Management system, management method and program

Abstract

To provide a technology for tracking use relation between a first object and a second object while securing security.SOLUTION: A management server according to one aspect of the present disclosure receives a first certificate and a second certificate from a terminal and receives a first time-limited certificate and a second time-limited certificate from a server in response to use relation occurring between a first object and a second object. The management server authenticates each object by collating the first certificate with the first time-limited certificate and collating the second certificate with the second time-limited certificate. When authentication of both the first target and the second target is established, the management server sets correspondence between the first identifier and the second identifier.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a management system, a management method, and a program. [Background technology]

[0002] Patent Document 1 proposes a fee collection system for collecting fees for services from vehicle users using a medium such as a card. Specifically, the fee collection system proposed in Patent Document 1 uses the ID of an ETC (Electronic Toll Collection System) card, It is configured to allocate the charge for expressway usage tolls for the target rental car to the target user based on the correspondence between the rental car company, the date and time of rental car use, and the rental car user (billing information, registration information, payment information, and usage information). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-140747 A Summary of the Invention [Problem to be solved by the invention]

[0004] One objective of the present disclosure is to provide a technique for tracking a usage relationship between a first object and a second object while ensuring security. [Means for solving the problem]

[0005] A management system according to a first aspect of the present disclosure includes a first server, a second server, and a management server. The first server is configured to issue a first time-limited certificate in relation to a first identifier of a first target, and notify the management server of the issued first time-limited certificate. The second server is configured to issue a second time-limited certificate in relation to a second identifier of a second target, and notify the management server of the issued second time-limited certificate. The management server is configured to receive a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target in response to the occurrence of a usage relationship between the first target and the second target, compare the received first certificate and the second certificate with the first time-limited certificate and the second time-limited certificate notified from the first server and the second server, and set a correspondence relationship between the first identifier and the second identifier when the comparison is established. The first time-limited certificate and the second time-limited certificate are configured to be invalidated after a validity period.

[0006] A management method according to a second aspect of the present disclosure is an information processing method in which a management server receives from a first server a first time-limited certificate issued in relation to a first identifier of a first target, the first time-limited certificate being configured to expire after a validity period, and receives from a second server a second time-limited certificate issued in relation to a second identifier of a second target, the second time-limited certificate being configured to expire after a validity period, and in response to a usage relationship being established between the first target and the second target, receives a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target, compares the received first certificate and the second certificate with the first time-limited certificate and the second time-limited certificate notified from the first server and the second server, and if a match is established, sets a correspondence relationship between the first identifier and the second identifier.

[0007] A program according to a third aspect of the present disclosure includes: transmitting a first identifier of the first target to a first terminal of the first target; a program for causing the second terminal of the second target to send the first certificate to an administration server in relation to a second identifier of the second target by providing the received first time-limited certificate as a first certificate to a second terminal of the second target when a usage relationship occurs between the first target and the second target; a program for causing the second terminal to send the first certificate to an administration server in relation to a second identifier of the second target by obtaining from the second terminal a second certificate corresponding to the second time-limited certificate issued by the second server; and a program for causing the second terminal to request setting of a correspondence relationship between the first identifier and the second identifier by transmitting the obtained second certificate to the administration server. Effect of the Invention

[0008] According to the present disclosure, it is possible to provide a technique for tracking a usage relationship between a first object and a second object while ensuring security. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example of a situation to which the present disclosure is applied. [Diagram 2] FIG. 2 shows a schematic diagram of an example of a scenario to which the present disclosure is applied. [Figure 3A] FIG. 3A illustrates an example of the linking information according to the present embodiment. [Figure 3B] FIG. 3B illustrates an example of user information according to the present embodiment. [Figure 3C] FIG. 3C illustrates an example of moving object information according to the present embodiment. [Figure 4A] FIG. 4A illustrates an example of a process of canceling a link according to this embodiment. [Figure 4B] FIG. 4B illustrates an example of a simplified link setting process according to this embodiment. [Diagram 5] FIG. 5 is a schematic diagram showing an example of a situation in which the association information according to the present embodiment is used. [Figure 6A]FIG. 6A illustrates an example of a hardware configuration of a management server according to this embodiment. [Figure 6B] FIG. 6B illustrates an example of a hardware configuration of the first server according to this embodiment. [Figure 6C] FIG. 6C illustrates an example of a hardware configuration of the second server according to this embodiment. [Figure 6D] FIG. 6D illustrates an example of a hardware configuration of the first terminal according to this embodiment. [Figure 6E] FIG. 6E illustrates an example of a hardware configuration of a second terminal according to the present embodiment. [Figure 7] FIG. 7 shows an example of a software configuration of each device according to the present embodiment. [Figure 8A] FIG. 8A shows an example of a processing procedure for linking settings according to this embodiment. [Figure 8B] FIG. 8B shows an example of a processing procedure for linking settings according to this embodiment. [Figure 8C] FIG. 8C shows an example of a processing procedure for canceling association according to this embodiment. [Figure 9] FIG. 9 shows an example of a process of linking in the 1-1 representative pattern according to this embodiment. [Figure 10] FIG. 10 shows an example of a processing procedure for linking settings in the 1-1 proxy pattern according to this embodiment. [Figure 11] FIG. 11 shows an example of a process of linking settings in the 1-2 representative pattern according to this embodiment. [Figure 12] FIG. 12 shows an example of a processing procedure for linking settings in the 1-2 proxy pattern according to this embodiment. [Figure 13] FIG. 13 shows an example of a process of linking settings in the second representative pattern according to the present embodiment. [Figure 14] FIG. 14 shows an example of a processing procedure for linking settings in the second proxy pattern according to this embodiment. [Figure 15]FIG. 15 shows an example of a process of linking settings in the third representative pattern according to the present embodiment. [Figure 16] FIG. 16 shows an example of a processing procedure for granting proxy authority in the third proxy pattern according to this embodiment. [Figure 17] FIG. 17 shows an example of a process of link setting according to a modified example. [Figure 18] FIG. 18 shows an example of a processing procedure for link setting according to the modified example. [Figure 19] FIG. 19 illustrates another example of the process of link setting according to the modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] According to the system proposed in Patent Document 1, a user can pay highway tolls by ETC even if he or she does not have an ETC card. However, the inventors of the present invention found that the conventional system has the following problems.

[0011] In other words, with the diversification of MaaS (Mobility as a Service), the benefits of efficient payment, etc. From the viewpoint of convenience, it is considered that there is a demand for tracking the use of a mobile object by a user while ensuring security. In response to this, in a conventional system, it is possible to hold the correspondence between the use date and time and the user as usage information according to the rental car contract or reservation, but since this usage date and time depends on the contract or reservation, the usage information does not necessarily match the actual use of the rental car by the user. In addition, for a vehicle used without a contract or reservation (e.g., a private car), the generation of usage information is not assumed in the first place. Therefore, according to the conventional system, it is difficult to track the use of a mobile object by a user while ensuring security. Note that this problem does not occur only in situations where a vehicle is used. The same problem may occur in situations where a mobile object other than a vehicle (e.g., an aircraft, a ship, etc.) is used and in situations where multiple types of mobile objects are used. Furthermore, the same problem may occur in any usage situation other than a mobile object.

[0012] In response to this, a management system according to a first aspect of the present disclosure includes a first server, a second server, and a management server. The first server is configured to issue a first time-limited certificate in relation to a first identifier of a first target, and notify the management server of the issued first time-limited certificate. The second server is configured to issue a second time-limited certificate in relation to a second identifier of a second target, and notify the management server of the issued second time-limited certificate. The management server is configured to receive a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target in response to the occurrence of a usage relationship between the first target and the second target, compare the received first certificate and second certificate with the first time-limited certificate and the second time-limited certificate notified from the first server and the second server, and set a correspondence relationship between the first identifier and the second identifier when the comparison is successful. The first time-limited certificate and the second time-limited certificate are configured to be invalidated after a validity period.

[0013] In a first aspect of the present disclosure, in response to the occurrence of a usage relationship between the first target and the second target, authentication of each of the first target and the second target is performed using a time-limited certificate. The time-limited certificate is configured to expire after a validity period. Therefore, it is possible to prevent the same certificate from being used permanently, which is expected to ensure security. Furthermore, when authentication of both the first target and the second target is established, a correspondence relationship (linking) between the first identifier and the second identifier is set. By recording this linking setting, the usage relationship between the first target and the second target can be traced. Therefore, according to the first aspect of the present disclosure, it is possible to track the usage relationship between the first target and the second target while ensuring security.

[0014] The present disclosure may not be limited to the above example. As another embodiment of the management system according to the above aspect, one aspect of the present disclosure may be an information processing device, an information processing method, or a program that realizes all or part of the above components. Alternatively, the information processing device may be a storage medium readable by a machine such as a computer, storing such a program. Here, the machine-readable storage medium is a medium that accumulates information such as a program by electrical, magnetic, optical, mechanical, or chemical action. The information processing device may be at least one of the management server, the first server, and the second server according to the above-mentioned aspect. Moreover, one aspect of the present disclosure may be either a first terminal or a second terminal related to the management system according to the above-mentioned aspect. At least one of the first terminal and the second terminal may be included in the management system according to the above-mentioned aspect. Furthermore, one aspect of the present disclosure may be an information processing method related to either the first terminal or the second terminal, a program, or a storage medium storing such a program.

[0015] For example, a management method according to a second aspect of the present disclosure may be an information processing method in which a management server receives from a first server a first time-limited certificate issued in relation to a first identifier of a first target, the first time-limited certificate being configured to expire when a validity period has elapsed, and receives from a second server a second time-limited certificate issued in relation to a second identifier of a second target, the second time-limited certificate being configured to expire when a validity period has elapsed, and in response to a usage relationship being established between the first target and the second target, receives a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target, compares the received first certificate and the second certificate with the first time-limited certificate and the second time-limited certificate notified from the first server and the second server, and if a match is established, sets a correspondence relationship between the first identifier and the second identifier.

[0016] Furthermore, for example, a program related to a third aspect of the present disclosure may be a program for causing a first terminal of a first target to send a request for issuance of a first time-limited certificate to a first server in relation to a first identifier of the first target, receiving the issued first time-limited certificate from the first server, and, upon the occurrence of a usage relationship between the first target and the second target, causing the second terminal to send the first certificate to an administration server by providing the received first time-limited certificate as a first certificate to a second terminal of a second target, obtaining from the second terminal a second certificate corresponding to the second time-limited certificate issued by the second server in relation to a second identifier of the second target, and requesting the setting of a correspondence relationship between the first identifier and the second identifier by sending the obtained second certificate to the administration server.

[0017] Hereinafter, an embodiment according to one aspect of the present disclosure (hereinafter also referred to as "the present embodiment") will be described with reference to the drawings. However, the present embodiment described below is merely an example of the present disclosure in all respects. Various improvements or modifications may be made without departing from the scope of the present disclosure. In implementing the present disclosure, a specific configuration according to the embodiment may be appropriately adopted. Note that while the data appearing in this embodiment is described in natural language, more specifically, it is specified in pseudo-language, commands, parameters, machine language, etc. that can be recognized by a computer.

[0018] [1 Application example] FIG. 1 illustrates a schematic diagram of an example of a situation in which the present disclosure is applied. The management system 100 according to the present embodiment includes a management server 1, a first server 2, and a second server 3. The management server 1 is one or more computers configured to record a correspondence (linking) between a first target and a second target. The first server 2 is one or more computers configured to issue a time-limited certificate for the first target. The second server 3 is one or more computers configured to issue a time-limited certificate for the second target. The first server 2 and the second server 3 may each be referred to as an authentication server, an ID (identification) server, or the like.

[0019] In this embodiment, the first terminal 4 of the first object is associated with a first identifier I10 of the first object, The first server 2 transmits a request for issuing a first time certificate C10 to the first server 2 (step SA10). In response to receiving the request, the first server 2 issues the first time certificate C10 in relation to the first identifier I10, and returns the issued first time certificate C10 to the first terminal 4 (step SA20). In response, the first terminal 4 receives the issued first time certificate C10 from the first server 2. The first terminal 4 stores the received first time certificate C10 so that it can be used as the first certificate C1. The first server 2 also notifies the management server 1 of the issued first time certificate C10 (step SA30).

[0020] The second terminal 5 of the second target transmits a request for issuing a second time certificate C20 to the second server 3 in relation to the second identifier I20 of the second target (step SB10). In response to receiving the request, the second server 3 issues the second time certificate C20 in relation to the second identifier I20 and returns the issued second time certificate C20 to the second terminal 5 (step SB20). In response, the second terminal 5 receives the issued second time certificate C20 from the second server 3. The second terminal 5 stores the received second time certificate C20 so that it can be used as the second certificate C2. The second server 3 also notifies the management server 1 of the issued second time certificate C20 (step SB30).

[0021] The first time-limit certificate C10 and the second time-limit certificate C20 are configured to have a validity period and to become invalid after the validity period has elapsed. Note that the issuance of each time-limit certificate (C10, C20) does not necessarily have to be based on a request (demand) from each terminal (4, 5). Each server (2, 3) may generate each time-limit certificate (C10, C20) voluntarily. In this case, the processes of steps SA10 and SB10 may be omitted.

[0022] In this embodiment, when a usage relationship occurs between the first target and the second target, data exchange is executed between the first terminal 4 and the second terminal 5 (step SA40, step SB40). Then, as a request for linking setting, the first certificate C1 and the second certificate C2 are submitted to the management server 1 from at least one of the first terminal 4 and the second terminal 5 in correspondence with the first time-limited certificate C10 and the second time-limited certificate C20. As a result, in response to the occurrence of a usage relationship between the first target and the second target, the management server 1 receives the first certificate C1 corresponding to the first time-limited certificate C10 and the second certificate C2 corresponding to the second time-limited certificate C20 from at least one of the first terminal 4 and the second terminal 5 (step SA50, step SB50).

[0023] The management server 1 compares the received first certificate C1 and second certificate C2 with the first time-limited certificate C10 and the second time-limited certificate C20 notified from the first server 2 and the second server 3 (step SC10). As a result, the management server 1 executes authentication processing of the first target and the second target. If this comparison is successful (i.e., authentication of both the first target and the second target is successful), the management server 1 sets a correspondence relationship (linking) between the first identifier I10 and the second identifier I20 (step SC20). In one example, the management server 1 generates linking information D10 indicating the setting of the correspondence relationship between the first identifier I10 and the second identifier I20, and stores the generated linking information D10. On the other hand, if authentication of at least one of the first target and the second target is not successful, the management server 1 may not set the correspondence relationship between the first identifier I10 and the second identifier I20, and may omit the process of setting the correspondence relationship. The management server 1 may return the result of this association process to at least one of the first terminal 4 and the second terminal 5 (step SC30). A series of processes from data exchange between the terminals (4, 5) to association setting may be executed in real time in response to the occurrence of a usage relationship. The established association (correspondence) may be appropriately released in response to the disappearance of the usage relationship between the first object and the second object. Setting the correspondence between the first identifier I10 and the second identifier I20 may be treated as setting the correspondence between the first object and the second object.

