a password for taking out the user authentication electronic certificate stored in the IC chip of the individual number card (S502) via the input device 504 of the computer 500 constituting the terminal 100. When the correct password is input, the registration request unit 106 can take out the user authentication electronic certificate from the IC chip.

[0084] The registration request unit 106 sends the retrieved electronic certificate for user authentication to the medical information management server 400 (S503). The electronic certificate verification unit 402 of the medical information management server 400 verifies the electronic certificate for user authentication received in step S503. When the verification is successful, the data management unit 401 obtains the qualification information of the user represented by the electronic certificate for user authentication from the qualification data 421, obtains the medical information of the user from the medical data 422, and sends the obtained qualification information and medical information to the user information management server 200 (S504).

[0085] The data management unit 201 of the user information management server 200 associates the various qualification information and medical information (an example of disclosure target information) received in step S504 with the data index of the category and stores them in the wallet 221 of the user (S505).

[0086] In addition, from Figure 3 The user information registration process starts and continues to execute Figure 5 In the case of the user medical information registration process, for example, the wallet 221 of the user as the storage destination of the qualification information and medical information in step S505 is determined by the UID obtained in step S307. Figure 3 The user information registration process is continuously executed Figure 5 In the case of user medical information registration processing, for example, before processing step S505, the terminal 100 accepts the input of the user's UID and PIN and sends the UID and the PIN to the user information management server 200, thereby determining the wallet 221 corresponding to the UID and the PIN as the wallet 221 of the user in step S505. The user's UID can also be determined by performing a 1:N authentication using the user's biometric information in the same way as steps S808 to S810 described later before processing step S505, thereby determining the wallet 221 corresponding to the determined UID as the wallet 221 of the user in step S505.

[0087] In addition, in step S503, the registration request unit 106 of the terminal 100 may send the public key generated in step S304 to the medical information management server 400, and in step S504, the data management unit 401 encrypts the obtained qualification information and medical information using the public key and sends them to the user information management server 200. Thus, the encrypted qualification information and medical information are stored in the wallet 221, so that even the administrator of the user information management server 200 cannot view the information.

[0088] The data management unit 201 notifies the terminal 100 of the registration result in step S505 (S506). The notified registration result may be displayed on the display device 505 of the computer 500 constituting the terminal 100, for example.

[0089] In addition, Figure 5 In the example, a personal number card is used to perform authentication between the terminal 100 and the medical information management server 400. The personal number card is an example of a medium used to perform authentication between the terminal 100 and the medical information management server 400. Authentication based on any algorithm can also be performed between the terminal 100 and the medical information management server 400.

[0090] The terminal 100 may entrust the medical information management server 400 to update the qualification data 421 and medical data 422 in the wallet 221 of the user in the user information management server 200 each time the qualification data 421 and medical data 422 of the user in the medical information management server 400 are updated.

[0091] In this case, for example, when the qualification data 421 and / or medical data 422 of the user of the medical information management server 400 are updated, the processing of steps S504 to S506 is performed on the updated data. In addition, for example, when the qualification data 421 and / or medical data 422 of the user of the medical information management server 400 are updated, the terminal 100 of the user may be notified from the medical information management server 400 that the data is updated, and when the authentication based on a predetermined algorithm (for example, the authentication using the above-mentioned personal number card or the authentication based on any algorithm) between the terminal 100 and the medical information management server 400 is successful, the processing of steps S504 to S506 is performed on the updated data.

[0092] Fig. 6A , Figure 6B as well as Figure 6C This is an explanatory diagram showing an example of screen transition of the authority transfer information registration screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in step S309. Fig. 6A and Figure 6B This is an explanatory diagram showing an example of screen transition when authority is transferred using standard classification described later. Figure 6C This is an explanatory diagram showing an example of screen transition when authority is transferred by selecting information individually.

[0093] illustrate Fig. 6A as well as Figure 6BAn example of screen transition. In step S309, screen 601 is first displayed. In screen 601, it is possible to select whether to transfer the authority to query a part of information when the user is not aware. When "Yes" is selected in screen 601 and the "Next" button is selected, the screen is transferred to screen 602. In addition, when "No" is selected in screen 601 and the "Next" button is selected, the display of the authority information registration screen ends, and the authority transfer is not performed, and when the user is aware, only the data of the setting object of the authority transfer can be disclosed to the user himself.

[0094] In screen 602, it is possible to select whether to transfer authority using a predetermined standard classification or to transfer authority by selecting the type of information by the user. In screen 602, when a character string "※ View sample" is selected, the screen moves to screen 610 displaying a predetermined standard classification.

[0095] exist Fig. 6A In the example of screen 610, information that meets level 1 indicates information that cannot be disclosed if the user is not aware, information that meets level 2 indicates information that can be disclosed only when the disclosure conditions are met (even if the user is not aware), and information that meets level 3 indicates information that can be disclosed when the user is in the same place as the lifeguard and the user's biometric authentication succeeds (even if the user is not aware). As shown in the example of screen 610, the disclosed information is not limited to medical information and qualification information, but may also include personal information such as bank account and credit card information.

