Authentication system, authentication method, program, and authentication information output apparatus

Abstract

To provide an authentication system capable of realizing authentication with improved security.SOLUTION: An authentication system 10 is provided with an acquisition unit 44 for acquiring authentication information from an information terminal 30 which has acquired the authentication information including an ID indicating a predetermined location and encrypted information outputted by an authentication information output apparatus 20 fixed at a predetermined location, and an authentication unit 45 for verifying the encrypted information included in the acquired authentication information to authenticate that the user of the information terminal 30 is located at the predetermined location indicated by the ID.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an authentication system, an authentication method, a program, and an authentication information output device. [Background technology]

[0002] Various techniques for controlling equipment have been proposed. Patent Document 1 discloses a control system that can give authority to control equipment to a user who has been authenticated. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-220114 A Summary of the Invention [Problem to be solved by the invention]

[0004] The present invention provides an authentication system and the like that can realize authentication with improved security. [Means for solving the problem]

[0005] An authentication system according to one embodiment of the present invention includes an acquisition unit that acquires authentication information from an information terminal that acquires authentication information including an ID indicating a predetermined location and encrypted information, the authentication information being output by an authentication information output device fixed to the predetermined location, and an authentication unit that authenticates that a user of the information terminal is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information.

[0006] An authentication method according to one embodiment of the present invention is an authentication method executed by a computer, and includes an acquisition step of acquiring authentication information from an information terminal that has acquired authentication information including an ID indicating a predetermined location and encrypted information, the authentication information being output by an authentication information output device fixed to the predetermined location, and an authentication step of authenticating that a user of the information terminal is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information.

[0007] A program according to one aspect of the present invention is a program for causing a computer to execute the authentication method.

[0008] An authentication information output device according to one aspect of the present invention is an authentication information output device fixed to a predetermined place, which outputs authentication information including an ID indicating the predetermined place and encrypted information. Effect of the Invention

[0009] The authentication system etc. of the present invention can realize authentication with improved security. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing a functional configuration of an authentication system according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of a predetermined place where an authentication information output device according to an embodiment is installed. [Diagram 3] FIG. 3 is a diagram illustrating an example of the registration information. [Figure 4] FIG. 4 is a sequence diagram of an operation example of the authentication system according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of a data format of the authentication information. [Figure 6] FIG. 6 is a diagram showing a modified example of the method of outputting authentication information. [Figure 7] FIG. 7 is a diagram illustrating an example of the authority management information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, the embodiments will be described with reference to the drawings. Note that the embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component arrangement and connection forms, steps, and order of steps shown in the following embodiments are merely examples and are not intended to limit the present invention. Furthermore, among the components in the following embodiments, components that are not described in the independent claims will be described as optional components.

[0012] In addition, each drawing is a schematic diagram and is not necessarily a precise illustration. In each drawing, the same reference numerals are used for substantially the same configurations, and duplicated explanations may be omitted or simplified.

[0013] (Embodiment) [composition] First, the configuration of an authentication system according to an embodiment will be described. Fig. 1 is a block diagram showing a functional configuration of the authentication system according to an embodiment. Fig. 2 is a diagram showing an example of a predetermined place where an authentication information output device according to an embodiment is installed.

[0014] The authentication system 10 is a system that can authenticate that a user is in a predetermined location (indoor space 90a in FIG. 2) in a facility 90 such as an office building. For example, while the user is located in the indoor space 90a, the user uses the information terminal 30 to request authentication from the server device 40. If the user is authenticated, the user can obtain the authority to control the equipment 60 installed in the indoor space 90a by operating the information terminal 30.

[0015] 1, the authentication system 10 includes a plurality of authentication information output devices 20, an information terminal 30, a server device 40, a local controller 50, and a plurality of pieces of equipment 60. The plurality of authentication information output devices 20, the information terminal 30, the local controller 50, and the plurality of pieces of equipment 60 are located within a facility 90, and the server device 40 is installed outside the facility 90. It is sufficient that the authentication system 10 includes at least one of each of the authentication information output devices 20 and the pieces of equipment 60.