[0024] As described above, in this embodiment, when a usage relationship is created between the first object and the second object, In response, the first target and the second target are authenticated using time-limited certificates (C10, C20) (step SC10). The time-limited certificates are configured to expire after a validity period. This makes it possible to prevent the same certificate from being used permanently, which is expected to ensure security. Furthermore, when authentication of both the first target and the second target is successful, a correspondence relationship (linking) between the first identifier and the second identifier is set (step SC20). By recording this linking setting, the usage relationship between the first target and the second target can be traced. Therefore, according to this embodiment, the usage relationship between the first target and the second target can be traced while ensuring security.

[0025] (subject) The first object and the second object may not be particularly limited as long as a relationship of use can be established, and may be appropriately selected according to the embodiment. The first object and the second object may be any object, such as an object, a human, or another living thing. Any object may include a virtual object. The establishment of a relationship of use may be, for example, the occurrence of a real or virtual relationship between at least two objects, such as one using the other, one possessing the other, one combining with the other, or one connecting with the other. The management system 100 of the present disclosure may be used in any situation where a correspondence relationship between two or more objects is tracked.

[0026] (Terminal) Each terminal (4, 5) is related to each target. The relationship between each terminal (4, 5) and each target is not particularly limited and may be appropriately determined according to the embodiment. In one example, either the first terminal 4 or the second terminal 5 may be carried by the corresponding target. Either the first terminal 4 or the second terminal 5 may be loaded on the corresponding target. Loading may include being placed on the target at all times, as well as being placed on the target at least temporarily when the target is used. Loading may include being carried by a user of the target. Also, either the first terminal 4 or the second terminal 5 may be each target itself.

[0027] Note that with respect to each terminal (4, 5), multiple terminals may be used as the same target terminal, for example, when one user shares an account among multiple terminals. In this case, a different terminal may be used when issuing a time-limited certificate and when setting up the linking. Among multiple terminals used as the same target terminal, the terminal that requests the issuance of a time-limited certificate may be different from the terminal that uses the time-limited certificate as a certificate when linking. The received time-limited certificate may be shared among multiple terminals as appropriate (for example, downloaded from a server).

[0028] (Time-limited certificate) Each time-limited certificate (C10, C20) is configured to expire when the validity period has elapsed. As long as expiration due to the expiration of the validity period can be controlled, the configuration of each time-limited certificate (C10, C20) is not particularly limited and may be appropriately selected depending on the embodiment. Each time-limited certificate (C10, C20) may include any information. In one example, each time-limited certificate (C10, C20) may be configured by a random number, a timestamp, a hash value, etc. Each time-limited certificate (C10, C20) may be configured by temporary information such as a one-time password.

[0029] The validity period of each time-limited certificate (C10, C20) may be managed as appropriate. Revocation due to the passage of the validity period may be identified as appropriate. For example, whether or not a time-limited certificate in question has expired may be identified when the expiration date set in the time-limited certificate has passed, the time-limited certificate has been added to a revocation list, the time-limited certificate has been removed from a validity list, the time-limited certificate has been updated to a new time-limited certificate, information indicating the expiration (e.g., a timestamp) has been added, etc. When reference information such as a revocation list or a validity list is used to manage the validity period, the reference information may be stored in any storage device accessible from the management system 100. Typically, each time-limited certificate ( The reference information for each of the servers (2, 3) may be stored in the corresponding server (C10, C20).

[0030] The issuance (steps SA10 to SA30, steps SB10 to SB30) of each time certificate (C10, C20) may be executed at any timing before the request for linking setting (step SA50, step SB50). In one example, the issuance of each time certificate (C10, C20) may be executed in advance before data exchange between the first terminal 4 and the second terminal 5 is executed (steps SA40, step SB40) (see FIG. 1). In another example, the issuance may be executed after data exchange between the first terminal 4 and the second terminal 5 is started and before the request for linking setting is sent. From the viewpoint of reducing the number of steps in linking setting, it is preferable to issue each time certificate (C10, C20) at the former timing.

[0031] Each certificate (C1, C2) corresponds to each time-limited certificate (C10, C20). A method of comparing the certificate and the time-limited certificate may be appropriately selected according to the relationship between them. In one example, the time-limited certificate (C10, C20) may be used as the certificate (C1, C2) as it is. In this case, the success or failure of the comparison in the authentication may be determined according to whether the time-limited certificate (C10, C20) matches the certificate (C1, C2). In this embodiment, a form in which each time-limited certificate (C10, C20) is used as the certificate (C1, C2) as it is will be described. However, the form of the certificate (C1, C2) is not limited to this example. In another example, the time-limited certificate (C10, C20) may be arbitrarily converted, and the converted time-limited certificate (C10, C20) may be used as the certificate (C1, C2). In this case, the success or failure of the comparison in the authentication may be determined depending on whether a predetermined relationship is established between the time-limited certificate (C10, C20) and the certificate (C1, C2). For example, the first time-limited certificate C10 may be converted into a hash value, and the obtained hash value may be used as the first certificate C1. Accordingly, whether the relationship is established may be determined depending on whether the hash value of the first time-limited certificate C10 matches the first certificate C1. The conversion may include data manipulation such as deletion and addition. At least one of the first time-limited certificate C10 and the second time-limited certificate C20 may be used as a certificate as is, and the other may be used as a certificate after conversion. The conversion process may be executed in each terminal (4, 5) or in each server (2, 3). When the conversion process is executed in each server (2, 3), each terminal (4, 5) may receive the converted time-limited certificate (C10, C20) from each server (2, 3).

[0032] (identifier) Each identifier (I10, I20) is used to identify each object. As long as each identifier (I10, I20) can identify each object, the data format and configuration are not particularly limited and may be appropriately selected depending on the embodiment. In one example, each identifier (I10, I20) may be composed of a symbol string including numbers, letters, etc.

[0033] Each identifier (I10, I20) may use information such as identification information uniquely assigned to the object, information derived from the terminal, etc. The uniquely assigned identification information may be, for example, a vehicle registration number, a vehicle identification number (VIN: Vehicle Identification Number), a personal number, etc. When an IC tag is assigned to the object, the uniquely assigned identification information may include information held by the IC tag. Information derived from the terminal may be, for example, a MAC address (Media Access Control address), terminal identification information (IMEI: International Mobile Equipment Identifier, IMSI: International Mobile Subscriber Identity, MEID: Mobile Equipment Identifier, ICCID, etc.). : Integrated Circuit Card ID, other serial number, etc.

[0034] Each identifier (I10, I20) may be acquired appropriately. In one example, at least one of the first identifier I10 and the second identifier I20 may be held in advance in the corresponding terminal. In another example, at least one of the first identifier I10 and the second identifier I20 may be acquired by any device such as an input device, a sensor, etc. For example, the identifier may be acquired by input via an input device. Also, for example, the identifier may be converted into a code, and the identifier may be obtained by reading (decoding) the code.

[0035] (1st server / 2nd server) The first server 2 and the second server 3 may each be configured with one or more server devices. The first server 2 and the second server 3 may each be configured to be able to access target information (O10, O20) relating to each target. Each piece of target information (O10, O20) may be held in one or more storage devices arranged at least either inside or outside each server (2, 3). Each piece of target information (O10, O20) may be managed by each server (2, 3).

[0036] In one example, each issued time-limit certificate (C10, C20) may be stored in association with the corresponding target information (O10, O20). However, each time-limit certificate (C10, C20) does not necessarily have to be stored. After being transmitted to each terminal (2, 3) and the management server 1, each time-limit certificate (C10, C20) may be deleted. Either the first time-limit certificate C10 or the second time-limit certificate C20 may be stored, and the other may be deleted.

[0037] The unit for managing each piece of target information (O10, O20) is not particularly limited and may be appropriately determined depending on the embodiment. At least one of the first target information O10 and the second target information O20 may be managed in a centralized (collectively) manner, or may be managed in a decentralized manner (separately) for each arbitrary group. The server devices constituting each server (2, 3) may be deployed by one or more operating organizations (subjects). At least one of the first server 2 and the second server 3 may be deployed by multiple operating organizations. When deployed by multiple operating organizations, the target information may be shared (i.e., may be managed in a centralized manner), or may be managed in a decentralized manner for each operating organization.

[0038] (Management Server) The management server 1 may be configured with one or more server devices. The management server 1 of the present disclosure is configured to record information regarding the occurrence and disappearance of a correspondence relationship between a first object and a second object as association information D10. The association information D10 may be held in one or more storage devices arranged at least either inside or outside the management server 1.

[0039] The obtained linking information D10 may be used in various situations. In one example, the linking information D10 may be used to track the relationship between the first object and the second object. As a specific example, the linking information D10 may be used to enable the authority linked to either the first object or the second object (the first object information O10 and the second object information O20) to be exercised from the other object while the corresponding relationship between the first object and the second object is set. That is, the linking information D10 may be used to enable the authority of either the first object or the second object to be exercised from the other object according to the linking between the first object and the second object (FIG. 2 to be described later).

[0040] In this embodiment, the linking information D10 includes information on the first identifier I10 and the second identifier I20 to indicate a combination of a first target and a second target for which a correspondence relationship is set. The management server 1 may acquire each identifier (I10, I20) of each target as appropriate. In one example, the management server 1 may not hold in advance information on the first identifier I10 and the second identifier I20 for which a correspondence relationship is set, but may acquire the information each time from at least one of the servers (2, 3) and the terminals (4, 5). In another example, the management server 1 may hold in advance information on at least one of the first identifier I10 and the second identifier I20 for which a correspondence relationship is set.

[0041] The relationship between the management server 1 and each server (2, 3) may be arbitrary. In one example, the management server 1 may be the same as the management server of at least one of the first server 2 and the second server 3. In another example, the management server 1 may be the same as the management server of at least one of the first server 2 and the second server 3. The management system 100 of the present disclosure may be produced by connecting the management server 1 to each server (2, 3) and each terminal (4, 5) via a network, and arranging each of them in a state capable of executing the above-mentioned information processing according to the intention of the management server 1 management organization.

[0042] (Matching of time-limited certificates) In this embodiment, the management server 1 receives the first time-limited certificate C10 from the first server 2, and receives the first certificate C1 from at least one of the first terminal 4 and the second terminal 5, among the data used to authenticate the first target. Similarly, the management server 1 receives the second time-limited certificate C20 from the second server 3, and receives the second certificate C2 from at least one of the first terminal 4 and the second terminal 5, among the data used to authenticate the second target. When adopting a form in which each time-limited certificate (C10, C20) is transmitted in advance from each server (2, 3) to the management server 1, the management server 1 may appropriately specify the correspondence of the data to be compared. Specifying the correspondence of the data to be compared is to determine the combination of the first time-limited certificate C10 and the first certificate C1, and the combination of the second time-limited certificate C20 and the second certificate C2 to be compared.

[0043] In one example, data for receiving each time-limited certificate (C10, C20) via the server route in steps SA30 and SB30 and data for receiving each certificate (C1, C2) via the terminal route in steps SA50 and SB50 may include shared information for identifying the correspondence. The shared information may be composed of information having a relationship, such as a match or a correspondence relationship. In response to the establishment of a relationship between the shared information included in the data received from each route, the management server 1 may identify the correspondence of the data and perform authentication processing for each target by comparing each associated time-limited certificate (C10, C20) with each certificate (C1, C2).

[0044] The shared information may be arbitrarily configured. In one example, the shared information may be configured by each identifier (I10, I20). The first server 2 may send the first time-limit certificate C10 to the management server 1 with the first identifier I10. The second server 3 may send the second time-limit certificate C20 to the management server 1 with the second identifier I20. At least one of the first terminal 4 and the second terminal 5 may send the first identifier I10 and the second identifier I20 together with the first certificate C1 and the second certificate C2. The management server 1 may specify a combination of the first time-limit certificate C10 and the first certificate C1 to be matched according to a match of the first identifier I10 included in the data received from the server root and the terminal root. Similarly, the management server 1 may specify a combination of the second time-limit certificate C20 and the second certificate C2 to be matched according to a match of the second identifier I20 included in the data received from the server root and the terminal root. In another example, the shared information may be composed of any other information other than each identifier (I10, I20). For example, the shared information may be composed of temporary information such as a random number, a timestamp, a hash value, etc. The shared information may be shared at any timing. In a typical example, the shared information may be shared between each terminal (4, 5) and each server (2, 3) when each time-limited certificate (C10, C20) is issued. The management server 1 may identify the correspondence in response to the establishment of a relationship between the shared information included in the data received from each route. The shared information may be composed of each identifier (I10, I20) and any other information.

[0045] The entity that performs the association does not need to be limited to the management server 1. At least one of the first time-limit certificate C10 and the second time-limit certificate C20 may be transmitted from the corresponding server (2, 3) to the management server 1 (steps SA30, SB30) after the management server 1 receives the corresponding certificate (C1, C2) (steps SA50, SB50). In this case, the association may be performed on the corresponding server (2, 3) side. As an example, after receiving the first certificate C1 from at least one of the first terminal 4 and the second terminal 5, the management server 1 sends an inquiry including the shared information attached to the first certificate C1 as a query to the first server 2. The shared information may be the same as above. The first server 2 may hold the first time-limit certificate C10 in association with the shared information. For example, when the shared information includes the first identifier I10, the first server 2 may hold the first time-limit certificate C10 in association with the first target information O10. In response to an inquiry from the management server 1, the first server 2 may extract the corresponding first time-limit certificate C10 and return the extracted first time-limit certificate C10 to the management server 1. This extraction process is an example of association. Thereby, the management server 1 may obtain the first time-limit certificate C10 to be compared with the first certificate C1. The same applies to the second time-limit certificate C20 and the second certificate C2.

[0046] Note that this matching process does not necessarily have to be performed. In another example, the management server 1 may hold each time certificate (C10, C20) notified from each server (2, 3) as a data group. The management server 1 may extract the first time certificate C10 that matches with the received first certificate C1 from the data group, and may determine whether the matching for the first target is successful depending on whether the first time certificate C10 is extracted. The management server 1 may extract the second time certificate C20 that matches with the received second certificate C2 from the data group, and may determine whether the matching for the second target is successful depending on whether the second time certificate C20 is extracted.

[0047] (Operation example) In one example, one of the first object and the second object may be a user. One of the first terminal 4 and the second terminal 5 corresponding to the user may be a user terminal related to the user. The other of the first object and the second object may be a usage object used by the user. One of the first terminal 4 and the second terminal 5 corresponding to the usage object may be a loading terminal loaded on the usage object. According to one example of the present embodiment, it is possible to track the usage relationship between the user and the usage object while ensuring security.

[0048] The type of the object of use is not particularly limited as long as it can be used by the user, and may be appropriately selected according to the embodiment. In one example, the object of use may be a moving body (mobility). According to one example of the present embodiment, the usage relationship between the user and the moving body can be tracked. The type of the moving body may be appropriately selected. The moving body may be, for example, a vehicle, a railroad vehicle, an aircraft (aircraft, drone, etc.), a ship, etc. The moving body may be at least one of a manually controlled manned aircraft and an automatically controlled unmanned aircraft. When the moving body is a vehicle, the type of the vehicle may be arbitrarily selected. The type of the vehicle may be, for example, a two-wheeled vehicle, a three-wheeled vehicle, a four-wheeled vehicle, etc. The vehicle may include a private car, a rental car, a shared car, a taxi, a bus, etc. The vehicle may be at least one of an automatic driving vehicle and a manually driving vehicle. The loaded terminal may be called a mobile terminal.