[0096] When the authority transfer of the usage standard classification is performed, (part of) the setting of the disclosure conditions of level 2 is performed on screen 604 and later. When the "return" button is selected on screen 610, the screen returns to screen 602.

[0097] When "transfer authority using standard classification" is selected on the screen 602 and the "next" button is selected, the screen moves to the screen 603. When the "return" button is selected on the screen 602, the screen returns to the screen 601.

[0098] In screen 603, explanations about level 2, types of information that conform to level 2, and explanations about disclosure conditions for information that conform to level 2 are displayed. The disclosure conditions displayed on screen 603 indicate that information that conforms to level 2 can be disclosed to lifeguards or people with medical qualifications, or people who have registered for authority transfer by the user (authority transfer targets) (even if the user is not aware of it). When the "return" button is selected in screen 603, the screen returns to screen 602. When the "next" button is selected in screen 603, the screen moves to screen 604.

[0099] In addition, in the example of screen 603, the lifeguard and the doctor also have the authority to accept disclosure regarding level 2 information, but it is also possible to set the lifeguard and the doctor not to have the authority to accept disclosure in screen 603 through input to the input device 504 (that is, only register the transfer of authority for the object of authority transfer registered in screen 604).

[0100] Screen 604 is a screen for setting a part of the disclosure conditions of information that meets level 2. Specifically, for example, in screen 604, the name and address of the authority transferee and the relationship with the user himself are registered (these are examples of information for specifying the authority transferee). In addition, the pronunciation of the name of the authority transferee (for example, the phonetic symbols of the name, or the kana name in Japanese, etc.) can also be registered. Similarly, the pronunciation of the user's name can be registered in the wallet 221 of the user information management server 200, and the pronunciation of the lifeguard's name can be registered in the wallet 321 of the lifeguard information management server 300.

[0101] When the "return" button is selected in the screen 604, the screen returns to the screen 603. When the "register" button is selected in the screen 604, the screen shifts to the screen 605.

[0102] Screen 605 is a screen for registering the biometric information of the authority transferee. For example, when the screen is transferred to screen 605, a camera as an example of the biometric sensor 507 of the computer 500 constituting the terminal 100 is activated, and the face of the authority transferee can be photographed. When the "return" button is selected in screen 605, the screen returns to screen 604. When the "shoot" button is selected in screen 605, the screen transfers to screen 606 after shooting with the camera.

[0103] The information of the authority transfer object inputted via the screen 604 and the image captured by the camera via the screen 605 are displayed on the screen 606 as confirmation information of the authority transfer setting. When the "return" button is selected on the screen 606, the screen returns to the screen 605. When the "confirm" button is selected on the screen 606, the screen shifts to the screen 6061.

[0104] Screen 6061 is the final confirmation screen for the authority transfer. When the "Cancel" button is selected in screen 6061, the screen returns to screen 606. When the "Register" button is selected in screen 6061, the authority transfer information is sent in step S310, and when the registration result in step S312 is notified, the notification screen as the registration result is transferred to screen 607. In addition, screens 605, 606, and 6061 can be displayed on the terminal 100 owned by the authority transfer object.

[0105] In addition, the biometric information of the object of authority transfer itself may not be registered in the wallet 221, for example, a feature quantity (of the biometric information of the object of authority transfer) generated from the biometric information of the object of authority transfer by a predetermined algorithm may be registered, or in order to further improve security, a public key certificate generated from the biometric information of the object of authority transfer by the same method as steps S304 to S305 may be registered. In addition, when the "Register" button is selected in the screen 6061, a biometric signature based on the biometric information of the object of authority transfer may be generated using a predetermined algorithm, thereby indicating consent to register the authority transfer information in the wallet 221.

[0106] In addition, with respect to the object of authority transfer, instead of authentication using biometric information, authentication based on other authentication means can be performed (for example, password authentication, device authentication (for example, by sending a one-time password to a pre-registered smartphone, etc. that is different from the terminal 100 of the authentication object, and entering the sent one-time password into the terminal 100, to authenticate that the authentication object is a person with the pre-registered smartphone, etc.) etc.).

[0107] When the "End" button is selected in screen 607, the processing of steps S309 to S312 ends. When the "Add Registration" button is selected in screen 607, the screen returns to screen 604 (however, in the case where screens 6031 and 6041 described later are transferred, the screen can be returned to screen 6041) to register further information on the object of authority transfer.

[0108] Next, Figure 6C When “Select information individually to transfer authority” is selected in screen 602 and the “Next” button is selected, the screen shifts to screen 6031 .

[0109] Screen 6031 displays a check box indicating which information is to be made eligible for level 2. When the text "Select from wallet" on screen 6031 is selected, a list of data indexes stored in wallet 221 is displayed, and information eligible for level 2 can be selected from the list of data indexes.

[0110] When the "Return" button is selected in the screen 6031, the screen returns to the screen 602. When the "Next" button is selected in the screen 6031, the information selected in the check box is selected as information that meets level 2, and then the screen moves to the screen 6041. In addition, when the "Next" button is selected in the screen 6031, a confirmation screen is displayed, which displays a list of the information selected in the check box and a "Confirm" button. When the "Confirm" button is selected in the confirmation screen, the screen moves to the screen 6041.