[0016] First, the authentication information output device 20 will be described. The authentication information output device 20 is a device that outputs authentication information. The authentication information output device 20 transmits a beacon signal including authentication information by, for example, short-distance wireless communication (radio waves). The authentication information output device 20 is fixedly installed in a facility 90. In the example of FIG. 2, the authentication information output device 20 is fixed to a lighting fixture 60a provided in an indoor space 90a, but the authentication information output device 20 is fixed to, for example, a wiring device, a wall, a ceiling, a floor, a distribution board, a robot, or a fire alarm provided in the indoor space 90a of FIG. 2. The authentication information output device 20 is fixed firmly so that it is difficult to remove, or fixed to a position that cannot be seen from the outside.

[0017] Furthermore, if the authentication information output device 20 is fixed to equipment that can supply power to the authentication information output device 20, such as a lighting fixture 60a, a wiring device, a distribution board, a robot, or a fire alarm, there is an advantage that the electrical construction (installation) of the authentication information output device 20 is made easier.

[0018] Specifically, the authentication information output device 20 includes a communication unit 21, an information processing unit 22, and a storage unit 23. The communication unit 21 transmits a beacon signal including authentication information by short-range wireless communication. Specifically, the communication unit 21 performs short-range wireless communication according to a communication standard such as BLE (Bluetooth (registered trademark) Low Energy) or Wi-Fi (registered trademark). The beacon signal may also be called an advertisement signal.

[0019] The information processing unit 22 generates authentication information and causes the communication unit 21 to transmit a beacon signal including the generated authentication information. The information processing unit 22 is realized by, for example, a microcomputer, but may also be realized by a processor or a dedicated circuit. The functions of the information processing unit 22 are realized by hardware such as a microcomputer or a processor constituting the information processing unit 22 executing a computer program (software) stored in the storage unit 36.

[0020] The storage unit 23 is a storage device that stores information such as a computer program executed by the information processing unit 22. The storage unit 23 is realized by, for example, a semiconductor memory. The storage unit 23 stores the ID of the authentication information output device 20, a signature key for generating an electronic signature, a hash function, and the like. The ID of the authentication information output device 20, the signature key for generating an electronic signature, the hash function, and the like are stored in the storage unit 23 in a state that makes them difficult to read from the outside.

[0021] The information terminal 30 is a portable information terminal carried by a user. Specifically, the information terminal 30 is a portable terminal such as a smartphone or a tablet terminal. The information terminal 30 may also be a dedicated terminal used in the authentication system 10. Specifically, the information terminal 30 includes an operation receiving unit 31, a display unit 32, a first communication unit 33, a second communication unit 34, an information processing unit 35, a storage unit 36, and a camera 37.

[0022] The operation reception unit 31 receives operations from a user. Specifically, the operation reception unit 31 is realized by a touch panel or the like.

[0023] The display unit 32 is a display on which an image is displayed, and is realized by, for example, a display panel such as a liquid crystal panel or an organic EL panel.

[0024] The first communication unit 33 is a wireless communication circuit for performing short-distance wireless communication (wireless communication through a local communication network). Specifically, the first communication unit 33 performs wireless communication according to a communication standard such as BLE or Wi-Fi (registered trademark). The first communication unit 33 receives a beacon signal emitted by the authentication information output device 20.

[0025] The second communication unit 34 is a wireless communication circuit for allowing the information terminal 30 to perform wireless communication with the server device 40 through a wide area communication network. The wide area communication network here includes a mobile communication network, the Internet, and the like.

[0026] The information processing unit 35 performs information processing for requesting authentication processing to the server device 40. The information processing unit 35 is realized by, for example, a microcomputer, but may also be realized by a processor or a dedicated circuit. The functions of the information processing unit 35 are realized by hardware such as a microcomputer or a processor constituting the information processing unit 35 executing a computer program (software) stored in the storage unit 36.

[0027] The storage unit 36 ​​is a storage device that stores information necessary for the information processing. The information stored in the storage unit 36 ​​includes computer programs executed by the information processing unit 35. The computer programs stored in the storage unit 36 ​​include predetermined application programs (hereinafter also referred to as predetermined apps) that are installed in advance in the storage unit 36 ​​by the user. The storage unit 36 ​​is realized by, for example, a semiconductor memory or the like.