[0049] FIG. 2 is a schematic diagram showing an example of a situation in which the management system 100 of the present disclosure is applied. In the example of FIG. 2, the first object is a user, and the second object is a moving object. In the following description of the example of FIG. 2, for convenience, the "first" is treated as relating to the user, and the "second" is treated as relating to the moving object. However, the correspondence between the "first" and the "second" is not limited to the example of FIG. 2. The "first" and the "second" may be interchangeable. That is, the second object may be a user, and the first object may be a moving object.

[0050] When the first object is a user, an example of the first terminal 4 is a user terminal. The user terminal may be any computer, such as a mobile terminal (such as a smartphone), a dedicated device (such as an electronic key device), or other computer device. Typically, the user terminal may be possessed by a user who is the object to be linked (the first object). The user's account may be shared among multiple computers, and accordingly, each computer sharing the account may be used as a user terminal (the first terminal 4) of the same user.

[0051] An example of the first identifier I10 is a user identifier (user ID, My ID). The user identifier may be, for example, a user account ID, a personal number, or identification information of a user terminal (for example, a MAC address or terminal identification information).

[0052] An example of the first target information O10 is user information O10A. The user information O10A may include any information related to a user (FIG. 3B described later). In one example, the user information O10A may include information related to the authority of the corresponding user, and may be associated with various information E10 for exercising the authority. The various information E10 may include, for example, information on public personal authentication, payment information, other service-related information, etc. The information on public personal authentication may include, for example, a personal number, etc. The payment information may include, for example, credit card information, Internet banking information, electronic payment information, etc. The other service-related information may include, for example, information on electronic prescriptions (insurer number, prescription information, etc.). The various information E10 may be managed by an external system or may be managed within the management system 100. The first server 2 may be deployed by a public institution, a neutral institution, each business (vehicle manufacturer, service management company, etc.), etc. The first server 2 may be called a user ID server, a my ID server, etc.

[0053] On the other hand, when the second object is a moving object, an example of the second terminal 5 is a moving object terminal (on-board terminal). The moving object terminal may be, for example, a terminal attached inside or outside the moving object, a terminal carried by a person involved in the operation of the moving object (for example, a driver, a conductor, etc.), a device installed in a facility of the moving object (for example, a ticket gate, etc.), etc. When the moving object is a vehicle, the moving object terminal may be called an on-board terminal.

[0054] An example of the second identifier I20 is a mobile identifier (mobile ID, car ID). The mobile identifier may be, for example, an ID of a mobile account, identification information uniquely assigned to a target mobile object (for example, a vehicle registration number, vehicle identification information, etc.), identification information of a mobile terminal, etc.

[0055] An example of the second target information O20 is mobile object information O20A. The mobile object information O20A may include any information related to the mobile object (FIG. 3C described later). In the example of FIG. 2, depending on the setting of the link between the user and the mobile object, at least a part of the authority of the various information E10 associated with the user information O10A may be enabled (activated) to be exercised by the mobile object. The second server 3 may be deployed by a public institution, a neutral institution, each business operator (vehicle manufacturer, service operator, etc.), etc. The second server 3 may be called a mobile object ID server, a car ID server, etc.

[0056] A mobile object is an example of a use. The embodiment of FIG. 2 may be applied to any case in which the user (occupant) of the use changes dynamically. The use may be, for example, a rental object, an accommodation facility, etc., in addition to a mobile object. The rental object may include a rental office, a rental space, etc.

[0057] The management system 100 may be configured to set a link between the first identifier I10 and the second identifier I20 in response to the start of use of the object, and to release the link in response to the end of use. The start and end of use may be detected by any method, for example, at the timing of getting on and off the vehicle, lending and returning the object, etc. In one example, at least one of the start and end of use may be detected in response to the execution of data exchange between the first terminal 4 and the second terminal 5.

[0058] In addition, items that can be used can be divided into at least two types: items that can be used repeatedly over the long term, and items that can be used temporarily. For the sake of convenience, the former will be called "items that can be used regularly" and the latter will be called "items that can be used regularly." An object in constant use is referred to as a "temporarily used object." An example of a constantly used object is an object owned by a user, such as a personal car. Examples of temporarily used objects are objects owned by persons other than the user, such as rental cars, shared cars, public transportation vehicles, rental objects, and accommodation facilities. Examples of public transportation vehicles include taxis, buses, railroad cars, airplanes, and ships.

[0059] In the management system 100, the type of the usage object (whether it is a regular usage object or a temporary usage object) may or may not be distinguished. When distinguishing the type of usage object, the management system 100 may determine the type of usage object by any method. In one example, the target information (mobile body information, etc.) may include information indicating the type of usage object, and the management system 100 may determine the type of usage object from this information. In another example, the type of usage object may be determined from the identifier. In another example, information transmitted from at least one of the first terminal 4 and the second terminal 5 to the management server 1 may include information indicating the type of usage object, and the management system 100 may determine the type of usage object from this information. In another example, when the operating organization of the server (the second server 3 in the example of FIG. 2) that handles the information of the usage object is determined according to the type of usage object, the type of usage object may be determined according to the affiliation of the operating organization of the server.

[0060] Furthermore, the management system 100 may switch, for example, the form of the linking setting process, the linking release condition, the management method of the linking information D10, the authentication process, etc., depending on the type of the identified use object. In one example, the management system 100 may be configured to execute the linking setting for some types of use objects by the authentication process of the present disclosure, and execute the linking setting for the remaining types of use objects by an authentication process different from that of the present disclosure.

[0061] In addition, the application of the management system 100 of the present disclosure may not be limited to a situation where a relationship between a user and a usage object is tracked. In another example, both the first object and the second object may be robotic devices configured to operate autonomously by automatic control. The robotic device may include a moving body such as an autonomous vehicle or a drone. In a situation where two or more robotic devices autonomously interact with each other, the management system 100 of the present disclosure may be used to track the emergence and extinction of a relationship between the robotic devices.

[0062] As a specific example, one of the first target and the second target may be a large autonomous vehicle, and the other may be a small autonomous vehicle. The large autonomous vehicle may be configured to accommodate a plurality of small autonomous vehicles. The large autonomous vehicle may collect, transport, and release each small autonomous vehicle as appropriate. Each small autonomous vehicle may be operated as appropriate at the release destination. In this case, the management system 100 of the present disclosure may be configured to track whether or not a large autonomous vehicle is being transported (collected) by setting and canceling a correspondence relationship between the large autonomous vehicle and the small autonomous vehicle.

[0063] (Transmission format of each information) In one example, at least one of the first terminal 4 and the second terminal 5 may transmit each identifier (I10, I20) together with each certificate (C1, C2) in order to specify the first target and the second target for which a linking setting is requested. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may include receiving the first identifier I10 and the second identifier I20 from at least one of the first terminal 4 and the second terminal 5. In this case, the allocation of data transmission of the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2 is not particularly limited and may be appropriately determined according to the embodiment.

[0064] (A) Divided transmission (A-1) Division pattern In one example, the first identifier I10, the first certificate C1, the second identifier I20 and part of the second certificate C2 may be sent by the first terminal 4 and the rest may be sent by the second terminal 5. By having each terminal (4, 5) take charge of transmitting the data in a divided manner, it is possible to expect an improvement in the efficiency of data transmission. The transmission items of each terminal (4, 5) may be appropriately selected depending on the embodiment. In this embodiment, at least one of the following four patterns may be adopted as a typical example.

[0065] (A-1-1) First pattern In the first pattern, the first terminal 4 may transmit the second identifier I20 and the second certificate C2, and the second terminal 5 may transmit the first identifier I10 and the first certificate C1. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may be configured by receiving the second identifier I20 and the second certificate C2 from the first terminal 4, and receiving the first identifier I10 and the first certificate C1 from the second terminal 5.

[0066] 1 and 2, it is assumed that the second terminal 5 acquires the first identifier I10 and the first certificate C1 as the process of step SA40, and transmits the first identifier I10 and the first certificate C1 as the process of step SA50. It is also assumed that the first terminal 4 acquires the second identifier I20 and the second certificate C2 as the process of step SB40, and transmits the second identifier I20 and the second certificate C2 as the process of step SB50.

[0067] When a usage relationship occurs between the first target and the second target, the first terminal 4 may provide the second terminal 5 with the first time-limited certificate C10 issued by the first server 2 in relation to the first identifier I10 as the first certificate C1 during data exchange with the second terminal 5 (step SA40). The first terminal 4 may provide the first identifier I10 to the second terminal 5 (step SA40). As a result, the first terminal 4 may cause the second terminal 5 to transmit the first identifier I10 and the first certificate C1 to the management server 1 (step SA50). In addition, the first terminal 4 may obtain from the second terminal 5 the second certificate C2 corresponding to the second time-limited certificate C20 issued by the second server 3 in relation to the second identifier I20 during data exchange (step SB40). The first terminal 4 may obtain the second identifier I20 from the second target (step SB40). The first terminal 4 may transmit the acquired second identifier I20 and second certificate C2 to the management server 1 (step SB50). As a result, the first terminal 4 may request the management server 1 to set a correspondence relationship (linking) between the first identifier I10 and the second identifier I20. That is, the first terminal 4 may cause the management server 1 to attempt authentication of the first target by matching the first certificate C1 and authentication of the second target by matching the second certificate C2 (step SC10), and when authentication of both the first target and the second target (each match) is successful, set a correspondence relationship between the first identifier I10 and the second identifier I20 (step SC20).

[0068] The second terminal 5 may provide the first terminal 4 with the second time-limited certificate C20 issued by the second server 3 in relation to the second identifier I20 as the second certificate C2 during data exchange with the first terminal 4 when a usage relationship occurs between the first target and the second target. The second terminal 5 may provide the second identifier I20 to the first terminal 4. As a result, the second terminal 5 may cause the first terminal 4 to transmit the second identifier I20 and the second certificate C2 to the management server 1. Furthermore, the second terminal 5 may obtain from the first terminal 4 the first certificate C1 corresponding to the first time-limited certificate C10 issued by the first server 2 in relation to the first identifier I10 during data exchange. The second terminal 5 may obtain the first identifier I10 from the first target. The second terminal 5 may transmit the obtained first identifier I10 and first certificate C1 to the management server 1. Thereby, the second terminal 5 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20. In other words, the second terminal 5 may cause the management server 1 to attempt to authenticate the first target by matching the first certificate C1 and to authenticate the second target by matching the second certificate C2, and set a correspondence relationship between the first identifier I10 and the second identifier I20 when authentication of both the first target and the second target is successful.

[0069] In one example of this embodiment, the second terminal 5 is in charge of transmitting data related to the first object, and the first terminal 4 is in charge of transmitting data related to the second object. This allows each terminal (4, 5) to obtain information on the other party in the usage relationship, thereby increasing the likelihood that a usage relationship has occurred between the first object and the second object, and as a result, it is expected that the reliability of the association information D10 will be improved.

[0070] (A-1-2) Second pattern In the second pattern, the first terminal 4 may transmit the first identifier I10 and the second certificate C2, and the second terminal 5 may transmit the second identifier I20 and the first certificate C1. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may be configured by receiving the first identifier I10 and the second certificate C2 from the first terminal 4, and receiving the second identifier I20 and the first certificate C1 from the second terminal 5.

[0071] When a usage relationship occurs between the first target and the second target, the first terminal 4 may provide the second terminal 5 with the first time-limited certificate C10 as the first certificate C1 during data exchange with the second terminal 5. As a result, the first terminal 4 may cause the second terminal 5 to transmit the first certificate C1 (and the second identifier I20) to the management server 1. Furthermore, the first terminal 4 may obtain the second certificate C2 corresponding to the second time-limited certificate C20 from the second terminal 5 during data exchange. The first terminal 4 may transmit the obtained second certificate C2 (and the first identifier I10) to the management server 1. As a result, the first terminal 4 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0072] When a usage relationship occurs between the first target and the second target, the second terminal 5 may provide the first terminal 4 with the second time-limited certificate C20 as the second certificate C2 during data exchange with the first terminal 4. As a result, the second terminal 5 may cause the first terminal 4 to transmit the second certificate C2 (and the first identifier I10) to the management server 1. Furthermore, the second terminal 5 may obtain the first certificate C1 corresponding to the first time-limited certificate C10 from the first terminal 4 during data exchange. The second terminal 5 may transmit the obtained first certificate C1 (and the second identifier I20) to the management server 1. As a result, the second terminal 5 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0073] In one example of this embodiment, similarly to the above-mentioned first pattern, the second terminal 5 is in charge of transmitting part of the data related to the first target, and the first terminal 4 is in charge of transmitting part of the data related to the second target, thereby increasing the likelihood that a usage relationship has occurred between the first target and the second target. As a result, it is expected that the reliability of the association information D10 will be improved.

[0074] Additionally, in one example of this embodiment, the second identifier I20 may not be transmitted from the first terminal 4 to the management server 1, and the first identifier I10 may not be transmitted from the second terminal 5 to the management server 1. This makes it possible to avoid transmitting data in a format indicating the correspondence between data used to authenticate each target ("first identifier I10 and first certificate C1", "second identifier I20 and second certificate C2"). As a result, the correspondence between data used to authenticate each target cannot be identified from only one of the data transmissions from the first terminal 4 and the second terminal 5, and therefore further improvement in security can be expected.

[0075] (A-1-3) Third pattern In the third pattern, the first terminal 4 may transmit the second identifier I20 and the first certificate C1, and the second terminal 5 may transmit the first identifier I10 and the second certificate C2. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may be configured by receiving the second identifier I20 and the first certificate C1 from the first terminal 4, and receiving the first identifier I10 and the second certificate C2 from the second terminal 5.

[0076] When a usage relationship occurs between the first target and the second target, the first terminal 4 may provide the second terminal 5 with the first identifier I10 during data exchange with the second terminal 5. As a result, the first terminal 4 may cause the second terminal 5 to transmit the first identifier I10 (and the second certificate C2) to the management server 1. Furthermore, the first terminal 4 may obtain the second identifier I20 from the second target during data exchange. Then, the first terminal 4 may transmit the obtained second identifier I20 (and the first certificate C1) to the management server 1. As a result, the first terminal 4 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0077] The second terminal 5 may provide the first terminal 4 with the second identifier I20 during data exchange with the first terminal 4 when a usage relationship occurs between the first target and the second target. As a result, the second terminal 5 may cause the first terminal 4 to transmit the second identifier I20 (and the first certificate C1) to the management server 1. Furthermore, the second terminal 5 may obtain the first identifier I10 from the first target during data exchange. Then, the second terminal 5 may transmit the obtained first identifier I10 (and the second certificate C2) to the management server 1. As a result, the second terminal 5 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0078] In one example of this embodiment, similarly to the above-mentioned first pattern, the second terminal 5 is in charge of transmitting part of the data related to the first target, and the first terminal 4 is in charge of transmitting part of the data related to the second target, thereby increasing the likelihood that a usage relationship has occurred between the first target and the second target. As a result, it is expected that the reliability of the association information D10 will be improved.