[0111] Screen 6041 is a screen for setting a part of the disclosure conditions of the information selected as meeting level 2 in screen 6031. Specifically, for example, on screen 604, the name and address of the person to whom the authority is transferred and the relationship with the user are registered. In addition, when the check box in screen 6041 is selected, the authority to accept the disclosure of the information selected as meeting level 2 is not transferred to the lifeguard and the doctor, but can be transferred only to the person to whom the authority is transferred. This check box can also be displayed on screen 604. When the "Return" button is selected in screen 6041, the screen returns to screen 6031. When the "Next" button is selected in screen 6041, the screen moves to screen 605.

[0112] Figure 7 This is a sequence diagram showing an example of information query processing when the user (injured or sick person) is conscious during first aid. Figure 7 In the example of , an example of using the terminal 100 owned by the user is described, but the terminal 100 owned by the lifeguard may also be used.

[0113] The UID acquisition unit 101 and the PIN acquisition unit 102 of the terminal 100 acquire the UID and the PIN of the user respectively through input to the input device 504 of the computer 500 constituting the terminal 100 ( S501 ).

[0114] The data acquisition request unit 108 generates a data index acquisition request including the UID and PIN of the user acquired in step S501 (S702). The data acquisition request unit 108 transmits the data index acquisition request generated in step S702 to the user information management server 200 (S703).

[0115] The data management unit 201 of the user information management server 200 retrieves the wallet 221 corresponding to the UID included in the data index acquisition request received in step S703, and the PIN verification unit 202 verifies whether the PIN stored in the retrieved wallet 221 is consistent with the PIN included in the data index acquisition request received in step S703 (S704). Thus, if the verification is successful, the user information management server 200 can determine that the user is conscious (that is, the user agrees to disclose the information).

[0116] In addition, when the PIN is managed by the terminal 100, the PIN stored in the terminal 100 is verified to be consistent with the PIN input in step S701. If the verification is successful, the process proceeds to step S702 and the subsequent processes. Moreover, in this case, the data acquisition request unit 108 does not include the PIN in the data index acquisition request in S702, and the user information management server 200 can determine that the verification of the PIN is successful based on the data index acquisition request including the user's UID received.

[0117] When the PIN verification in step S704 is successful, the data management unit 201 of the user information management server 200 obtains a list of public key certificates and data indexes (or data indexes that only store information of the type indicated by the data index) from the retrieved wallet 221 (S705).

[0118] The biometric information acquisition unit 103 of the terminal 100 acquires the same biometric information as in step S303 via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S706). The key generation unit 104 generates a private key based on the biometric information acquired in step S706 using the same algorithm as in step S304 (S707).

[0119] Execute the authentication process between the terminal 100 and the user information management server 200 (S708). Specifically, the authentication unit 109 of the terminal 100 uses the private key generated in step S707, and the authentication unit 203 of the user information management server 200 uses the public key certificate obtained in step S705, thereby performing the authentication of step S708. Through the authentication process of step S708, security can be ensured for the impersonation and input errors of the UID of the user information management server 200 by the terminal 100. In addition, instead of the authentication using biometric information shown in this embodiment, authentication based on other authentication means (for example, password authentication, device authentication, etc.) can be performed.

[0120] Furthermore, if auxiliary information is also stored in the wallet 221 retrieved in step S704, the data management unit 201 also obtains the auxiliary information in step S705, and transmits the obtained auxiliary information to the terminal 100 before step S707. In this case, the key generation unit 104 of the terminal 100 generates a private key in step S707 using the biometric information obtained in step S706 and the received auxiliary information.

[0121] If the authentication in step S708 is successful, the data management unit 201 of the user information management server 200 transmits the list of data indices acquired in step S705 (ie, the data indices of all the information of level 1, level 2 and level 3) to the terminal 100 (S709).

[0122] The data acquisition request unit 108 of the terminal 100 displays the list of data indices received in step S709 on the display device 505 of the computer 500 constituting the terminal 100, and accepts selection of a data index corresponding to acquisition target data via the input device 504 of the computer 500 (S710).

[0123] The data acquisition request unit 108 of the terminal 100 sends the data index selected in step S710 to the user information management server 200 (S711). The data management unit 201 of the user information management server 200 acquires the data corresponding to the data index received in step S711 from the wallet 221 retrieved in step S704, and sends the acquired data to the terminal 100 (S712). Figure 7 As in the example, when the user information management server 200 can confirm that the user is conscious and biometric authentication based on the user's biometric information is successful between the terminal 100 and the user information management server 200, the terminal 100 can obtain arbitrary information stored in the wallet 221 of the user.

[0124] The signature unit 110 of the terminal 100 generates provision consent information, and adds a signature using the private key generated in step S707 to the data received in step S712 and the generated provision consent information (S713). In addition, when the qualification information and medical information stored in the wallet 221 are encrypted using the public key generated in step S304, the data acquisition request unit 108 decrypts the data received in step S712 using the private key generated in step S707.