[0028] The camera 37 captures an image. The camera 37 is realized by an image sensor, a lens (optical system), and the like.

[0029] The server device 40 is a server device that performs an authentication process to authenticate that a user is in a predetermined place such as the indoor space 90a. The server device 40 is realized by, for example, a cloud computer provided outside the indoor space 90a. The server device 40 includes a communication unit 41, an information processing unit 42, and a storage unit 43.

[0030] The communication unit 41 is a communication module (communication circuit) for the server device 40 to communicate with the information terminal 30 through a wide area communication network. The communication performed by the communication unit 41 may be wired communication or wireless communication. There is no particular limitation on the communication standard used for the communication.

[0031] The information processing unit 42 performs authentication processing to authenticate that the user is in the indoor space 90a in response to an authentication request received from the information terminal 30. Specifically, the information processing unit 42 is realized by a processor or a microcomputer. The information processing unit 42 includes, as functional components, an acquisition unit 44, an authentication unit 45, and a control unit 46. The functions of the acquisition unit 44, the authentication unit 45, and the control unit 46 are realized by the processor or microcomputer constituting the information processing unit 42 executing a computer program stored in the storage unit 43.

[0032] The storage unit 43 is a storage device that stores information such as computer programs executed by the information processing unit 42. Specifically, the storage unit 43 is realized by a semiconductor memory or a hard disk drive (HDD).

[0033] The storage unit 43 stores a verification key for verifying the electronic signature (a verification key paired with the signature key stored in the authentication information output device 20), a hash function, history information of a count value (described later), registration information, etc. Fig. 3 is a diagram showing an example of the registration information.

[0034] 3, the registration information is information that associates the ID of the authentication information output device 20 with the installation location (coordinates and name of the installation location) of the authentication information output device 20. When a new authentication information output device 20 is installed, the ID and installation location of the new authentication information output device 20 are added to the registration information. Note that it is sufficient for at least one of the coordinates and the name to be specified as the installation location of the authentication information output device 20 in the registration information, and it is not essential that both are specified.

[0035] The local controller 50 is an edge computer that controls a plurality of pieces of equipment 60 in the facility 90. The local controller 50 communicates with the server device 40 through a wide area communication network. When the local controller 50 receives a control command for controlling the pieces of equipment 60 from the server device 40, the local controller 50 controls the pieces of equipment 60 in accordance with the control command.

[0036] The equipment 60 is provided within the facility 90 and includes automatic doors, lighting equipment 60a, air conditioning equipment, ventilation equipment, video equipment, audio equipment, sensors, and the like.

[0037] [Example] As described above, the authentication system 10 can authenticate that the user is in the indoor space 90a. An example of the operation of the authentication system 10 will be described below. FIG. 4 is a sequence diagram of an example of the operation of the authentication system 10.

[0038] The authentication information output device 20 installed in the indoor space 90a generates authentication information (S11) and transmits a beacon signal including the generated authentication information (S12). Fig. 5 is a diagram showing an example of a data format of the authentication information.

[0039] 5, the authentication information includes the ID of the authentication information output device 20, a count value, and a digital signature. The ID of the authentication information output device 20 is pre-stored in the storage unit 23. As described above in FIG. 3, the ID of the authentication information output device 20 is associated with the installation location of the authentication information output device 20 in the registration information, and therefore, it can be said that the ID is an ID indicating the installation location of the authentication information output device 20.

[0040] The count value is a count value that the information processing unit 22 of the authentication information output device 20 counts over time (regularly). The count value is used for authentication processing of the server device 40. For example, the information processing unit 22 includes in the authentication information the count value at the time of generating the authentication information. Note that it is not essential that the count value be included in the authentication information, but including the count value improves security.

[0041] The electronic signature is information for verifying the validity of the authentication information, and is an example of encrypted information. The information processing unit 22 generates the electronic signature by, for example, converting the ID of the authentication information output device 20 into a hash value using a hash function, and encrypting the hash value using a signature key. The signature key and the hash function are stored in advance in the storage unit 23. The electronic signature is generated, for example, each time the authentication information is output, but may also be generated in advance and stored in the storage unit 23.