[0079] Additionally, in one example of this embodiment, the first identifier I10 may not be transmitted from the first terminal 4 to the management server 1, and the second identifier I20 may not be transmitted from the second terminal 5 to the management server 1. This makes it possible to avoid data transmission in a format that indicates the correspondence between data used to authenticate each target, as in the second pattern above. As a result, the correspondence between data used to authenticate each target cannot be identified from only one of the data transmissions from the first terminal 4 and the second terminal 5, and therefore further improvement in security can be expected.

[0080] (A-1-4) Fourth pattern In the fourth pattern, the first terminal 4 may transmit the first identifier I10 and the first certificate C1, and the second terminal 5 may transmit the second identifier I20 and the second certificate C2. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may be configured by receiving the first identifier I10 and the first certificate C1 from the first terminal 4, and receiving the second identifier I20 and the second certificate C2 from the second terminal 5.

[0081] When a usage relationship occurs between the first target and the second target, the first terminal 4 may cause the second terminal 5 to transmit the second identifier I20 and the second certificate C2 to the management server 1 in response to data exchange with the second terminal 5. Furthermore, the first terminal 4 may transmit the first identifier I10 and the first certificate C1 to the management server 1. Thereby, the first terminal 4 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0082] When a usage relationship occurs between the first target and the second target, the second terminal 5 may cause the first terminal 4 to transmit the first identifier I10 and the first certificate C1 to the management server 1 in response to data exchange with the first terminal 4. Furthermore, the second terminal 5 may transmit the second identifier I20 and the second certificate C2 to the management server 1. In this way, the second terminal 5 may request the management server 1 to set a correspondence relationship between the first identifier I10 and the second identifier I20.

[0083] According to one example of this embodiment, the first terminal 4 is responsible for transmitting data related to the first object, and the second terminal 5 is responsible for transmitting data related to the second object, which is expected to improve the efficiency of data transmission. It is possible.

[0084] (A-1-5)Other The items transmitted by each terminal (4, 5) need not be limited to the above four patterns. In another example, one of the first terminal 4 and the second terminal 5 may transmit the first certificate C1 and the second certificate C2, and the other may transmit the first identifier I10 and the second identifier I20. The transmission unit of each terminal (4, 5) may not necessarily match the unit of the identifier (I10, I20) and the certificate (C1, C2). For example, the first terminal 4 and the second terminal 5 may transmit data for at least any of the items in a divided manner, such as one of the first terminal 4 and the second terminal 5 transmitting a part of the first certificate C1 and the other transmitting the remainder of the first certificate C1.

[0085] (A-2) Matching method When the divided transmission mode is adopted, a part of the data used for authenticating the first target and the second target is transmitted from the first terminal 4, and the remaining data is transmitted from the second terminal 5. In order to identify the combination of the first target and the second target for which the setting of the correspondence is currently requested, the management server 1 identifies the correspondence of this data (i.e., determines the combination of corresponding data). Then, when the authentication (matching) of the first target and the second target is established by the associated data, the correspondence is set between the first target and the second target of the associated data.

[0086] The data correspondence may be specified by any method, similar to the above-mentioned certificate correspondence. In one example, the data transmitted from each terminal (4, 5) may include shared information for specifying the data correspondence. The shared information may be composed of information having a relationship, such as, for example, matching or corresponding. The management server 1 may specify the data correspondence in response to the establishment of a relationship between the shared information included in the data received from one of the first terminal 4 and the second terminal 5 and the shared information included in the data received from the other terminal.

[0087] The shared information may be configured arbitrarily. In one example, the shared information may be configured by a combination of a first identifier I10 and a second identifier I20. In this case, the management server 1 may identify the data association in response to a match between a combination of identifiers (I10, I20) included in the data received from the first terminal 4 and a combination of identifiers (I10, I20) included in the data received from the second terminal 5. In another example, the shared information may be configured by temporary information such as a random number, a timestamp, a hash value, etc. In this case, the management server 1 may identify the data association in response to a relationship being established between the temporary information included in the data received from the first terminal 4 and the temporary information included in the data received from the second terminal 5. In the second and third patterns, by adopting the latter, further improvement in security can be expected.

[0088] The shared information may be shared between the first terminal 4 and the second terminal 5 at any timing. In a typical example, the first terminal 4 and the second terminal 5 may share the shared information during data exchange (step SA40, step SB40). After receiving data from one of the first terminal 4 and the second terminal 5, if data does not arrive from the other within a predetermined period, the management server 1 may notify at least one of the first terminal 4 and the second terminal 5 of an inquiry to request transmission of the remaining data by any method. Typically, the management server 1 may notify the inquiry to one of the terminals that has received the data. If the other terminal from which data has not been received is identified, the management server 1 may notify the other terminal of the inquiry.

[0089] (B) Bulk sending In one example, one of the first terminal 4 and the second terminal 5 may transmit the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2. That is, receiving the first certificate C1 and the second certificate C2 from at least one of the first terminal 4 and the second terminal 5 may be a first It may be configured by receiving the first certificate C1 and the second certificate C2 from one of the terminal 4 and the second terminal 5.

[0090] In the case of a batch transmission from the second terminal 5, the first terminal 4 may provide the first certificate C1 to the second terminal 5 during data exchange with the second terminal 5 when a usage relationship occurs between the first target and the second target. As a result, the first terminal 4 may cause the second terminal 5 to transmit the first certificate C1 and the second certificate C2 to the management server 1. In one example, the first terminal 4 may further provide the first identifier I10 to the second terminal 5 during data exchange. As a result, the first terminal 4 may cause the second terminal 5 to further transmit the first identifier I10 and the second identifier I20 to the management server 1. Then, by this data transmission, the first terminal 4 may request the management server 1 via the second terminal 5 to set the correspondence relationship between the first identifier I10 and the second identifier I20.

[0091] In the case of a batch transmission from the first terminal 4, the second terminal 5 may provide the first terminal 4 with the second certificate C2 during data exchange with the first terminal 4 when a usage relationship occurs between the first target and the second target. As a result, the second terminal 5 may cause the first terminal 4 to transmit the first certificate C1 and the second certificate C2 to the management server 1. In one example, the second terminal 5 may further provide the first terminal 4 with the second identifier I20 during data exchange. As a result, the second terminal 5 may cause the first terminal 4 to further transmit the first identifier I10 and the second identifier I20 to the management server 1. Then, by this data transmission, the second terminal 5 may request the management server 1 via the first terminal 4 to set the correspondence relationship between the first identifier I10 and the second identifier I20.

[0092] In one example of this embodiment, the second terminal 5 is in charge of transmitting data related to the first object, or the first terminal 4 is in charge of transmitting data related to the second object. This increases the likelihood that a usage relationship exists between the first object and the second object. As a result, it is expected that the reliability of the association information D10 will be improved.

[0093] (Data Exchange) In this embodiment, a series of processes related to the association setting may be started with a trigger of data exchange (step SA40, step SB40) between the first terminal 4 and the second terminal 5. The method of data exchange is not particularly limited, and may be appropriately selected depending on the embodiment.

[0094] In one example, data exchange between the first terminal 4 and the second terminal 5 may be performed by wireless or wired data communication. Wireless communication may be performed by, for example, Near Field Communication (NFC), Bluetooth (registered trademark), Wi-fi (registered trademark), etc. Wired communication may be performed by, for example, a wired Local Area Network (LAN), Universal Serial Bus (USB), etc. Data communication may be performed directly between the first terminal 4 and the second terminal 5, or indirectly via another computer. In another example, data exchange may be performed by a method other than data communication, such as reading a two-dimensional code. For example, data exchange may be performed by one of the first terminal 4 and the second terminal 5 displaying data on a display and the other reading the displayed data using a sensor such as an image sensor.

[0095] In data transmission to the management server 1, when one of the first terminal 4 and the second terminal 5 is in charge of transmitting data of the other terminal (for example, the above-mentioned first to third patterns of divided transmission, batch transmission, etc.), the one terminal may acquire the data of the other terminal that is in charge of transmission in this data exchange. That is, at least one of the first terminal 4 providing the first target data to the second terminal 5 and the second terminal 5 providing the second target data to the first terminal 4 may be executed in the data exchange. Alternatively, in the data exchange, the first terminal 4 may acquire the second target data by an autonomous operation, and the second terminal 5 may acquire the first target data by an autonomous operation.

[0096] As a specific example, when the first pattern of the divided transmission is adopted, the first terminal 4 may acquire the second identifier I20 and the second certificate C2 from the second target in the data exchange. In one example, when the second terminal 5 holds at least one of the second identifier I20 and the second certificate C2, the first terminal 4 may acquire at least one of the second identifier I20 and the second certificate C2 from the second terminal 5 by data communication. In another example, the first terminal 4 may acquire at least one of the second identifier I20 and the second certificate C2 from the second terminal 5 by a method other than data communication, such as reading data displayed in a two-dimensional code on the second terminal 5. In yet another example, the first terminal 4 may acquire at least one of the second identifier I20 and the second certificate C2 from either the second target or the second terminal 5 by using a device such as an input device or a sensor in the data exchange. Acquiring from the second target may include acquiring by the first target operating a device on its behalf when the first target is a human and the second target is an object. The same applies to the acquisition of the first identifier I10 and the first certificate C1 by the second terminal 5.

[0097] For example, in the example of FIG. 2, the first terminal 4 may obtain the second identifier I20 (mobile identifier) ​​and the second certificate C2 from the second terminal 5 by data communication or reading a code. Similarly, the second terminal 5 may obtain the first identifier I10 (user identifier) ​​and the first certificate C1 from the first terminal 4 by data communication or reading a code. However, the method of obtaining data is not limited to these and may be appropriately selected according to the embodiment. In another example, at least one of the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2 may be given by a user's operation via an input device. When the second identifier I20 is a vehicle registration number, the first terminal 4 may obtain the second identifier I20 by photographing the license plate with an image sensor and analyzing the obtained image.

[0098] When an input device is used to acquire data, one terminal acquiring data from another target may include one target acquiring data of the other target by operating an input device in addition to the other target acquiring data of the other target by operating an input device. For example, in the example of Fig. 2 above, when the second identifier I20 is a vehicle registration number and an input device is used to acquire the vehicle registration number, the first terminal 4 may acquire the second identifier I20 from the mobile object (second target) by inputting the vehicle registration number via the input device by the user (first target).

[0099] Note that acquisition of data of the other target by one terminal does not necessarily have to be performed during data exchange. One terminal may acquire data of the other target at any timing other than data exchange. Any of the above methods may be adopted as the data acquisition method. When acquisition of data of the other target by one terminal is not performed within the data exchange (including the fourth pattern of divided transmission described above), the data exchange between the first terminal 4 and the second terminal 5 may function simply as a trigger for starting a series of processes related to the linking setting.

[0100] In addition, in data transmission to the management server 1, when the first terminal 4 is in charge of transmitting at least a part of the data of the first target, the first terminal 4 may acquire the data of the first target at any timing before executing the data transmission. Similarly, when the second terminal 5 is in charge of transmitting at least a part of the data of the second target, the second terminal 5 may acquire the data of the second target at any timing before executing the data transmission. The method of acquiring data is not particularly limited and may be appropriately selected according to the embodiment. In one example, when at least one of the first identifier I10 and the first certificate C1 (first time-limited certificate C10) of the first target is stored in advance in the memory resource of the first terminal 4, the first terminal 4 may acquire at least one of the first identifier I10 and the first certificate C1 of the first target from the memory resource. In another example, the first terminal 4 may acquire at least one of the first identifier I10 and the first certificate C1 of the first target using an input device, a sensor, or the like. The same applies to the second terminal 5 acquiring the data of the second target.

[0101] (Linking information) FIG. 3A is a schematic diagram showing an example of the association information D10 according to the present embodiment. In the example of FIG. 3A, the association information D10 includes a first identifier I10, a second identifier I20, a setting time, and a release time. The first identifier I10 and the second identifier I20 indicate a first target and a second target for which a correspondence (association) is set. The setting time indicates the time when the correspondence is set. The setting time may be configured by a time stamp. The release time indicates the time when the correspondence is released. The value of the release time may be added when a process for releasing the correspondence is executed. The method of expressing the release is not limited to this example. In another example, the release time may be replaced by at least one of an expiration date and a flag. The expiration date indicates a period during which the setting of the correspondence is valid. In this case, whether the setting of the correspondence is valid (i.e., whether the correspondence is set or released) is indicated depending on whether the expiration date is reached or not. The flag indicates whether the correspondence is released or not. The flag may be set when a process for releasing the correspondence is executed. In yet another example, the linking information D10 may include at least one of an expiration date and a flag, along with a release time field. Note that as long as it is possible to indicate the setting of the correspondence relationship, the configuration of the linking information D10 is not limited to the example of FIG. 3A, and may be changed as appropriate depending on the embodiment. In another example, the linking information D10 may further include information indicating the type of the object of use (whether it is a regular object of use or a temporary object of use). Note that the type of the object of use does not necessarily need to be identified by separate information. For example, the type of the object of use may be identified by information such as an identifier.

[0102] The data format of the linking information D10 is not particularly limited and may be appropriately selected depending on the embodiment. The linking information D10 may be held in any database platform. In one example, the linking information D10 may be held in a relational database such as a table format. In another example, the linking information D10 may be held in a blockchain platform. In this case, each transaction of linking setting and release may be accumulated in the blockchain as the linking information D10. For example, the transaction of linking setting may include a first identifier I10, a second identifier I20, and a setting time. The transaction of releasing the linking may include a first identifier I10, a second identifier I20, and a release time (or information indicating release).

[0103] (First target information) The first target information O10 may include any information related to the first target. The first target information O10 may include, for example, a first identifier I10, attribute information of the first target, information related to authority, and the like. The first target information O10 may be associated with a first time-limited certificate C10. Associating the first time-limited certificate C10 with the first target information O10 may include storing the first time-limited certificate C10 as one item of the first target information O10. When storing the first time-limited certificate C10 in association with the first target information O10, the first time-limited certificate C10 that has expired due to the expiration of its validity period may be deleted as appropriate. In the example of FIG. 2, user information O10A is an example of the first target information O10.

[0104] FIG. 3B is a schematic diagram showing an example of user information O10A according to the present embodiment. In the example of FIG. 3B, the user information O10A includes a user ID (first identifier I10), attribute information, and authority information. The attribute information may include any information related to the attributes of the corresponding user. The attribute information may include personal information such as name, address, age, sex, and contact information. The authority information is related to the authority of the corresponding user. The authority information may include information for linking with a server that executes information processing related to the target authority, information indicating association with various information E10, and the like. The user information O10A may be associated with a first time-limited certificate C10 of the user. Note that the configuration of the user information O10A is not limited to the example of FIG. 3B, and may be appropriately changed according to the embodiment.

[0105] The data format of the first target information O10 (user information O10A) is not particularly limited and may be appropriately selected depending on the embodiment. The first target information O10 (user information O10A) may be held in any database platform. In one example, the first target information O10 (user information O10A) may be held in a relational database such as a table format. In another example, the first target information O10 (user information O10A) may be held in a blockchain platform.