[0125] The consent information provided generated in step S713 includes, for example, the hash value of the data received in step S712, the user's information, the information of the verifier (for example, the fire department, the administrators of each server included in the information inquiry system, the administrator of the entire information inquiry system, the user's family, and lawyers, who may conduct lifeguard operation inspections, are all examples of verifiers), the date and time, and the purpose of use of the provided data. The signature assigned in step S713 is information that proves to the verifier that the user agrees to present the data. By assigning a signature in step S713, the verifier can prove to a third party that the data received in step S712 is not illegally obtained data and that the data is not used for an unintended purpose.

[0126] When the process of step S713 is completed, the signed data and the provision consent information are displayed on the display device 505 of the computer 500 constituting the terminal 100. The key generation unit 104 deletes the private key generated in step S707 (S714).

[0127] Fig. 8A as well as Figure 8B This is a sequence diagram showing an example of information query processing when the user (injured or sick person) is unconscious during first aid. Fig. 8A and Figure 8BIn the example of , both the terminal 100 owned by the user and the terminal 100 owned by the lifeguard can be used, but the same terminal is used in the process related to the lifeguard and the process related to the user.

[0128] The UID acquisition unit 101 of the terminal 100 acquires the UID of the lifeguard (S801) via input to the input device 504 of the computer 500 constituting the terminal 100. The data acquisition request unit 108 generates a public key certificate acquisition request including the UID of the lifeguard acquired in step S801 (S802), and transmits the generated public key certificate acquisition request to the lifeguard information management server 300 (S803).

[0129] The data management section 301 of the lifeguard information management server 300 searches for the wallet 321 corresponding to the UID of the lifeguard included in the public key certificate acquisition request received in step S803, and acquires the public key certificate from the searched wallet 321 (S804).

[0130] In addition, when the lifeguard's PIN is registered, the lifeguard's PIN is obtained in addition to the lifeguard's UID, and the obtained PIN is included in the public key certificate acquisition request. The lifeguard information management server 300 obtains the public key certificate in step S804 only when the PIN stored in the retrieved wallet 321 is consistent with the PIN included in the public key certificate acquisition request.

[0131] The biometric information acquisition unit 103 of the terminal 100 acquires the same biometric information as in step S402 via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S805). The key generation unit 104 generates a private key based on the biometric information acquired in step S805 using the same algorithm as in step S403 (S806).

[0132] Execute the authentication process between the terminal 100 and the lifeguard information management server 300 (i.e., confirm the authority of the lifeguard) (S807). Specifically, the authentication unit 109 of the terminal 100 uses the private key generated in step S806, and the authentication unit 302 of the lifeguard information management server 300 uses the public key certificate obtained in step S804, thereby performing the authentication of step S807. Through the authentication process of step S807, the security can be ensured for the impersonation and input errors of the UID of the lifeguard information management server 300 by the terminal 100. In addition, instead of the authentication using the biometric information shown in this embodiment, it is also possible to perform authentication based on other authentication means (for example, password authentication, device authentication, etc.).

[0133] Furthermore, if auxiliary information is also stored in the wallet 321 retrieved in step S804, the data management unit 301 also obtains the auxiliary information in step S804, and sends the obtained auxiliary information to the terminal 100 before step S806. In this case, the key generation unit 104 of the terminal 100 generates a private key in step S806 using the biometric information obtained in step S805 and the received auxiliary information.

[0134] If the authentication in step S807 is successful, the biometric information acquisition unit 103 of the terminal 100 acquires the biometric information of the user (for example, through the operation of a lifeguard because the user is not aware of it) (S808). The key generation unit 104 generates a private key based on the biometric information acquired in step S808 (S809). The processing of steps S808 and S809 is the same as the processing of steps S706 and S707, respectively.

[0135] The authentication process between the terminal 100 and the user information management server 200 is performed (S810). The process of step S810 is the same as the process of step S708, but Fig. 8A The user is not aware of the process and the user's UID cannot be obtained, so 1:N authentication is performed. That is, authentication is performed using the private key generated in step S809 and the public key certificates in all wallets 221 maintained by the user information management server 200. If authentication using the private key and the public key certificate in one wallet 221 is successful, it is determined that the authentication in step S810 is successful.

[0136] and Figure 7 Unlike the example, the user's UID and PIN are not sent to the user information management server 200 (the verification of the user's PIN is not determined to be successful). By executing the authentication of step S810, the user information management server 200 can determine that the user is unconscious.

[0137] Since the biometric information of the lifeguard in step S805 and the biometric information of the user in step S808 are obtained by the same terminal 100, it is ensured that the lifeguard and the user are in the same place, thereby preventing the lifeguard from illegally obtaining the user's information.

[0138] When the authentication in step S810 is successful, the data management unit 201 of the user information management server 200 transmits the user's UID and authority transfer information stored in the wallet 221 corresponding to the successfully authenticated public key certificate to the terminal 100 (S811).