[0042] The processes of steps S11 and S12 are performed periodically at a predetermined time interval. In this situation, the user visits the indoor space 90a in the facility 90 and performs an authentication request operation on the information terminal 30 that is executing a predetermined application. The operation receiving unit 31 receives the authentication request operation (S13).

[0043] After the authentication request operation is accepted, the information processing unit 35 receives authentication information (FIG. 5) using the first communication unit 33 (S14), and transmits an authentication request including the received authentication information and the user ID stored in the storage unit 36 ​​to the server device 40 using the second communication unit 34 (S15). The user ID is stored in the storage unit 36 ​​when a predetermined application is installed in the information terminal 30. The user ID can also be considered as the ID of the predetermined application.

[0044] The communication unit 41 of the server device 40 receives the authentication request. The acquisition unit 44 acquires the authentication information and the user ID included in the authentication request (S16). The authentication unit 45 performs an authentication process based on the acquired authentication information to authenticate that the ID of the authentication information output device 20 included in the authentication information is a valid ID (S17).

[0045] In step S17, authentication unit 45 performs authentication processing based on verification of the electronic signature and authentication processing based on the count value, and determines that authentication has been successful if both authentication processes are successful.

[0046] First, the authentication process based on the verification of the electronic signature will be described. The authentication unit 45 converts the ID of the authentication information output device 20 included in the authentication information into a first hash value using a hash function. The authentication unit 45 also decrypts the electronic signature using a verification key, and determines whether the second hash value obtained by the decryption matches the first hash value.

[0047] If the first hash value and the second hash value match, the authentication unit 45 can determine that the ID of the authentication information output device 20 is authentication information output by a (legitimate) authentication information output device 20 having a signature key and has not been tampered with by a third party. In other words, it can authenticate that the ID of the authentication information output device 20 included in the authentication information is a legitimate ID. Note that if the first hash value and the second hash value do not match, the authentication fails.

[0048] Next, the authentication process based on the count value will be described. The authentication process based on the count value is a process for authenticating that the authentication information is the one most recently acquired by the information terminal 30 (that is, that the user of the information terminal 30 is currently in the location indicated by the ID of the authentication information output device 20).

[0049] To perform authentication processing based on the count value, the storage unit 43 of the server device 40 stores, as history information, the date and time when the previous authentication processing was performed and the first count value included in the authentication information at that time. The authentication unit 45 adds (or subtracts) a second count value determined based on the difference between the date and time when the previous authentication processing was performed and the current date and time to (from) this first count value, and calculates the upper and lower limit values ​​that the count value included in the authentication information should take (in other words, the timing requirements that the count value should satisfy) by taking a margin into account.

[0050] When the count value included in the authentication information satisfies the above-mentioned time requirement, the authentication unit 45 can authenticate that the ID of the authentication information output device 20 included in the authentication information is the most recently acquired ID. When the count value included in the authentication information does not satisfy the above-mentioned time requirement, the authentication fails. For example, when the authentication information is a copy of authentication information acquired in the past, the count value included in the authentication information does not satisfy the time requirement.

[0051] As described above, in step S17, the authentication unit 45 performs authentication processing based on verification of the electronic signature and authentication processing based on the count value, thereby authenticating that the user indicated by the user ID is currently at the location indicated by the ID of the authentication information output device 20. When the authentication is complete, the control unit 46 transmits, to the information terminal 30, using the communication unit 41, authority information for operating the information terminal 30 as a remote controller for the facility 60 installed at the location indicated by the ID of the authentication information output device 20 (S18).

[0052] The second communication unit 34 of the information terminal 30 receives the authority information. The information processing unit 35 enables a function (a control function of the equipment 60 of a predetermined application) for operating the information terminal 30 as a remote controller for the equipment 60 based on the received authority information (S19). For example, the information processing unit 35 displays a control screen for controlling the equipment 60 on the display unit 32.

[0053] As a result, the user can control the equipment 60 by operating the information terminal 30. When the equipment 60 is controlled by operating the information terminal 30, information for controlling the equipment 60 (such as a control command) is transmitted via a route including the information terminal 30, the server device 40, the local controller 50, and the equipment 60, for example.