[0106] (Second target information) The second target information O20 may include any information related to the second target. The second target information O20 may include, for example, a second identifier I20, attribute information of the second target, information related to authority, and the like. The second target information O20 may be associated with a second time-limited certificate C20. Associating the second time-limited certificate C20 with the second target information O20 may include storing the second time-limited certificate C20 as one item of the second target information O20. When storing the second time-limited certificate C20 in association with the second target information O20, the second time-limited certificate C20 that has expired due to the expiration of its validity period may be appropriately deleted. In the example of FIG. 2, the mobile information O20A is an example of the second target information O20.

[0107] FIG. 3C is a schematic diagram showing an example of the mobile object information O20A according to the present embodiment. In the example of FIG. 3C, the mobile object information O20A includes a mobile object ID (second identifier I20) and attribute information. The attribute information includes a number, a type, and owner information. When the mobile object is a vehicle, the number is a vehicle registration number, and the type is a vehicle type. When the vehicle registration number is used as the mobile object ID, the number may be omitted from the attribute information. The owner information may include any information related to the owner of the mobile object. The owner information may include personal information of the owner, such as, for example, a name, an address, an age, a sex, and a contact address. The owner may be a corporation. Note that the configuration of the mobile object information O20A is not limited to the example of FIG. 3C, and may be appropriately changed according to the embodiment. The configuration of the attribute information may also be appropriately changed. For example, the mobile object information O20A may further include information related to the mobile object terminal, such as a contact address of the mobile object terminal.

[0108] The data format of the second target information O20 (mobile object information O20A) is not particularly limited and may be appropriately selected depending on the embodiment. The second target information O20 (mobile object information O20A) may be held in any database platform. In one example, the second target information O20 (mobile object information O20A) may be held in a relational database such as a table format. In another example, the second target information O20 (mobile object information O20A) may be held in a blockchain platform.

[0109] (How to notify pegging settings) The management server 1 may transmit a notification indicating the result of the association process to at least one of the first terminal 4 and the second terminal 5 (step SC30). The transmission path of the notification is not particularly limited and may be determined appropriately depending on the embodiment. In one example, the management server 1 may directly notify at least one of the first terminal 4 and the second terminal 5 (FIGS. 1 and 2). In another example, the management server 1 may indirectly notify at least one of the first terminal 4 and the second terminal 5 via an external computer such as each server (2, 3).

[0110] (Confirmation of continued use) As an optional configuration, after setting the correspondence between the first target and the second target, the management server 1 may further execute a process (confirmation process) for confirming whether the correspondence is continuing or not. The method of confirming the continuation of use may be appropriately selected depending on the embodiment.

[0111] In one example, the first target and the second target are connected to each other via at least one of the first terminal 4 and the second terminal 5. The continuation of the correspondence may be confirmed by authenticating at least one of the objects. The authentication in the confirmation process may be performed in the same manner as the authentication using the certificates (C1, C2), or may be performed in a different manner. When performing authentication using the certificates (C1, C2), the time-limited certificates (C10, C20) used when setting the correspondence may be used for authentication of continued use as long as they are within the validity period, or newly issued time-limited certificates (C10, C20) may be used. As an example of a form adopting an authentication method different from the certificates (C1, C2), in the case of FIG. 2, for example, the user may be authenticated by using an image sensor provided on the mobile object to perform face authentication of the user, using a fingerprint reader attached to the steering wheel to perform fingerprint authentication of the user, having the user speak and performing voiceprint authentication using a microphone provided on the mobile object, or the like. In order to increase the certainty, the other object may be authenticated via one of the first terminal 4 and the second terminal 5, as in the first pattern of the divided transmission described above. The authentication process may be executed by at least one of the terminals (4, 5), the servers (2, 3), and the management server 1. When the authentication process is executed by the servers (2, 3), the data used for authentication may be sent directly from the terminals (4, 5) to the servers (2, 3), or may be sent indirectly via an external computer such as the management server 1. The same applies when the authentication process is executed by the management server 1. The data used for authentication in the confirmation process may be the same as the certificates (C1, C2), or may be different. The management server 1 may appropriately acquire the authentication result, and may determine that the correspondence relationship continues if the authentication of the target is established in the acquired authentication result, and may determine that the correspondence relationship does not continue if the authentication is not established.

[0112] In another example, when at least one of the first target and the second target is a user (for example, the case of FIG. 2), the management server 1 may directly or indirectly send a confirmation notification including an operator to at least one of the first terminal 4 and the second terminal 5. The operator may be configured to be, for example, a confirmation button, a reply button, a link, or the like. The destination of the confirmation notification does not necessarily correspond to the user. In the case of FIG. 2, the management server 1 may send a confirmation notification to at least one of the first terminal 4 and the second terminal 5. The destination of the confirmation notification may overlap with or may be different from the destination of the notification indicating the result of the association process. The confirmation notification may be configured to directly or indirectly return a response to the management server 1 in response to the operation of the operator by the user. When the management server 1 receives a response to the operation of the operator within a predetermined period, it may determine that the correspondence relationship continues, and when it does not receive a response, it may determine that the correspondence relationship does not continue.

[0113] In yet another example, when tracking the correspondence between a first object and a second object in the real world, each terminal (4, 5) may include a positioning module such as a GPS (Global Positioning Satellite) module or a GNSS (Global Navigation Satellite System) module. The first terminal 4 may measure the current position of the first object (first terminal 4) using the positioning module, and the second terminal 5 may measure the current position of the second object (second terminal 5) using the positioning module. Each terminal (4, 5) may transmit the obtained current position of each object to the management server 1 directly or indirectly via an external computer such as each server (2, 3). The management server 1 may determine whether the correspondence continues depending on whether the received current position of each object is close enough to satisfy a predetermined condition of the usage relationship (for example, the user is riding on a moving object). That is, the management server 1 may determine that the correspondence continues when the current positions of each object are close enough to satisfy the predetermined condition, and may determine that the correspondence does not continue when the current positions of each object are not close enough to satisfy the predetermined condition. In addition, when this form is adopted, the management server 1 may store the obtained information of the current position of each object in association with the association information D10. This allows the management server 1 to track the movement history of each object as well as the correspondence between each object. In addition, at least a part of the above processing may be executed by a computer other than the management server 1.

[0114] If it is determined that the correspondence relationship continues, the management server 1 may maintain the setting of the correspondence relationship. On the other hand, if it is determined that the correspondence relationship does not continue, the management server 1 may The management server 1 may be configured to update the status of the correspondence relationship by repeatedly executing the confirmation process periodically or irregularly after the correspondence relationship is set until the correspondence relationship is released.

[0115] (Unlink) In this embodiment, the management server 1 may be configured to cancel the correspondence relationship upon receipt of a cancellation request from at least one of the first terminal 4 and the second terminal 5 or upon establishment of a predetermined cancellation condition.

[0116] (I) Cancellation request In one example, the link release request (request) includes at least one of the first identifier I10 and the second identifier I20. Simply, the first terminal 4 may send to the management server 1 a release request that includes the first identifier I10 and does not include the second identifier I20. Similarly, the second terminal 5 may send to the management server 1 a release request that includes the second identifier I20 and does not include the first identifier I10. When overlapping of the correspondence setting is permitted, the release request may include both the first identifier I10 and the second identifier I20. In one example, the first terminal 4 or the second terminal 5 may send to the management server 1 a release request that includes the first identifier I10 and the second identifier I20. In another example, the first terminal 4 may send a release request that includes one of the first identifier I10 and the second identifier I20, and the second terminal 5 may send a release request that includes the other. In yet another example, the management server 1 may assign an identifier to the set correspondence relationship, and may notify at least one of the first terminal 4 and the second terminal 5 of the assigned identifier at any timing, such as a notification indicating the result of the association process. At least one of the first terminal 4 and the second terminal 5 may specify the correspondence relationship to be released by sending a release request including this identifier to the management server 1, and cause the management server 1 to release the specified correspondence relationship. According to one example of the present embodiment, the first identifier I10 and the second identifier I20 can be omitted from the information included in the release request. This can be expected to improve the efficiency of data communication in the release request.

[0117] When the first terminal 4 transmits a release request including the second identifier I20, the first terminal 4 may acquire the second identifier I20 at any timing. In one example, when the first terminal 4 adopts a form in which the first terminal 4 acquires the second identifier I20 when requesting the above-mentioned binding setting (for example, the first pattern of divided transmission, etc.), the first terminal 4 may store the second identifier I20 acquired when requesting the binding setting in the memory resource as the current binding information. Alternatively, when the management server 1 adopts a form in which the management server 1 transmits a notification indicating the result of the binding process to the first terminal 4, the notification may be configured to include the second identifier I20. The first terminal 4 may store the second identifier I20 included in the notification received from the management server 1 in the memory resource as the current binding information. When requesting the binding release, the first terminal 4 may acquire the second identifier I20 from the memory resource. Note that the first terminal 4 may acquire the first identifier I10 at any timing. In one example, the first identifier I10 may be stored in advance in a memory resource. When creating the current binding information, the first terminal 4 may store the second identifier I20 in association with the first identifier I10. When sending the release request, the first terminal 4 may obtain the first identifier I10 from the memory resource.

[0118] Similarly, when the second terminal 5 transmits an release request including the first identifier I10, the second terminal 5 may acquire the first identifier I10 at any timing. In one example, when the second terminal 5 adopts a form in which it acquires the first identifier I10 when requesting the above-mentioned binding setting (for example, the first pattern of divided transmission, etc.), the second terminal 5 may store the first identifier I10 acquired when requesting the binding setting in a memory resource as current binding information. Alternatively, when the management server 1 adopts a form in which it transmits a notification indicating the result of the binding process to the second terminal 5, the notification may be configured to include the first identifier I10. The second terminal 5 stores the first identifier I10 included in the notification received from the management server 1 in a memory resource as current binding information. The second terminal 5 may store the first identifier I10 in the memory resource. When requesting to release the association, the second terminal 5 may obtain the first identifier I10 from the memory resource. The second terminal 5 may obtain the second identifier I20 at any timing. In one example, the second identifier I20 may be stored in the memory resource in advance. When creating the current association information, the second terminal 5 may store the first identifier I10 in association with the second identifier I20. When sending the release request, the second terminal 5 may obtain the second identifier I20 from the memory resource.

[0119] FIG. 4A is a schematic diagram showing an example of a process of untying according to the present embodiment. In the example of FIG. 4A, as a first route, the first terminal 4 directly transmits an unbinding request to the management server 1 (step SZ10). Also, as a second route, the first terminal 4 gives an instruction to the second terminal 5 (step SZ10A) to cause the second terminal 5 to directly transmit an unbinding request to the management server 1 (step SZ11A). However, the transmission route of the unbinding request is not limited to this example. The first terminal 4 may indirectly transmit the unbinding request to the management server 1 via an external computer such as the first server 2. In the second route, the second terminal 5 may indirectly transmit the unbinding request to the management server 1 via an external computer such as the second server 3. Note that the starting point of untying is not limited to the first terminal 4. In another example, the second terminal 5 may directly or indirectly transmit the unbinding request to the management server 1. Furthermore, the second terminal 5 may instruct the first terminal 4 to directly or indirectly send a cancellation request to the management server 1. After receiving the cancellation request, the management server 1 refers to the association information D10 and cancels the correspondence specified by the identifier included in the cancellation request. After this cancellation process, the management server 1 may send a notification indicating the result of the cancellation process to at least one of the first terminal 4 and the second terminal 5, in the same manner as when the association was set.

[0120] In one example, the process of the release request may include an authentication process of at least one of the first target and the second target. The authentication process may be the same as the authentication process in the above-mentioned process of setting the association or the process of confirming continued use. However, when making the release request, the authentication process does not necessarily have to be executed. In another example, the process of the release request may be simplified by omitting the authentication process.

[0121] The trigger of the release request may be set appropriately depending on the embodiment. In one example, when at least one of the first target and the second target is a user, the release request may be transmitted from at least one of the first terminal 4 and the second terminal 5 by the user operating at least one of the first terminal 4 and the second terminal 5. That is, the trigger of the release request may be an operation by the user. In another example, with the end of the usage relationship, at least one of the first terminal 4 and the second terminal 5 may execute an arbitrary information processing. This arbitrary information processing may be used as a trigger to transmit the release request from at least one of the first terminal 4 and the second terminal 5. For example, the arbitrary information processing may be data exchange between the first terminal 4 and the second terminal 5. The method of data exchange when requesting release may be the same as the data exchange when setting the link (step SA40, step SB40). The data exchange when setting the link and the data exchange when requesting release may be appropriately distinguished. For example, in the example of FIG. 2, the second terminal 5 may be provided with separate sensor devices at the entrance and exit, such as a bus entrance or a train ticket gate. In this case, a distinction may be made between when a link is set and when a request to release the link is made depending on the sensor device used for the data exchange. Also, for example, when data exchange is executed by an application of the terminal, the application may be configured to be switchable between a link setting mode and a release request mode. In this case, a distinction may be made between when a link is set and when a request to release the link is made depending on the mode of the application.

[0122] In addition, any internal process may be executed in each terminal (4, 5) in association with the processing of the release request. In one example, when current association information is created in at least one of the first terminal 4 and the second terminal 5, at least one of the terminals may update the current association information to past association information in association with the processing of the release request. The update process may be performed as appropriate depending on the embodiment. The update process may be set appropriately. For example, the update process may be to delete the current association information. In this case, the current association information may be completely deleted or may be saved as a past association history. Also, for example, the update process may be to invalidate the current association information by adding invalidation information such as an end time and an end flag setting to the current association information. When adopting a form in which one of the first terminal 4 and the second terminal 5 transmits a release request, the one terminal may transmit a notification to the other terminal to notify the release of association when the release request is transmitted or the release is established. When the current association information is created in the other terminal, the other terminal may execute the update process in response to the notification.

[0123] (II) Termination Conditions The cancellation condition indicates a condition for canceling the correspondence relationship of the target, and may be defined appropriately depending on the embodiment.

[0124] In one example, the release condition may be defined so that the correspondence relationship is released at an arbitrarily set release time. The release time may be given, for example, by a user or another application (such as a scheduler). In this case, the management server 1 may release the target correspondence relationship upon arrival of the release time. The release time may be set as the expiration date of the association information D10. If the release time is set as the expiration date, the management server 1 may treat the target correspondence relationship as having been released upon arrival of the release time.

[0125] In another example, the release condition may be defined such that, when multiple correspondence relationships are set for the same target due to the interruption of a correspondence relationship setting by at least one of another first target and another second target, one of the overlapping correspondence relationships is released. The number of correspondence relationships (linking) that can be set for the same target is not limited to one, and may be two or more. When the overlap of the correspondence relationship settings exceeds a threshold (upper limit), the management server 1 may release one of the correspondence relationships that was set earlier and maintained. The threshold may be given as appropriate. Which correspondence relationship is to be released may be determined as appropriate according to the priority, order, type of target, etc.