[0139] The data acquisition request unit 108 of the terminal 100 displays information indicating the content of the authority transfer on the display device 505 of the computer 500 constituting the terminal 100 based on the authority transfer information received in step S811, thereby allowing the lifeguard to confirm the registration content of the authority transfer (S812). In addition, in step S812, the data acquisition request unit 108 can execute the authority transfer based on the authority transfer registration content through input to the input device 504 of the computer 500 constituting the terminal 100.

[0140] The data acquisition request unit 108 transmits a data index list acquisition request including the user UID received in step S811 and the information indicating the authority transferred in step S812 to the user information management server 200 ( S813 ).

[0141] The data management unit 201 of the user information management server 200 retrieves the wallet 221 corresponding to the UID contained in the data index acquisition request received in step S813, and obtains an overview of the data index (which may also be a data index that only stores information of the type indicated by the data index) from the retrieved wallet 221 (S814).

[0142] The list of data indexes obtained in step S814 is composed of the following data indexes:

[0143] If the user is in the same place as the lifeguard and the authentication based on the user's biometric information is successful, the data index of the data that can be disclosed (the information that meets level 3 in the above example), and

[0144] The data index of the data corresponding to the transferred authority indicated by the data index list acquisition request received in step S813.

[0145] The data management unit 201 sends the list of data indexes obtained in step S814 to the terminal 100 (S815). The data acquisition request unit 108 of the terminal 100 displays the list of data indexes received in step S815 on the display device 505 of the computer 500 constituting the terminal 100, and accepts the selection of the data index corresponding to the acquisition target data via the input device 504 of the computer 500 (S816).

[0146] The data acquisition request unit 108 of the terminal 100 transmits the data index selected in step S816 to the user information management server 200 (S817). The data management unit 201 of the user information management server 200 obtains the data corresponding to the data index received in step S817 from the wallet 221 retrieved in step S814, and transmits the obtained data to the terminal 100 (S818).

[0147] In addition, data that can be made public if the user himself is in the same place as the lifeguard and authentication based on the user's own biometric information is successful (information that complies with Level 3 in the above example) can be sent in step S811 (ensuring that the disclosure conditions of Level 3 are met in the processing of steps S805 to S810), and displayed on the display device 505 of the computer 500 that constitutes the terminal 100 in step S812.

[0148] The signature unit 110 of the terminal 100 generates provision consent information, and gives a signature using the private key generated in step S806 to the data received in step S818 and the generated provision consent information (S819). In addition, the processing of step S819 may be omitted. In addition, when the qualification information and medical information stored in the wallet 221 are encrypted using the public key generated in step S304, the data acquisition request unit 108 decrypts the data received in step S818 using the private key generated in step S809.

[0149] The provision consent information generated in step S819 includes, for example, the hash value of the data received in step S818, the lifeguard's information, the verifier's information, the date and time, and the purpose of use of the provided data. The signature given in step S819 is information that proves to the verifier that the authority transfer to the lifeguard was performed with the user's prior consent and that the data was presented to the lifeguard. By giving the signature in step S819, the verifier can prove to a third party that the data received in step S818 is not illegally obtained data and that the data is not used for an unintended purpose.

[0150] When the processing of step S819 is completed, the signed data and the provision consent information are displayed on the display device 505 of the computer 500 constituting the terminal 100. However, in the case where the processing of step S819 is omitted, when the processing of step S818 is completed, the received data is displayed on the display device 505 of the computer 500 constituting the terminal 100. The key generation unit 104 deletes the private key generated in step S806 (S820), and deletes the private key generated in step S809 (S821).

[0151] Fig. 9A as well as Fig. 9B This is an explanatory diagram showing an example of screen transition of the authority transfer registration content confirmation screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in steps S805 to S812. Fig. 9C This is an explanatory diagram showing an example of screen transition of the information presentation approval screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in step S812.

[0152] Fig. 9A and Fig. 9B The confirmation screen for the rights transfer registration content shown is displayed on Fig. 8A and Figure 8B The terminal 100 shown (the terminal 100 of the lifeguard or the user). Preferably, the terminal 100 to which the authority is transferred is displayed Fig. 9C The information prompt consent screen shown in the figure allows the user to consent to information disclosure even if the person to whom the authority is transferred is not in the same place as the lifeguard and the user. However, when the person to whom the authority is transferred is in the same place as the lifeguard and the user, the consent screen may be displayed. Fig. 8A and Figure 8B The terminal 100 shown

[0153] In step S805, screen 901 is first displayed. Screen 901 is a screen for obtaining the biometric information of the lifeguard in order to confirm the qualification of the lifeguard. When screen 901 is displayed, a camera as an example of the biometric sensor 507 of the computer 500 constituting the terminal 100 is activated to capture the face of the lifeguard. When the "shoot" button is selected in screen 901, the camera captures (processing of step S805), and processes of steps S806 and S807 are performed. When the authentication of step S807 is successful, the process shifts to screen 902.

[0154] Screen 902 displays the qualification confirmation result (for example, the name and qualification of the lifeguard, etc., information obtained from wallet 321). When the "return" button is selected in screen 902, the screen returns to screen 901. When the "register" button is selected in screen 902, the screen moves to screen 903.