[0054] Note that the information terminal 30 in which a predetermined application is installed also has a function of controlling other equipment 60 installed in other locations (for example, an indoor space adjacent to the indoor space 90a), but in step S19, the function for controlling the other equipment 60 is not enabled. In order to enable the function for controlling the other equipment 60, the information terminal 30 needs to receive authentication information from an authentication information output device 20 installed in another location and perform the above-mentioned steps S15 to S19. In other words, the equipment 60 that can be controlled varies depending on which authentication information output device 20 the information terminal 30 obtained authentication information from in step S14.

[0055] Thus, the authentication system 10 (server device 40) includes an acquisition unit 44 that acquires authentication information and the user ID of the user of the information terminal 30 from the information terminal 30, an authentication unit 45 that authenticates that the user indicated by the acquired user ID is located in the indoor space 90a based on the electronic signature and count value included in the acquired authentication information, and a control unit 46 that enables at least some of the functions of the information terminal 30 when it is authenticated that the user is located in the indoor space 90a.

[0056] Such an authentication system 10 makes it difficult to tamper with the ID of the authentication information output device 20 included in the authentication information by including a digital signature and a count value in the authentication information, thereby enabling authentication with improved security to be realized.

[0057] It is also possible to consider an authentication system 10 that employs an IC chip reading method in which the authentication information output device 20 is equipped with an IC chip, and the information terminal 30 acquires authentication information from an IC chip installed in the indoor space 90a. However, the IC chip reading method is highly dependent on the model of the information terminal 30 (dependence on the OS), making it difficult to enhance versatility. In contrast, in the authentication system 10, the authentication information output device 20 transmits a beacon signal including authentication information, thereby realizing a system configuration that is inexpensive and highly versatile and has low model dependency (dependence on the OS) of the information terminal 30.

[0058] [Variations of the method for outputting authentication information] In the above operation example, the authentication information output device 20 outputs the authentication information (beacon signal) by short-distance wireless communication, but the method of outputting the authentication information is not limited to this. Fig. 6 is a diagram showing a modified example of the method of outputting the authentication information.

[0059] 6, for example, the authentication information output device 20 may include a display unit 24, and output the authentication information by displaying a two-dimensional code corresponding to the authentication information on the display unit 24. In this case, the information terminal 30 obtains the authentication information by reading the two-dimensional code with the camera 37. Note that, if the authentication information includes a count value, the two-dimensional code displayed on the display unit 24 is appropriately changed (updated) in response to a change in the count value.

[0060] The method of reading two-dimensional codes is highly versatile and has low dependency on the model (OS) of the information terminal 30. In other words, the authentication system 10 realizes an inexpensive and highly versatile system configuration by displaying a two-dimensional code corresponding to authentication information.

[0061] [Modification of authority information] The authority information transmitted to the information terminal 30, i.e., the authority given to the user, may be changed according to the user (user ID) of the information terminal 30. For example, the control unit 46 determines the authority given to the user by comparing the user ID acquired in step S16 with the authority management information stored in the storage unit 43. Fig. 7 is a diagram showing an example of the authority management information.

[0062] As shown in Fig. 7, in the authority management information, user IDs are associated with authorities. In Fig. 7, as an example, the authorities are divided into three levels: strong authority (all of the facilities 60 can be controlled), normal authority (some of the facilities 60 can be controlled), and weak authority (minimum amount of the facilities 60 can be controlled).

[0063] For example, the control unit 46 can change the authority given to the user by sending authority information for granting strong authority in step S18 if the user ID acquired in step S16 is U0001, and by sending authority information for granting normal authority in step S18 if the user ID acquired in step S16 is U0002.

[0064] The authority management information is defined for each indoor space (for each installation location of the authentication information output device 20), and for example, a user may be granted strong authority in the indoor space 90a but granted normal authority in other locations. In an extreme example, a user may be able to control all the facilities 60 in the indoor space 90a but may not be able to control all the facilities 60 in other locations.

[0065] [Variations of processing after authentication is completed] In the above operation example, when the authentication is completed in step S17, the authority information is transmitted from the server device 40 to the information terminal 30. However, when the authentication is completed, the control unit 46 of the server device 40 may execute the control of the facility 60 without transmitting the authority information.