[0126] For example, assume a situation where one of the first object and the second object is a user and the other is a use. In this case, the number of users that can be linked to the same use may be infinite or finite. When the number of users that can be linked is finite, the upper limit of the number of users that can be linked may be appropriately given by a threshold. The threshold may be set according to the attribute of the use. When the management server 1 receives a new correspondence setting for the target use, it may refer to the association information D10 and extract the previous correspondence that has been set and maintained for the target use. When the newly received correspondence setting causes the overlap of the correspondence setting for the target use to exceed the threshold, the management server 1 may discard the request for the newly received correspondence setting or cancel at least one of the extracted previous correspondences. When canceling the previous correspondence, the management server 1 may determine the correspondence to be canceled according to the priority and order of the users (for example, the earlier the correspondence setting is, the more it is canceled).

[0127] As a specific example, in the example of FIG. 2, it is assumed that the moving object is a private car, and that the first user and the second user are, for example, family members, and thus share the target private car. The private car may be interpreted as a constantly used object. For ease of explanation, it is assumed that the number of users that can be linked to the target private car is one. In this case, while a correspondence relationship between one of the first user and the second user and the target private car has been set, in response to receiving the setting of a correspondence relationship between the other user and the target private car, the management server 1 may cancel the previous correspondence relationship (the correspondence relationship between one of the first user and the target private car).

[0128] Similarly, the number of uses that can be linked to the same user may be either infinite or finite. If the number of uses that can be linked is finite, the upper limit of the number of uses that can be linked is may be appropriately given by a threshold value. When the management server 1 receives a new correspondence setting for the target user, the management server 1 may refer to the association information D10 and extract previous correspondences that have been set and maintained for the target user. If the newly received correspondence setting causes the overlap of the correspondence settings for the target user to exceed the threshold value, the management server 1 may discard the request for the newly received correspondence setting or cancel at least one of the extracted previous correspondences. When canceling the previous correspondences, the management server 1 may determine the correspondence to be canceled according to the priority and type of the object (for example, whether it is a constantly used object or a temporary used object), etc.

[0129] 2, it is assumed that the first moving body is a constantly used object (e.g., a personal car, etc.) and the second moving body is a temporarily used object (e.g., a rental car, a shared car, a moving body of a public transportation system, etc.). In this case, while the correspondence relationship between the target user and the first moving body is set, the management server 1 may cancel the previous correspondence relationship (the correspondence relationship with the first moving body) in response to receiving the setting of the correspondence relationship between the target user and the second moving body.

[0130] In this specific example, in response to the cancellation of the correspondence relationship with the second moving body (temporarily used object), the management server 1 may reset the correspondence relationship between the first moving body (regularly used object) and the target user that was previously cancelled. This allows the setting of the correspondence relationship with the regular-use object to be quickly restored. Furthermore, when the first moving body and the second moving body are both regular-use objects or temporary-use objects, the management server 1 may arbitrate the settings of the overlapping correspondence relationships as appropriate. For example, the management server 1 may discard a newly received request for setting a correspondence relationship unless the previous correspondence relationship is cancelled.

[0131] As described above, the management server 1 may cancel the correspondence relationship upon receiving a cancellation request from at least one of the first terminal 4 and the second terminal 5 or upon the establishment of a predetermined cancellation condition. According to one example of the present embodiment, it is possible to track the disappearance of the usage relationship between the first target and the second target. Note that the association information D10 after the correspondence relationship is cancelled may be saved as history.

[0132] (Simplified pegging settings) In one example, when a usage relationship is repeatedly created and deleted between the same combination of first and second objects, the management system 100 may execute authentication processing of the first and second objects each time, and repeatedly set and cancel the correspondence relationship. However, when the usage relationship is frequently created and deleted, it may be troublesome to execute authentication processing of the same first and second objects each time. In particular, when one of the first and second objects is a user and the other is a constantly used object, it may be troublesome to execute authentication of both objects each time.

[0133] Therefore, in another example, the management system 100 may be configured to set a correspondence relationship for the same combination of the first target and the second target in the next or subsequent link setting process by omitting authentication processing for at least one of the first target and the second target. That is, the management system 100 may be configured to accept a request to set a correspondence relationship for a combination of the first target and the second target for which a correspondence relationship has been set in the past by omitting authentication processing for at least one of the first target and the second target. For convenience of explanation, the process of setting a correspondence relationship by omitting authentication processing for at least one of the first target and the second target is also referred to as a "simplified link setting process", and the process of the normal route in which the authentication processing is not omitted is also referred to as a "normal link setting process". In one example, in the link setting by the simplified process, authentication processing for one of the first target and the second target may be executed. In another example, in the link setting by the simplified process, authentication processing for both the first target and the second target may be omitted.

[0134] Information on combinations of first and second objects for which a correspondence relationship has been set in the past is managed by at least one of the management server 1, each server (2, 3), and each terminal (4, 5). In one example, the association information D10 may be maintained as a history even after the correspondence is released. The management server 1 may determine whether or not the combination of the first target and the second target for which the request for setting the correspondence has been received is a combination for which a correspondence has been set in the past, based on the history of the association information D10. If it is determined that the combination is a combination for which a correspondence has been set in the past, the management server 1 may set the association by simplified processing. In addition, at any timing, such as when setting the association, the first terminal 4 may acquire the second identifier I20 of the second target, and store the acquired second identifier I20 as a destination of the simplified processing. The second terminal 5 may also acquire the first identifier I10 of the first target, and store the acquired first identifier I10 as a destination of the simplified processing. Thereby, at least one of the first terminal 4 and the second terminal 5 may hold information of a destination with which a correspondence has been set in the past, and may use the held information of the destination to request the setting of the association by simplified processing. The first server 2 may also acquire the second identifier I20 of the second target from at least one of the management server 1 and each terminal (4, 5), and store the acquired second identifier I20 in association with the first target information O10 of the corresponding first target as a destination of the simplified processing. The second server 3 may also acquire the first identifier I10 of the first target from at least one of the management server 1 and each terminal (4, 5), and store the acquired first identifier I10 in association with the second target information O20 of the corresponding second target as a destination of the simplified processing. In this way, at least one of the first server 2 and the second server 3 may hold information of the destination with which a correspondence relationship was previously set, and may use the held information of the destination to respond to the linking setting by the simplified processing.

[0135] Furthermore, the management system 100 may be configured to permit simplified processing for some of the first and second objects, for example, permitting simplified processing for objects used regularly, not permitting simplified processing for objects used temporarily, and linking them every time with normal processing. Whether or not simplified processing is permitted may be switched as appropriate. In one example, whether or not simplified processing is permitted may be switched depending on the type of at least one of the first and second objects. As a specific example, when one of the first and second objects is a user and the other is an object of use, as described above, whether or not simplified processing is permitted may be switched depending on the type of the object of use (whether it is an object of use regularly or an object of use).

[0136] Whether or not simplified processing is permitted may be switched by any method. In one example, at least one of the management server 1, each server (2, 3), and each terminal (4, 5) may identify the type of the object to be used, and may switch whether or not simplified processing is permitted depending on the result of the identification. The type of the object to be used may be identified by individual information included in the target information, or may be identified by information such as an identifier. In another example, a program including a mode that permits simplified processing may be installed only in a terminal of an object to be used that permits simplified processing, such as a terminal of an object to be used at all times (the second terminal 5 in FIG. 2), and whether or not simplified processing is permitted may be switched by the operation of this terminal. Note that the operation of the mode that permits simplified processing may be, for example, storing the information of the other party, transmitting a request for linking setting by simplified processing, etc.

[0137] The request for the simplified processing of the linking setting may be transmitted from at least one of the first terminal 4 and the second terminal 5. At least one of the first terminal 4 and the second terminal 5 may transmit the request for the simplified processing of the linking setting to the management server 1 directly, or may transmit the request indirectly to the management server 1 via an external computer such as each server (2, 3). For example, the first terminal 4 may transmit the request for the simplified processing of the linking setting to the management server 1 directly, or may transmit the request indirectly to the management server 1 via an external computer such as the first server 2. The first terminal 4 may instruct the second terminal 5 to transmit the request for the simplified processing of the linking setting to the management server 1 directly, or may transmit the request indirectly to the management server 1 via an external computer such as the second server 3. Similarly, the second terminal 5 may transmit the request for the simplified processing of the linking setting to the management server 1 directly, or may transmit the request indirectly to the management server 1 via an external computer such as the second server 3. The second terminal 5 gives an instruction to the first terminal 4 to cause the first terminal 4 to directly transmit a request for linking setting by simplified processing to the management server 1. Alternatively, the information may be transmitted indirectly via an external computer such as the first server 2.

[0138] Whether the request is for simplified processing or normal processing may be determined as appropriate. In one example, the request for linking setting may include information indicating whether it is simplified processing or not. The management server 1 may determine whether it is simplified processing or normal processing depending on this information. In another example, the management server 1 may determine whether it is simplified processing or normal processing depending on the target information included in the request for linking setting (for example, the combination of the first identifier I10 and the second identifier I20).

[0139] Basically, the request for the simplified processing to set up the association may include the first identifier I10 and the second identifier I20. The first identifier I10 and the second identifier I20 included in the request may be obtained from either of the terminals (4, 5) and the servers (2, 3) in the process of being sent from at least one of the first terminal 4 and the second terminal 5 to the management server 1. However, the request for the simplified processing to set up the association may not be limited to such a configuration. At least one of the first identifier I10 and the second identifier I20 may be omitted from the information included in the request. In another example, similar to the example of the above-mentioned release request, the management server 1 may store (register) a combination that allows the simplified processing by assigning an identifier to the correspondence relationship between the first identifier I10 and the second identifier I20 when setting up the association in the past. The management server 1 may notify at least one of the first terminal 4 and the second terminal 5 of the assigned identifier at any timing such as a notification indicating the result of the association processing. At least one of the first terminal 4 and the second terminal 5 may transmit a request for binding setting including this identifier to the management server 1, thereby causing the management server 1 to execute the binding setting by simplified processing. According to one example of this embodiment, the first identifier I10 and the second identifier I20 can be omitted from the information included in the request. This can be expected to improve the efficiency of data communication in the request for binding setting.

[0140] In one example, when a form of performing authentication processing of one of the first target and the second target is adopted in the simplified processing, the authentication processing of one of the first target and the second target may be performed in the same transmission form as in the normal processing. For example, when a first pattern of divided transmission is adopted in the normal processing, the first pattern of divided transmission may also be adopted in the simplified processing. However, the form of authentication processing in the simplified processing may not be limited to such an example. In another example, a transmission form different from the transmission form adopted in the normal processing among the above transmission forms may be adopted as the transmission form of the authentication processing in the simplified processing. In yet another example, at least one of the first terminal 4 and the second terminal 5 may directly transmit an authentication request to each server (2, 3). The authentication result may be transmitted to the management server 1 from at least one of the servers (2, 3) and each terminal (4, 5).

[0141] In addition, when adopting a form in which authentication processing of one of the first target and the second target is performed, the terminal that transmits the request for the association setting by the simplified processing may store at least a part of the data (identifier, certificate) used for authentication of the one. For example, when adopting the first pattern of the divided transmission, the second terminal 5 may store at least one of the first identifier I10 and the first certificate C1 of the first target in the memory resource at any timing such as when the association setting was performed in the past. The second terminal 5 may obtain at least one of the first identifier I10 and the first certificate C1 from the memory resource, and transmit the data used for authentication to the management server 1 using the obtained information. This can further reduce the effort required for the association setting.

[0142] Fig. 4B shows a schematic diagram of an example of the process of linking setting by simplified processing according to this embodiment. Fig. 4B assumes a scene in which, in the example of Fig. 2, authentication processing of a user (first target) is executed, authentication processing of a mobile object (second target) is omitted, and the first pattern of divided transmission is adopted as the transmission form of the authentication processing. In steps SA10 to SA30, a first time-limit certificate C10 is issued, and the issued first time-limit certificate C10 is notified to the first terminal 4 and the management server 1. In step SA40, in the data exchange, the first terminal 4 provides the issued first time-limited certificate C10 to the second terminal 5 as the first certificate C1. The first terminal 4 also provides the first identifier I10 to the second terminal 5. The second terminal 5 acquires the first identifier I10 and the first certificate C1 from the user. In step SA50, the second terminal 5 transmits a request for setting up a link by the simplified process, including the first identifier I10 and the first certificate C1, to the management server 1. This request may also include the second identifier I20. The management server 1 appropriately determines that the request received from the second terminal 5 is a request for setting up a link by the simplified process. In step SC10, the management server 1 performs a user authentication process by collating the first certificate C1 received from the second terminal 5 with the corresponding first time-limited certificate C10. When the user authentication is established (matching is established), the management server 1 sets a correspondence (linking) between the first identifier I10 and the second identifier I20 (step SC20). The process of linking setting by the simplified process may not be limited to the example of FIG. 4B, and may be changed as appropriate according to the embodiment. For example, when adopting a form in which authentication processing of one of the first target and the second target is executed as described above, a transmission form other than the first pattern of divided transmission may be adopted. The simplified process may be configured to omit authentication processing of the user (first target) and execute authentication processing of the mobile object (second target). The request for linking setting by the simplified process may be transmitted from the first terminal 4, not from the second terminal 5. The transmission route of the request by the simplified process may not be limited to the example of FIG. 4B. At least one of the first identifier I10 and the second identifier I20 may be omitted from the request for linking setting by the simplified process.

[0143] As an optional configuration, the management server 1 may acquire identification information (MAC address, terminal identification information, etc.) of at least one of the first terminal 4 and the second terminal 5 for which simplified processing is permitted as a registration process of targets for which simplified processing is permitted, and store the acquired identification information. This registration process may be executed at any timing, such as when setting up a past association. The management server 1 may be configured to accept requests for setting up association using simplified processing only from terminals identified by the identification information.

[0144] The trigger of the request for the simplified processing of the association setting may be the same as that of the normal processing. That is, the data exchange between the first terminal 4 and the second terminal 5 may be used as a trigger to cause at least one of the first terminal 4 and the second terminal 5 to transmit a request for the simplified processing of the association setting to the management server 1. However, the trigger of the simplified processing may not be limited to such an example. In another example, when at least one of the first target and the second target is a user, a request for the simplified processing of the association setting may be transmitted from at least one of the first terminal 4 and the second terminal 5 by the user's operation of at least one of the first terminal 4 and the second terminal 5. That is, the trigger of the request for the simplified processing of the association setting may be an operation by the user. In another example, the trigger of the request for the simplified processing of the association setting may be an instruction by another application (scheduler, etc.). In another example, as with the above-mentioned release request, any information processing may be executed by at least one of the first terminal 4 and the second terminal 5 in response to the occurrence of the usage relationship. This optional information processing may be used as a trigger to transmit a request for linking setting by simplified processing from at least one of the first terminal 4 and the second terminal 5.

[0145] Basically, the process of canceling the correspondence relationship set by the simplified process (the process of canceling the correspondence relationship for the simplified process) may be the same as the process of canceling the association in the normal process (the process of canceling the correspondence relationship for the normal process). However, the process of canceling the correspondence relationship for the simplified process may not necessarily match the process of canceling the correspondence relationship for the normal process. The correspondence relationship set by the simplified process may be canceled as appropriate. In another example, when the transmission route of the request to set the correspondence relationship for the simplified process is different from the transmission route of the request to cancel the correspondence relationship for the normal process, the transmission route of the request to cancel the correspondence relationship for the simplified process may be aligned with the transmission route of the request to set the correspondence relationship for the simplified process.