[0155] Screen 903 is a screen for acquiring biological information of a user (injured or sick person). When screen 903 is displayed, a camera as an example of a biological sensor 507 of the computer 500 constituting the terminal 100 is activated to capture a picture of the user's face.

[0156] When the "Return" button is selected in screen 903, the screen returns to screen 902. When the "Photograph" button is selected in screen 903, the camera takes a picture (processing of step S808), and processes of steps S809 and S810 are performed. When the authentication of step S810 is successful, the screen is transferred to screen 904 after processing of step S811.

[0157] Screen 904 is a screen displayed in step S812, and the authority transfer information is displayed on screen 904. In the example of screen 904, the user's name (Hitachi tree) and allergy information (a text such as "no allergy information is registered") are data that can be disclosed when the user himself is in the same place as the lifeguard and the user's biometric authentication is successful (equivalent to the above-mentioned level 3 information).

[0158] In addition, the example of screen 904 shows that there is a case where the permission to receive disclosure can be transferred to "First Aid Rescue Worker", "Doctor", and data of "Taro Hitachi" and "Jiro Hitachi" who are family members of the user (equivalent to the above-mentioned level 2 information). Fig. 8A and Figure 8B In the example, the lifeguard is operating the terminal 100, and the authority to disclose the data can be transferred to the lifeguard, so (the authentication in step S807 has been successful) the lifeguard can operate the "Agree" button to disclose the data.

[0159] When the "Agree" button is selected in the screen 904, the user's UID and the information indicating the authority to disclose to the lifeguard are sent in step S813, and the processing of steps S814 to S819 is executed (in Fig. 9A (The illustration of the screen for selecting a data index from the list of data indexes in step S816 is omitted), and the screen is transferred to screen 905.

[0160] The data received in step S818 is displayed on screen 905. When the "return" button is selected on screen 905, the screen returns to screen 904. When the "end" button is selected on screen 905, the authority transfer registration content confirmation screen ends.

[0161] Fig. 9B Screen 9041 is a screen displayed instead of screen 904 when the disclosure condition of information equivalent to level 2 indicates that the rights have not been transferred to the lifeguard, but there are rights transfer targets such as family members set by the user. Screen 9041 displays data that can be disclosed when the user is in the same place as the lifeguard and the user's biometric authentication succeeds, similarly to screen 904.

[0162] In addition, screen 9041 shows that there is data (equivalent to the above-mentioned level 2 information) that can be transferred to "Hitachi Taro" and "Hitachi Jiro" who are family members of the user (that is, these two are pre-registered rights transfer targets). In addition, screen 9041 can display a list of data indexes of data that are disclosed when the rights transfer targets agree to the information prompt.

[0163] When the "Contact" button is selected after selecting at least one check box corresponding to the authority transfer object, the terminal 100 of the authority transfer object Fig. 9C The information prompt consent screen starts.

[0164] exist Fig. 9C The screen 906 of FIG. 1 displays information indicating that the information disclosure has been entrusted to the authority transferee from the user and information about the lifeguard. When the "next step" button is selected in the screen 906 , the screen moves to a screen 907 .

[0165] Screen 907 is a screen for obtaining biometric information of the authority transferee (biometric information of the type registered via screen 606) (a screen for obtaining information required for authentication). When screen 907 is displayed, a camera as an example of a biometric sensor 507 of computer 500 constituting terminal 100 is activated and can capture the face of the authority transferee. When the "return" button is selected on screen 907, the screen returns to screen 906. When the "authentication" button is selected on screen 907, the camera captures and the authority transferee is authenticated using the captured image, and when the authentication is successful, the screen shifts to screen 9071.

[0166] Screen 9071 is the final confirmation screen for consenting to information disclosure. When the "Cancel" button is selected in screen 9071, the screen returns to screen 907. When the "Agree" button is selected in screen 9071, the user's UID and the public authority information indicating the object of authority transfer are sent in step S813, and the processing of steps S814 to S819 is executed (in Fig. 9A The illustration of the screen for selecting a data index from the list of data indexes in step S816 is omitted), and the screen 9041 of the lifeguard's terminal 100 is transferred to the screen 9051, and the screen 9071 of the authority transfer object is transferred to the screen 908.

[0167] A message indicating that the authentication and information disclosure of the authority transferee has been completed is displayed on the screen 908. When the "Finish" button is selected on the screen 908, the information presentation consent screen on the terminal 100 of the authority transferee is terminated.

[0168] exist Fig. 9B Screen 9051 displays the data received in step S818 and information on the authority transfer target as the approver. When the "return" button is selected in screen 9051, the screen returns to screen 9041. When the "end" button is selected on screen 905, the authority transfer registration content confirmation screen ends.

[0169] Furthermore, in the case where the disclosure consent from the authority transferee has not been obtained after a predetermined time has passed even after the "Contact" button on the screen 9041 has been selected (after the instruction for displaying the screen 9071 has been outputted) (i.e., the "Agree" button on the screen 9071 has not been selected), part or all of the information corresponding to level 2 may be disclosed to the lifeguard's terminal 100. For example, the type of data to be disclosed when the disclosure consent from the authority transferee has not been obtained after a predetermined time has passed even after the "Contact" button on the screen 9041 has been selected may be predetermined, or may be set by the user when registering the authority transfer information. Therefore, even in the case where the authority transferee cannot confirm the terminal 100, the lifeguard can obtain the information necessary for lifesaving.