[0066] For example, when authentication is completed in step S17, the control unit 46 identifies the facility 60 installed at the location indicated by the ID of the authentication information output device 20, and transmits a control command for controlling the identified facility 60 to the local controller 50 using the communication unit 41. As a result, the facility 60 installed at the location indicated by the ID of the authentication information output device 20 is controlled.

[0067] The facility 60 is, for example, an automatic door, and the control of the facility 60 is the opening control of the automatic door. In this case, when the user performs an authentication request operation (step S13) on the information terminal 30 in the indoor space 90a, the processing from step S14 onward is performed, and the automatic door installed in the indoor space 90a is opened.

[0068] Moreover, the facility 60 is, for example, a lighting facility 60a, and the control of the facility 60 is a lighting control of the lighting facility 60a. In this case, when the user performs an authentication request operation (step S13) on the information terminal 30 in the indoor space 90a, the processes from step S14 onward are performed, and the lighting facility 60a installed in the indoor space 90a is turned on.

[0069] Moreover, the facility 60 is, for example, a personal computer, and the control of the facility 60 is a login control of the personal computer (control to make the personal computer available). In this case, when the user performs an authentication request operation (step S13) on the information terminal 30 in the indoor space 90a, the processing from step S14 onward is performed, and the personal computer becomes available (such as displaying a desktop screen).

[0070] In this manner, when the control unit 46 authenticates that the user is located in the indoor space 90a, the control unit 46 may control the equipment 60 installed in the indoor space 90a.

[0071] [Effects, etc.] Hereinafter, examples of inventions that can be obtained from the disclosure of this specification will be given, and the effects and the like that can be obtained from the inventions will be described.

[0072] Invention 1 is an authentication system 10 comprising an acquisition unit 44 that acquires authentication information from an information terminal 30 that acquires authentication information including an ID indicating a predetermined location and encrypted information output by an authentication information output device 20 fixed to a predetermined location, and an authentication unit 45 that authenticates that the user of the information terminal 30 is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information.

[0073] Such an authentication system 10 can realize authentication with improved security by performing authentication with the requirement of verifying encrypted information.

[0074] Invention 2 is the authentication system 10 of Invention 1, in which the encrypted information is stored in advance in the authentication information output device 20.

[0075] Such an authentication system 10 (authentication information output device 20) can omit the process of generating encrypted information by reading and using the encrypted information.

[0076] Invention 3 is the authentication system 10 of Invention 1, in which the encrypted information is an electronic signature generated using a signature key pre-stored in the authentication information output device 20, and the authentication unit 45 authenticates that the user is located at a specified location if the electronic signature included in the acquired authentication information is successfully verified.

[0077] Such an authentication system 10 can improve security by performing authentication with the requirement of verifying an electronic signature.

[0078] Invention 4 is the authentication system 10 of Invention 3, in which the authentication information further includes a count value that the authentication information output device 20 counts over time, and the authentication unit 45 certifies that the user is located at a specified location when the authentication unit 45 successfully verifies the electronic signature included in the acquired authentication information and the count value included in the acquired authentication information satisfies a timing requirement.

[0079] Such an authentication system 10 can improve security by performing authentication on the conditions that the digital signature is successfully verified and that the count value satisfies a time requirement.

[0080] A fifth aspect of the present invention is the authentication system 10 of any one of the first to fourth aspects of the present invention, further comprising a control unit 46 that enables at least a part of the functions of the information terminal 30 when it is authenticated that the user is located at a predetermined location.

[0081] Such an authentication system 10 can enable at least a part of the functions of the information terminal 30 when it is authenticated that the user is located at a predetermined location.

[0082] Invention 6 is an authentication system 10 of Invention 5, in which the control unit 46 enables a function to control equipment 60 installed at a specified location by operating the information terminal 30 when the user is authenticated as being located at a specified location.

[0083] Such an authentication system 10 can grant the user of the information terminal 30 control authority for the facility 60 when it is authenticated that the user is located at a predetermined location.