[0146] (Scenes where linked information can be used) As described above, the linking information D10 may be used in various situations. In one example, the linking information D10 may be used simply to track the occurrence and disappearance of a relationship between a first object and a second object. In another example, the linking information D10 may be used to enable at least a part of the authority linked to either the first object or the second object to be exercised from the other object while a correspondence relationship between the first object and the second object is set. In the example of FIG. 2, the linking information D10 may be used to enable at least a part of the authority linked to the user to be exercised from the mobile object while a correspondence relationship between the user and the mobile object is set.

[0147] Fig. 5 shows a schematic example of a usage scenario of the association information D10 according to this embodiment. Fig. 5 assumes a scenario in which the authority associated with a user is exercised from a mobile object in the example of Fig. 2. The external system SY1 is deployed in a location where various services are exercised (e.g., a parking lot, etc.), and is configured to execute information processing for providing a target service to a user having the target authority. The configuration and services of the external system SY1 are not particularly limited, and may be appropriately selected according to the embodiment.

[0148] First, in step U10, the external system SY1 acquires the second identifier I20 (mobile body identifier) ​​from the target mobile body. A method for acquiring the second identifier I20 may be appropriately selected depending on the embodiment. In one example, the external system SY1 may acquire the second identifier I20 from the second terminal 5 by exchanging data with the second terminal 5. The method of data exchange may be similar to the data exchange between the first terminal 4 and the second terminal 5. In another example, when the second identifier I20 is a vehicle registration number, the external system SY1 may acquire the second identifier I20 by photographing the license plate with an image sensor and analyzing the obtained image.

[0149] In step U20, the external system SY1 uses the acquired second identifier I20 as a query to inquire of the management server 1 whether or not there is a valid correspondence relationship for the target moving object at the target date and time. "Valid" means that the setting is maintained (not released) at the target date and time. Basically, the target date and time is the present (instant), but is not limited to this. For example, when executing a payment process at a past date and time, the target date and time may be a past date and time. If there is a valid correspondence relationship, the first identifier I10 (user identifier) ​​of the user associated with the target moving object is extracted. On the other hand, if there is no valid correspondence relationship and a user associated with the target moving object is not extracted, this process may end.

[0150] In step U30, the external system SY1 uses the extracted first identifier I10 as a query to inquire of the first server 2 about the exercisable authority of the user associated with the target moving object. The first server 2 refers to the first target information O10 (user information O10A) to extract the exercisable authority associated with the target user. If the exercisable authority is not extracted, this process may end. In the first target information O10 (user information O10A), whether or not to permit the exercise of the authority by the moving object may be set for each authority. The exercisable authority may be extracted according to this setting. Also, if the target authority that the external system SY1 is going to exercise is not included in the exercisable authority, this process may end. The authority to be exercised may be appropriately specified at any timing. In one example, the authority to be exercised may be specified in advance in the external system SY1, or may be specified by the user.

[0151] In step U40, if the exercisable authorities include the target authority, the external system SY1 executes a process for exercising the target authority. As a result, the authority associated with the user is exercised from the mobile body, and the user can receive services via the mobile body. For example, if the authority information includes information on public personal authentication and the target authority is related to public personal authentication, the user can receive public services via the mobile body. Also, for example, if the authority information includes payment information and the target authority is related to payment, the user can A payment service can be received via the mobile device. The payment service can be, for example, payment for parking fees, highway fees, drive-through fees, public transportation fees, rental fees, etc. Also, for example, if the authority information includes information regarding an electronic prescription and the target authority is receipt of medicine prescribed by the electronic prescription, the user can exercise the electronic prescription via the mobile device and receive the medicine.

[0152] The above processing procedure for exercising authority is merely an example, and each step may be modified as much as possible. Steps of the above processing procedure may be omitted, replaced, or added as appropriate depending on the embodiment. In addition, in the above processing procedure, the user may be replaced with a first object, and the moving object may be replaced with a second object. Furthermore, in the above processing procedure, "first" and "second" may be interchanged.

[0153] (Data communication between devices) Data communication between each device (management server 1, first server 2, second server 3, first terminal 4, and second terminal 5) is not particularly limited and may be appropriately selected depending on the embodiment. The network between each device may be appropriately selected from, for example, the Internet, a wireless communication network, a mobile communication network, a telephone network, a dedicated network, a local area network, etc. Data communication between each device is performed using a method such as SSL (Secure Socket Layer) or TLS (Transport Layer Security). In one example, each of the terminals (4, 5) may include a Subscriber Identity Module (SIM), and data communication between the management server 1 and each of the terminals (4, 5) may be performed by encrypted communication using the SIM.

[0154] [2 Configuration example] [Hardware configuration example] (Management Server) 6A is a schematic diagram showing an example of a hardware configuration of the management server 1 according to the present embodiment. The management server 1 according to the present embodiment is a computer to which a control unit 11, a storage unit 12, a communication interface 13, an input device 14, an output device 15, and a drive 16 are electrically connected.

[0155] The control unit 11 includes a CPU (Central Processing Unit) which is a hardware processor, The management server 1 includes a random access memory (RAM), a read only memory (ROM), etc., and is configured to execute any information processing based on programs and various data. The control unit 11 (CPU) is an example of a processor resource of the management server 1.

[0156] The storage unit 12 may be configured, for example, with a hard disk drive, a solid state drive, a semiconductor memory, etc. The storage unit 12 (as well as RAM and ROM) is an example of a memory resource. In this embodiment, the storage unit 12 stores various information such as a management program 81 and association information D10. The management program 81 is a program for causing the management server 1 to execute information processing (such as FIGS. 8A to 8C described below) relating to the setting and cancellation of a correspondence relationship between a first object and a second object. The management program 81 includes a series of commands for the information processing.

[0157] The communication interface 13 is configured to perform wired or wireless communication via a network. The communication interface 13 may be configured, for example, by a wired LAN (Local Area Network) module, a wireless LAN module, etc. The management server 1 may perform data communication with other computers (the first server 2, the second server 3, the first terminal 4, and the second terminal 5) via the communication interface 13.

[0158] The input device 14 is a device for inputting information such as a mouse, a keyboard, and an operation button. The output device 15 is a device for outputting information such as a display and a speaker. An operator can operate the management server 1 by using the input device 14 and the output device 15. The input device 14 and the output device 15 may be integrally configured, for example, by a touch panel display or the like. The input device 14 and the output device 15 may be connected via an external interface. The external interface may be appropriately configured to connect to an external device in a wired or wireless manner, for example, by a Universal Serial Bus (USB) port, a dedicated port, a wireless communication port, or the like.

[0159] The drive 16 is a device for reading various information such as a program stored in the storage medium 91. At least one of the management program 81 and the association information D10 may be stored in the storage medium 91 instead of or together with the storage unit 12. The storage medium 91 is configured to accumulate various information (stored programs, etc.) by electrical, magnetic, optical, mechanical, or chemical action so that a machine such as a computer can read the information. The management server 1 may acquire at least one of the management program 81 and the association information D10 from the storage medium 91. The storage medium 91 may be a disk-type storage medium such as a CD or DVD, or may be a non-disk-type storage medium such as a semiconductor memory (e.g., a flash memory). The type of the drive 16 may be appropriately selected according to the type of the storage medium 91. The drive 16 may be connected via an external interface.

[0160] In addition, with regard to the specific hardware configuration of the management server 1, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 11 may include multiple hardware processors. The hardware processor may be a microprocessor, a field-programmable gate array (FPGA), a digital signal processor (DSP), a GPS (GPS), or a combination of these. The input device 14, the output device 15, and the drive 16 may be configured by a graphics processing unit (U), an application specific integrated circuit (ASIC), etc. Either of them may be omitted. The association information D10 may be stored in an external computer accessible to the management server 1 (for example, NAS: Network Attached Storage, etc.) instead of in the storage unit 12. The management server 1 may be composed of multiple computers. In this case, the hardware configurations of the computers may or may not match. The management server 1 may be an information processing device designed specifically for the service provided, as well as a general-purpose server device, a general-purpose computer, etc.

[0161] (First server) 6B shows a schematic diagram of an example of a hardware configuration of the first server 2 according to this embodiment. The first server 2 according to this embodiment is a computer in which a control unit 21, a storage unit 22, a communication interface 23, an input device 24, an output device 25, and a drive 26 are electrically connected. The control unit 21 to the drive 26 and the storage medium 92 of the first server 2 may be configured similarly to the control unit 11 to the drive 16 and the storage medium 91 of the management server 1, respectively.

[0162] The control unit 21 (CPU) is an example of a processor resource of the first server 2, and the storage unit 22 (and RAM, ROM) is an example of a memory resource of the first server 2. In this embodiment, the storage unit 22 stores various information such as a program 82 and first target information O10. The program 82 is a program for causing the first server 2 to execute information processing (FIG. 8A, etc., described later) related to the issuance of the first target time-limited certificate. The program 82 includes a series of instructions for the information processing. At least one of the program 82 and the first target information O10 may be stored in a storage medium 92 instead of or together with the storage unit 22. The first server 2 may acquire at least one of the program 82 and the first target information O10 from the storage medium 92. The first server 2 may perform data communication with other computers (the management server 1, the first terminal 4, etc.) via the communication interface 23. The first server 2 may be operated via an input device 24 and an output device 25.

[0163] Regarding the specific hardware configuration of the first server 2, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 21 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, FPGA, DSP, GPU, ASIC, or the like. At least one of the input device 24, the output device 25, and the drive 26 may be omitted. The first target information O10 may be stored in an external computer (e.g., NAS, etc.) accessible by the first server 2, instead of the storage unit 22. The first server 2 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The first server 2 may be an information processing device designed specifically for the service provided, as well as a general-purpose server device, a general-purpose computer, or the like.

[0164] (Second server) 6C shows an example of a hardware configuration of the second server 3 according to this embodiment. The second server 3 according to this embodiment is a computer to which a control unit 31, a storage unit 32, a communication interface 33, an input device 34, an output device 35, and a drive 36 are electrically connected. The control unit 31 to the drive 36 and the storage medium 93 of the second server 3 may be configured similarly to the control unit 11 to the drive 16 and the storage medium 91 of the management server 1, respectively.

[0165] The control unit 31 (CPU) is an example of a processor resource of the second server 3, and the storage unit 32 (and RAM, ROM) is an example of a memory resource of the second server 3. In this embodiment, the storage unit 32 stores various information such as the program 83 and the second target information O20. The program 83 is a program for causing the second server 3 to execute information processing (FIG. 8A, etc., described later) related to the issuance of the second target time-limited certificate. The program 83 includes a series of instructions for the information processing. At least one of the program 83 and the second target information O20 may be stored in a storage medium 93 instead of or together with the storage unit 32. The second server 3 may acquire at least one of the program 83 and the second target information O20 from the storage medium 93. The second server 3 may perform data communication with other computers (the management server 1, the second terminal 5, etc.) via the communication interface 33. The second server 3 may be operated via an input device 34 and an output device 35.

[0166] Regarding the specific hardware configuration of the second server 3, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 31 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, FPGA, DSP, GPU, ASIC, or the like. At least one of the input device 34, the output device 35, and the drive 36 may be omitted. The second target information O20 may be stored in an external computer (e.g., NAS, etc.) accessible by the second server 3, instead of the storage unit 32. The second server 3 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The second server 3 may be an information processing device designed specifically for the service provided, as well as a general-purpose server device, a general-purpose computer, or the like.

[0167] (First terminal) 6D shows a schematic diagram of an example of a hardware configuration of the first terminal 4 according to the present embodiment. The first terminal 4 according to the present embodiment is a computer to which a control unit 41, a storage unit 42, a communication interface 43, an input device 44, an output device 45, and a drive 46 are electrically connected. The control unit 41 to the drive 46 and the storage medium 94 of the first terminal 4 may be configured in the same manner as the control unit 11 to the drive 16 and the storage medium 91 of the management server 1, respectively.

[0168] The control unit 41 (CPU) is an example of a processor resource of the first terminal 4, and the memory unit 4 2 (and RAM, ROM) are an example of memory resources of the first terminal 4. In this embodiment, the storage unit 42 stores various information such as the program 84, the first time certificate C10, and the first identifier I10. The program 84 is a program for causing the first terminal 4 to execute information processing related to the association (FIGS. 8A to 8C, etc., described later). The program 84 includes a series of instructions for the information processing. At least one of the program 84, the first time certificate C10, and the first identifier I10 may be stored in the storage medium 94 instead of the storage unit 42 or together with the storage unit 42. The first terminal 4 may acquire at least one of the program 84, the first time certificate C10, and the first identifier I10 from the storage medium 94. The first terminal 4 may perform data communication with other computers (the management server 1, the first server 2, the second terminal 5, etc.) via the communication interface 43. The first terminal 4 may be operated via the input device 44 and the output device 45.

[0169] In addition, regarding the specific hardware configuration of the first terminal 4, components can be omitted, replaced, or added as appropriate depending on the embodiment. For example, the control unit 41 may include multiple hardware processors. The hardware processor is configured by a microprocessor, FPGA, DSP, GPU, ASIC, ECU (Electronic Control Unit), etc. At least one of the input device 44, the output device 45, and the drive 46 may be omitted. The first identifier I10 may not be stored in the storage unit 42. The first identifier I10 may be acquired each time. In order to acquire data such as the identifier and the certificate, the first terminal 4 may further include a data acquisition device such as a sensor and a reading device. The communication interface 43 may be configured with a plurality of types of modules. For example, the communication interface 43 may include a short-range wireless communication module and a wireless communication module, and the first terminal 4 may perform data communication with the second terminal 5 via the short-range wireless communication module and perform data communication with the management server 1 via the wireless communication module. The first terminal 4 may be configured with a plurality of computers. In this case, the hardware configurations of the computers may or may not be the same. The first terminal 4 may be an information processing device designed specifically for the service provided, as well as a general-purpose computer, a terminal device (e.g., a smartphone, a tablet PC, etc.), etc.

[0170] (2nd terminal) 6E shows a schematic diagram of an example of a hardware configuration of the second terminal 5 according to the present embodiment. The second terminal 5 according to the present embodiment is a computer to which a control unit 51, a storage unit 52, a communication interface 53, an input device 54, an output device 55, and a drive 56 are electrically connected. The control unit 51 to the drive 56 and the storage medium 95 of the second terminal 5 may be configured in the same manner as the control unit 11 to the drive 16 and the storage medium 91 of the management server 1, respectively.

[0171] The control unit 51 (CPU) is an example of a processor resource of the second terminal 5, and the storage unit 52 (and RAM, ROM) is an example of a memory resource of the second terminal 5. In this embodiment, the storage unit 52 stores various information such as the program 85, the second time certificate C20, and the second identifier I20. The program 85 is a program for causing the second terminal 5 to execute information processing related to the association (FIGS. 8A to 8C, etc., described later). The program 85 includes a series of instructions for the information processing. At least one of the program 85, the second time certificate C20, and the second identifier I20 may be stored in the storage medium 95 instead of the storage unit 52 or together with the storage unit 52. The second terminal 5 may acquire at least one of the program 85, the second time certificate C20, and the second identifier I20 from the storage medium 95. The second terminal 5 may perform data communication with other computers (the management server 1, the second server 3, the first terminal 4, etc.) via the communication interface 53. The second terminal 5 may be operated via an input device 54 and an output device 55 .