[0170] As described above, in the information query system of the present embodiment, the user's medical information and qualification information are pre-stored in the user information management server 200. During the user's emergency transportation, the biometric information-based authentication between the terminal 100 and the user information management server 200 can be used to query this information. Therefore, even if the user does not have an official identification document during the user's emergency transportation, the user's identity can be confirmed based on the user's biometric information. Based on the queried medical information and qualification information, the emergency lifesaver can quickly make emergency treatment judgments and select the medical institution at the transportation destination.

[0171] In addition, the information inquiry system registers the prior consent for transferring the right to disclose the received data to the lifeguard, family members, etc. in the user information registration process, so that even if the user is unconscious during the emergency transportation of the user, the medical information and qualification information can be queried after the identity confirmation and the intention to transfer the authority are confirmed based on the user's biometric information. In addition, especially when the user is unconscious, the same terminal 100 is used to perform the biometric authentication of the lifeguard and the biometric authentication of the user, so that the lifeguard and the user are in the same place, thereby suppressing the illegal query of medical information and qualification information.

[0172] In addition, the information inquiry system can pre-register disclosure conditions for authority transfer (such as the user's symptoms and the authority transfer object) in the user information registration process, thereby enabling information disclosure based on the user's own intention.

[0173] In addition, during the information query process, the information query system cannot access the user information management server 200 and disclose information without the biological information prompt of the user himself and the lifeguard and / or the authority transfer object as required, thereby preventing medical information and qualification information from being mistakenly disclosed to others or unauthorized persons.

[0174] In addition, the information inquiry system signs the data sent from the user information management server 200 using the private key generated based on the biometric information during the information inquiry process, thereby being able to verify later that the information is disclosed with the consent of the user or lifeguard.

[0175] In addition, the information inquiry system of this embodiment is not limited to emergency transportation, but can also be applied to identity confirmation when property is lost due to natural disasters such as earthquakes and floods, medical information, and information inquiry of various contracted services such as banks.

[0176] In addition, the present invention is not limited to the above-mentioned embodiments, and includes various modified examples. For example, the above-mentioned embodiments are examples described in detail in order to easily explain the present invention, and are not necessarily limited to having all the structures described. In addition, a part of the structure of a certain embodiment can be replaced with the structure of other embodiments, and the structure of other embodiments can be added to the structure of a certain embodiment. In addition, with respect to a part of the structure of each embodiment, other structures can be added, deleted, or replaced.

[0177] In addition, part or all of the above-mentioned structures, functions, processing parts, processing units, etc. may also be implemented in hardware, for example, by designing with integrated circuits. In addition, the above-mentioned structures, functions, etc. may also be implemented in software by interpreting and executing programs for implementing each function through a processor. Information such as programs, tables, files, etc. that implement each function can be placed in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

[0178] In addition, the control lines and information lines are those that are considered necessary for explanation, and not all control lines and information lines are necessarily shown on the product. In fact, it can be considered that almost all the structures are connected to each other.

[0179] Description of Reference Numerals

[0180] 100 terminal, 101 UID acquisition unit, 102 PIN acquisition unit, 103 biometric information acquisition unit, 104 key generation unit, 105 public key certificate generation unit, 106 registration request unit, 107 authority transfer registration unit, 108 data acquisition request unit, 108, 109 authentication unit, 109, 110 signature unit, 200 user information management server, 201 data management unit, 202 PIN verification unit, 203 authentication unit, 221 wallet, 300 lifeguard information management server, 301 data management unit, 302 authentication unit, 321 wallet, 500 computer, 501 CPU501, 502 memory, 503 auxiliary storage device, 504 input device, 505 display device, 506 communication device, 507 biometric sensor, 508 IC card reader.

Claims

1. An information query system, comprising a terminal and a server, characterized in that: The server stores the user's disclosure target information and authority information, wherein the authority information indicates the disclosure authority corresponding to the user's awareness or non-awareness for each type of the disclosure target information. The terminal obtains the first biometric information of the user and obtains the second biometric information of the agent, The server receives a data acquisition request based on consciousness confirmation information indicating that the user has consciousness from the terminal, and when it is determined based on the data acquisition request that verification of the consciousness confirmation information is successful and when it is determined that first biometric authentication of the user based on the first biometric information between the terminal and the server is successful, sends to the terminal information that is included in the disclosure object information and that is indicated by the permission information as having permission to disclose when the user has consciousness, When the server does not determine that the verification of the consciousness confirmation information is successful, and determines that the first biometric authentication and the second biometric authentication of the agent between the terminal and the server based on the second biometric information are successful, the server sends to the terminal information contained in the disclosure object information, information indicating that the authority to accept disclosure without the user's awareness.