[0084] Invention 7 is the authentication system 10 of any of Inventions 1 to 4, further comprising a control unit 46 that controls equipment 60 installed at a specified location when it is authenticated that the user is located at the specified location.

[0085] Such an authentication system 10 allows the user of the information terminal 30 to control the equipment 60 when the user is authenticated as being located at a predetermined location.

[0086] Invention 8 is the authentication system 10 of any of Inventions 1 to 7, in which the authentication information output device 20 is fixed to a wiring device, a wall, a ceiling, a floor, a distribution board, a lighting fixture 60a, a robot, or a fire alarm installed in a predetermined location.

[0087] Such an authentication system 10 can authenticate that a user is located at a specified location by using an authentication information output device 20 fixed to a wiring device, a wall, a ceiling, a floor, a distribution board, a lighting fixture 60a, a robot, or a fire alarm.

[0088] A ninth aspect of the present invention is the authentication system 10 of any one of the first to seventh aspects, in which the authentication information output device 20 is fixed to a device capable of supplying power to the authentication information output device 20.

[0089] Such an authentication system 10 has the advantage that electrical construction (installation) of the authentication information output device 20 is easy.

[0090] Invention 10 is the authentication system 10 of any of Inventions 1 to 9, in which the information terminal 30 acquires the authentication information output by the authentication information output device 20 through short-distance wireless communication.

[0091] In such an authentication system 10, a user can be authenticated as being located at a specified location by an information terminal 30 carried by the user receiving authentication information from the authentication information output device 20 via short-range wireless communication.

[0092] Invention 11 is an authentication system 10 of any of Inventions 1 to 9, in which the authentication information output device 20 outputs the authentication information by displaying a two-dimensional code corresponding to the authentication information, and the information terminal 30 obtains the authentication information by reading the two-dimensional code.

[0093] In such an authentication system 10, a user can receive authentication that the user is located at a predetermined location by reading a two-dimensional code with an information terminal 30 carried by the user.

[0094] A twelfth aspect of the present invention is the authentication system 10 of any one of the first to eleventh aspects, comprising an authentication information output device 20 and a server device 40 including an acquisition unit 44 and an authentication unit 45.

[0095] Such an authentication system 10 can perform authentication on the condition that the server device 40 verifies the encrypted information.

[0096] Invention 13 is an authentication method executed by a computer, comprising: an acquisition step S16 of acquiring authentication information from an information terminal 30 which has acquired authentication information including an ID indicating a predetermined location and encrypted information output by an authentication information output device 20 fixed to a predetermined location; and an authentication step S17 of authenticating that the user of the information terminal 30 is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information.

[0097] Such an authentication method can achieve authentication with improved security by making verification of encrypted information a requirement for authentication.

[0098] Invention 14 is a program for causing a computer to execute the authentication method of Invention 13.

[0099] According to such a program, the computer performs authentication with the requirement of verifying encrypted information, thereby achieving authentication with improved security.

[0100] Invention 15 is an authentication information output device 20 that is fixed to a predetermined location and outputs authentication information including an ID indicating the predetermined location and encrypted information.

[0101] Such an authentication information output device 20 can output verifiable authentication information.

[0102] (Other embodiments) Although the embodiment has been described above, the present invention is not limited to the above embodiment.

[0103] For example, in the above embodiment, the facility is described as an office building, but it may also be a commercial facility, a social education facility (such as a library, museum, or art gallery), a medical facility (such as a hospital), a factory, a research facility, an accommodation facility, or a public facility.

[0104] In the above embodiment, the authentication system is realized by a plurality of devices. When the authentication system is realized by a plurality of devices in this way, the components (particularly functional components) of the authentication system may be distributed in any manner among the plurality of devices. For example, some or all of the functions provided in the information processing unit of the server device may be provided by the information processing unit of the information terminal.

[0105] The authentication system may also be realized as a single device. For example, the authentication system may be realized as a single device corresponding to a server device, or as a single device corresponding to an information terminal.

[0106] For example, the method of communication between the devices in the above-described embodiment is not particularly limited. In addition, a relay device (such as a broadband router) (not shown) may be involved in the communication between the devices.

[0107] In the above embodiment, the processes executed by a specific processing unit may be executed by another processing unit. The order of multiple processes may be changed, or multiple processes may be executed in parallel.