2. The information query system according to claim 1, characterized in that: The permission information indicates: The first type of information is information that can be disclosed only with the user's awareness; The second type of information is information that can be disclosed even without the user's awareness if disclosure conditions based on the user's symptoms and / or the target of the transfer of authority are met; as well as The third type of information is information that can be disclosed even without the user's awareness when the first biometric authentication and the second biometric authentication are successful using the same terminal.

3. The information query system according to claim 2, characterized in that: The disclosure condition indicates that the authentication of the authority transferee including the agent is successful, When the server does not determine that the verification of the consciousness confirmation information is successful and determines that the first biometric authentication and the second biometric authentication are successful, the server transmits the second type of information included in the disclosure target information to the terminal.

4. The information query system according to claim 2, characterized in that: The disclosure condition indicates that the authentication of the authority transferee who is different from the agent is successful, The terminal obtains the authentication information of the query of the authority transfer object, Authentication of the authority transfer object based on the authentication information at the time of the query is performed between the terminal and the server, When the server does not determine that the verification of the consciousness confirmation information is successful, but determines that the first biometric authentication, the second biometric authentication, and the authentication of the authority transferee are successful, the server sends the second type of information included in the disclosure object information to the terminal.

5. The information query system according to claim 4, characterized in that: The terminal has an input device and a display device. The terminal displays on the display device a first screen for obtaining, via the input device, information for identifying the authority transferee and authentication information during registration of the authority transferee, The terminal sends the information for determining the object of the authority transfer and the authentication information during registration to the server, The authentication of the authority transfer object is performed based on the inquiry authentication information and the registration authentication information.

6. The information query system according to claim 4, characterized in that: The authority information includes information for identifying the authority transfer object and authentication information during registration of the authority transfer object. The terminal has an input device and a display device. When the server does not determine that the verification of the consciousness confirmation information is successful, and determines that the first biometric authentication and the second biometric authentication are successful, the terminal displays a second screen for determining the information of the authority transfer object and a third screen for obtaining the authentication information at the time of the query via the input device on the display device, The authentication of the authority transfer object is performed based on the inquiry authentication information and the registration authentication information.

7. The information query system according to claim 6, characterized in that: Even if the authentication of the authority transferee is not completed after a predetermined time has passed since the terminal displayed the third screen, the server omits the authentication of the authority transferee and transmits the second type of information included in the disclosure target information to the terminal.

8. The information query system according to claim 2, characterized in that: The terminal has a display device and an input device. The server receives the data acquisition request from the terminal, and when it is determined based on the data acquisition request that the verification of the consciousness confirmation information is successful and that the first biometric authentication is successful, sends a list of indexes to the terminal, wherein the indexes represent types of the disclosure target information corresponding to the first type of information, the second type of information, and the third type of information, respectively. The terminal displays the list of indexes on the display device, receives selection of an index corresponding to the information to be transmitted from the list of indexes via input to the input device, and transmits the selected index to the server. The server transmits the disclosure target information corresponding to the index transmitted from the terminal to the terminal.

9. The information query system according to claim 1, characterized in that: The terminal has a display device and an input device. The terminal displays, on the display device, a screen for accepting, through input to the input device, settings of the disclosure target information corresponding to information disclosed with the user's awareness and information disclosed even without the user's awareness.

10. The information query system according to claim 1, characterized in that: The server holds a first public key certificate corresponding to a public key of a key pair consisting of a private key and a public key generated based on the biometric information of the user at the first registration time, and a second public key certificate corresponding to a public key of a key pair consisting of a private key and a public key generated based on the biometric information of the agent at the second registration time, The terminal generates a first private key according to the first biometric information, and generates a second private key according to the second biometric information, The terminal uses the first private key, and the server uses the first public key certificate to perform the first biometric authentication, The terminal uses the second private key and the server uses the second public key certificate to perform the second biometric authentication.

11. The information query system according to claim 10, characterized in that: The disclosed object information held by the server is encrypted using a public key generated based on the biometric information during the first registration. The server decrypts information included in the disclosure target information sent from the terminal using the second private key.

12. The information query system according to claim 10, characterized in that: The server adds a signature using the first private key to information included in the disclosure target information transmitted from the terminal.

13. An information query method of an information query system, the information query system comprising a terminal and a server, characterized in that: The server stores the user's disclosure target information and authority information, wherein the authority information indicates the disclosure authority corresponding to the user's awareness or non-awareness for each type of the disclosure target information. In the information query method, The terminal obtains first biometric information of the user, The terminal obtains the second biological information of the agent, The server receives a data acquisition request based on consciousness confirmation information indicating that the user has consciousness from the terminal, and when it is determined based on the data acquisition request that verification of the consciousness confirmation information is successful and when it is determined that first biometric authentication of the user based on the first biometric information between the terminal and the server is successful, sends to the terminal information that is included in the disclosure object information and that is indicated by the permission information as having permission to disclose when the user has consciousness, When the server does not determine that the verification of the consciousness confirmation information is successful, and determines that the first biometric authentication and the second biometric authentication of the agent between the terminal and the server based on the second biometric information are successful, the server sends to the terminal information contained in the disclosure object information, information indicating that the authority to accept disclosure without the user's awareness.

Images