[0108] In the above embodiment, each component may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0109] Furthermore, each component may be realized by hardware. For example, each component may be a circuit (or an integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit, or a dedicated circuit.

[0110] Furthermore, the general or specific aspects of the present invention may be realized as a system, an apparatus, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0111] For example, the present invention may be realized as the authentication system of the above-described embodiment, or as an authentication method executed by a computer such as the authentication system. The present invention may be realized as a program for causing a computer to execute such an authentication method, or as a computer-readable non-transitory recording medium having such a program recorded thereon. Furthermore, the present invention may be realized as a predetermined application program installed in an information terminal, or as a computer-readable non-transitory recording medium having such an application program recorded thereon.

[0112] In addition, the present invention also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art may think of, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope that does not deviate from the spirit of the present invention. [Explanation of symbols]

[0113] 10 Authentication System 20 Authentication information output device 21, 41 Communications Department 22, 35, 42 Information Processing Section 23, 36, 43 storage section 24, 32 Display section 30 Information terminal 31 Operation reception section 33 First Communications Department 34 2nd Communications Department 37 Camera 40 Server device 44 Acquisition Department 45 Authentication Section 46 Control Unit 50 Local Controller 60 Equipment 60a Lighting equipment 90 Facilities 90a indoor space

Claims

1. an acquisition unit that acquires authentication information from an information terminal that acquires authentication information including an ID indicating a predetermined location and encrypted information, the authentication information being output by an authentication information output device fixed to the predetermined location; and an authentication unit that authenticates that the user of the information terminal is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information. Authentication system.

2. The encrypted information is stored in advance in the authentication information output device. The authentication system according to claim 1 .

3. the encrypted information is an electronic signature generated using a signature key stored in advance in the authentication information output device, The authentication unit authenticates that the user is located at the predetermined location when the digital signature included in the acquired authentication information is successfully verified. The authentication system according to claim 1 .

4. the authentication information further includes a count value that is counted by the authentication information output device according to the passage of time; The authentication unit authenticates that the user is located at the predetermined location when the electronic signature included in the acquired authentication information is successfully verified and the count value included in the acquired authentication information satisfies a time requirement. The authentication system according to claim 3.

5. and a control unit that enables at least a part of the functions of the information terminal when the user is authenticated as being located at the predetermined location. The authentication system according to any one of claims 1 to 4.

6. The control unit enables a function of controlling equipment installed at the predetermined location by operating the information terminal when the user is authenticated as being located at the predetermined location. The authentication system according to claim 5.

7. The device further includes a control unit that controls equipment installed at the predetermined location when the user is authenticated as being located at the predetermined location. The authentication system according to any one of claims 1 to 4.

8. The authentication information output device is fixed to a wiring device, a wall, a ceiling, a floor, a distribution board, a lighting fixture, a robot, or a fire alarm provided at the predetermined location. The authentication system according to any one of claims 1 to 4.

9. The authentication information output device is fixed to a device capable of supplying power to the authentication information output device. The authentication system according to any one of claims 1 to 4.

10. The information terminal acquires the authentication information output by the authentication information output device through short-range wireless communication. The authentication system according to any one of claims 1 to 4.

11. the authentication information output device outputs the authentication information by displaying a two-dimensional code corresponding to the authentication information; The information terminal obtains the authentication information by reading the two-dimensional code. The authentication system according to any one of claims 1 to 4.

12. The authentication information output device; a server device including the acquisition unit and the authentication unit; The authentication system according to any one of claims 1 to 4.

13. 1. A computer implemented authentication method comprising: an acquisition step of acquiring authentication information from an information terminal that has acquired authentication information including an ID indicating the predetermined location and encrypted information, the authentication information being output by an authentication information output device fixed to the predetermined location; and an authentication step of authenticating that the user of the information terminal is located at the predetermined location indicated by the ID by verifying the encrypted information included in the acquired authentication information. Authentication method.

14. A program for causing a computer to execute the authentication method according to claim 13.

15. and outputting authentication information including an ID indicating a predetermined location and encryption information, the authentication information being fixed to the predetermined location. Authentication information output device.

Images