[0172] Regarding the specific hardware configuration of the second terminal 5, depending on the embodiment, Components can be omitted, replaced, and added. For example, the control unit 51 may include multiple hardware processors. The hardware processor may be configured with a microprocessor, FPGA, DSP, GPU, ASIC, ECU, etc. At least one of the input device 54, the output device 55, and the drive 56 may be omitted. The second identifier I20 may not be stored in the storage unit 52. The second identifier I20 may be acquired each time. In order to acquire data such as an identifier and a certificate, the second terminal 5 may further include a data acquisition device such as a sensor or a reading device. The communication interface 53 may be configured with multiple types of modules, similar to the first terminal 4. The second terminal 5 may be configured with multiple computers. In this case, the hardware configurations of the computers may or may not be the same. The second terminal 5 may be a general-purpose computer, a terminal device, etc., in addition to an information processing device designed specifically for the service provided.

[0173] [Software configuration example] FIG. 7 illustrates an example of a software configuration of each device (the management server 1, the first server 2, the second server 3, the first terminal 4, and the second terminal 5) according to this embodiment.

[0174] (Management Server) The control unit 11 of the management server 1 loads the management program 81 stored in the storage unit 12 into the RAM, and causes the CPU to execute instructions included in the management program 81. As a result, the management server 1 operates as a computer including a collating unit 111, a setting unit 112, a release unit 113, and a notification unit 114 as software modules.

[0175] The matching unit 111 is configured to receive, in response to the occurrence of a usage relationship between the first target and the second target, the first certificate C1 submitted in correspondence with the first time-limit certificate C10 and the second certificate C2 submitted in correspondence with the second time-limit certificate C20 from at least one of the first terminal 4 and the second terminal 5. The matching unit 111 is configured to match each of the received certificates (C1, C2) with each of the time-limit certificates (C10, C20) notified from each of the servers (2, 3).

[0176] The setting unit 112 is configured to set a correspondence relationship between the first identifier I10 and the second identifier I20 when matching (authentication of the first target and the second target) of each certificate (C1, C2) and each time-limited certificate (C10, C20) is both established. The release unit 113 is configured to release the correspondence relationship upon receiving a release request from at least one of the first terminal 4 and the second terminal 5 or upon establishment of a predetermined release condition. The notification unit 114 is configured to send a notification indicating a result of the process of setting the correspondence relationship to at least one of the first terminal 4 and the second terminal 5. The notification unit 114 is configured to send a notification indicating a result of the process of releasing the correspondence relationship to at least one of the first terminal 4 and the second terminal 5.

[0177] (First server) The control unit 21 of the first server 2 executes instructions included in the program 82 by the CPU. As a result, the first server 2 operates as a computer having an issuing unit 211 and a notifying unit 212 as software modules. The issuing unit 211 is configured to issue a first time certificate C10 of a first subject. The first time certificate C10 may be generated in response to an issuance request from the first subject, or may be generated spontaneously. The notifying unit 212 is configured to notify the issued first time certificate C10.

[0178] (Second server) The control unit 31 of the second server 3 executes instructions included in the program 83 by the CPU. As a result, the second server 3 operates as a computer having an issuing unit 311 and a notifying unit 312 as software modules. The issuing unit 311 is configured to issue a second time-limit certificate C20 for a second subject. The second time-limit certificate C20 is issued in response to an issuance request from the second subject. The second time-limit certificate C20 may be generated in response to a request, or may be generated spontaneously. The notification unit 312 is configured to notify the issued second time-limit certificate C20.

[0179] (First terminal) The control unit 41 of the first terminal 4 executes instructions included in the program 84 by the CPU. As a result, the first terminal 4 operates as a computer having an issuance request unit 411, a data exchange unit 412, a setting request unit 413, and a release request unit 414 as software modules. The issuance request unit 411 is configured to request the first server 2 to issue the first time-limited certificate C10. The data exchange unit 412 is configured to execute data exchange with the second terminal 5. The setting request unit 413 is configured to request the management server 1 to set the correspondence relationship between the first target and the second target by transmitting data used for authentication. The release request unit 414 is configured to request the management server 1 to release the correspondence relationship.

[0180] (2nd terminal) The control unit 51 of the second terminal 5 executes instructions included in the program 85 by the CPU. As a result, the second terminal 5 operates as a computer having an issuance request unit 511, a data exchange unit 512, a setting request unit 513, and a release request unit 514 as software modules. The issuance request unit 511 is configured to request the second server 3 to issue the second time-limited certificate C20. The data exchange unit 512 is configured to execute data exchange with the first terminal 4. The setting request unit 513 is configured to request the management server 1 to set the correspondence relationship between the first target and the second target by transmitting data used for authentication. The release request unit 514 is configured to request the management server 1 to release the correspondence relationship.

[0181] (others) In this embodiment, an example is described in which each software module of each device is realized by a general-purpose CPU. However, some or all of the above software modules may be realized by one or more dedicated processors. Each of the above modules may be realized as a hardware module. With respect to the software configuration of each device, modules may be omitted, replaced, or added as appropriate depending on the embodiment. For example, when the above-mentioned bulk transmission form is adopted as the transmission form of data used for authentication, the setting request unit (413, 513) may be omitted from one of the first terminal 4 and the second terminal 5 (the terminal not responsible for data transmission). Also, for example, when a form in which an release request is transmitted from only one of the first terminal 4 and the second terminal 5 is adopted, the release request unit (414, 514) may be omitted from the other terminal.

[0182] [3 Example of operation] (Linking settings) 8A and 8B show an example of a processing procedure for linking setting by the management system 100 according to this embodiment. The following processing procedure is an example of a management method executed by a computer. Note that the example of Fig. 8A and Fig. 8B assumes a situation in which the first divided transmission pattern is adopted as the transmission form of data used for authentication, each time-limited certificate (C10, C20) is issued in advance prior to a request for linking setting, and each terminal (4, 5) acquires data used for authentication in data exchange.

[0183] In step SA10, the control unit 41 of the first terminal 4 operates as an issuance request unit 411 and transmits an issuance request for a first time-limited certificate C10 to the first server 2. In step SA20, the control unit 21 of the first server 2 operates as an issuing unit 211 and issues a first time-limited certificate C10 in association with the first identifier I10 in response to receiving the issuance request. Note that the first target individual may be appropriately identified between the first terminal 4 and the first server 2. In a typical example, the first terminal 4 may transmit an issuance request including the first identifier I10 to the first server 2, and the first identifier I10 included in the issuance request may be transmitted to the first server 2. The first identifier I10 may allow the first server 2 to identify the first subject individual.

[0184] Then, the control unit 21 operates as the notification unit 212 and returns the issued first time certificate C10 to the first terminal 4. In response to this, in step SA201, the control unit 41 of the first terminal 4 receives the issued first time certificate C10 from the first server 2 and stores the received first time certificate C10 so that it can be used as the first certificate C1. Also, in step SA30, the control unit 21 of the first server 2 operates as the notification unit 212 and notifies the management server 1 of the issued first time certificate C10. In response to this, in step SA301, the control unit 11 of the management server 1 receives the issued first time certificate C10 from the first server 2 and stores the received first time certificate C10. In one example, the control unit 21 may send the first time certificate C10 to the management server 1 with the first identifier I10 attached. The management server 1 may store the first time-limited certificate C10 in association with the first identifier I10.

[0185] In step SB10, the control unit 51 of the second terminal 5 operates as the issuance request unit 511 and transmits an issuance request for the second time-limited certificate C20 to the second server 3. In step SB20, the control unit 31 of the second server 3 operates as the issuing unit 311 and issues the second time-limited certificate C20 in relation to the second identifier I20 in response to receiving the issuance request. Note that, similar to the first object, the individual of the second object may be appropriately identified between the second terminal 5 and the second server 3. In a typical example, the issuance request may include the second identifier I20, and the individual of the second object may be identified in the second server 3 by the second identifier I20 included in the issuance request.

[0186] Then, the control unit 31 operates as the notification unit 312 and returns the issued second time certificate C20 to the second terminal 5. In response to this, in step SB201, the control unit 51 of the second terminal 5 receives the issued second time certificate C20 from the second server 3 and stores the received second time certificate C20 so that it can be used as the second certificate C2. Also, in step SB30, the control unit 31 of the second server 3 operates as the notification unit 312 and notifies the management server 1 of the issued second time certificate C20. In response to this, in step SB301, the control unit 11 of the management server 1 receives the issued second time certificate C20 from the second server 3 and stores the received second time certificate C20. In one example, the control unit 31 may send the second time certificate C20 to the management server 1 with the second identifier I20 attached. The management server 1 may store the second time-limited certificate C20 in association with the second identifier I20.

[0187] In step SAB400, the control unit 41 of the first terminal 4 operates as the data exchange unit 412 and executes data exchange with the second terminal 5. The control unit 51 of the second terminal 5 operates as the data exchange unit 512 and executes data exchange with the first terminal 4. The data exchange may be executed appropriately in response to the occurrence of a usage relationship between the first target and the second target. In step SA40, the control unit 41 of the first terminal 4 provides the first identifier I10 and the first certificate C1 corresponding to the first time-limited certificate C10 to the second terminal 5. In response, the control unit 51 of the second terminal 5 acquires the first identifier I10 and the first certificate C1 from the first target. In step SB40, the control unit 51 of the second terminal 5 provides the second identifier I20 and the second certificate C2 corresponding to the second time-limited certificate C20 to the first terminal 4. In response, the control unit 41 of the first terminal 4 acquires the second identifier I20 and the second certificate C2 from the second target. The processes of steps SA40 and SB40 may be performed within the process of data exchange.

[0188] In step SA50, the control unit 51 of the second terminal 5 operates as a setting request unit 513 and transmits a binding setting request including an authentication request consisting of the first identifier I10 and the first certificate C1 to the management server 1. In response to this, the control unit 11 of the management server 1 receives the first identifier I10 and the first certificate C1. Also, in step SB50, the control unit 41 of the first terminal 4 operates as a setting request unit 413 and transmits a binding setting request including an authentication request consisting of the second identifier I20 and the second certificate C2 to the management server 1. In response to this, the control unit 11 of the management server 1 receives the first identifier I10 and the first certificate C1. The control unit 11 of the management server 1 receives the second identifier I20 and the second certificate C2. The control unit 11 appropriately associates the data received from the first terminal 4 and the second terminal 5, respectively, and identifies the combination of the first target and the second target for which the setting of the correspondence relationship is requested.

[0189] In step SC10, the control unit 11 of the management server 1 operates as a matching unit 111 and matches the first certificate C1 of the first target with the valid first time-limited certificate C10. The control unit 11 also matches the second certificate C2 of the second target with the valid second time-limited certificate C20. In step SC101, the control unit 11 judges whether or not the matching of the first target and the second target is successful. If the matching of the first target and the second target is successful, the control unit 11 proceeds to the next step SC20. On the other hand, if the matching of at least one of the first target and the second target is not successful, the control unit 11 skips the process of step SC20 and proceeds to step SC30. Note that if the first time-limited certificate C10 / second time-limited certificate C20 has expired due to the expiration of the validity period, the matching of the first target / second target is not successful.

[0190] In step SC20, the control unit 11 operates as the setting unit 112 and sets a correspondence relationship between the first identifier I10 and the second identifier I20. In one example, the control unit 11 generates linking information D10 indicating the correspondence relationship between the first identifier I10 and the second identifier I20, and stores the generated linking information D10. In step SC30, the control unit 11 operates as the notification unit 114 and transmits a notification indicating a result of the process of setting the correspondence relationship to at least one of the first terminal 4 and the second terminal 5. When the notification of the result is completed, the processing procedure regarding the linking setting according to this operation example ends.

[0191] The above process is merely an example, and each step may be modified as much as possible. Furthermore, steps may be omitted, replaced, or added as appropriate in accordance with the embodiment.

[0192] For example, the order of issuing the first time-limit certificate C10 and the second time-limit certificate C20 is not particularly limited and may be changed as appropriate depending on the embodiment. Either the first time-limit certificate C10 or the second time-limit certificate C20 may be issued first. The process of issuing the first time-limit certificate C10 (step SA10 to step SA30) and the process of issuing the second time-limit certificate C20 (step SB10 to step SB30) may be executed at least partially in parallel. The order of transmitting the issued time-limit certificates (C10, C20) is not limited to the above example. Each server (2, 3) may transmit each time-limit certificate (C10, C20) to each terminal (4, 5) and the management server 1 at least partially in parallel. Each server (2, 3) may transmit each time certificate (C10, C20) to the management server 1 before each terminal (4, 5). When the first server 2 generates the first time-limited certificate C10 spontaneously, the process of step SA10 may be omitted. When the second server 3 generates the second time-limited certificate C20 spontaneously, the process of step SB10 may be omitted.

[0193] Also, for example, the process of step SA50 may be executed at any timing after step SA40. The process of step SB50 may be executed at any timing after step SB40. The processes of steps SA40 and SA50 may be executed at least partially in parallel with the processes of steps SB40 and SB50. The process of step SA50 may be executed prior to step SB40. The process of step SB50 may be executed prior to step SA40. The process of step SA20 may be executed at any timing prior to step SA40. The process of step SB20 may be executed at any timing prior to step SB40. The process of step SA30 may be executed prior to step SA50, or may be executed after step SA50 in response to an inquiry from the management server 1. The process of step SB30 may be executed prior to step SB50, or may be executed after step SB50 in response to an inquiry from the management server 1. It may also be performed in response to a query.

[0194] Furthermore, the transmission form of data used for authentication is not limited to the first divided transmission pattern, and may be appropriately selected according to the embodiment. In another example, the transmission form of data used for authentication may be any of the above transmission forms other than the first divided transmission pattern (the second to fourth divided transmission patterns, other divided transmission, and batch transmission). In response to this, the processes of steps SA40, SA50, SB40, and SB50 may be appropriately changed.

[0195] (Unlink) Fig. 8C shows an example of a processing procedure for canceling a link by the management system 100 according to this embodiment. The following processing procedure is an example of a management method executed by a computer. Note that the example of Fig. 8C assumes a situation in which the authentication process is omitted and a cancellation request is sent directly from the first terminal 4 to the management server 1.

[0196] In step SZ10, the control unit 41 of the first terminal 4 operates as the cancellation request unit 414 and transmits a request (demand) to cancel the correspondence relationship to the management server 1. In response to this, the control unit 11 of the management server 1 receives the cancellation request. The correspondence relationship to be requested to be cancelled may be designated as appropriate. The trigger for the cancellation request may be selected as appropriate depending on the embodiment.

[0197] In step SZ20, the control unit 11 operates as the release unit 113 and releases the correspondence specified by the received release request. The release may be configured by generating information indicating the release and recording the generated information. In one example, when the linking information D10 has the configuration of FIG. 3A, the control unit 11 may release the target correspondence by adding a release time to the corresponding linking information D10 or setting a release flag. When the linking information D10 is configured on a blockchain platform, the control unit 11 may release the target correspondence by generating a transaction indicating the release of the link and adding the generated transaction to the blockchain.

[0198] In step SZ30, control unit 11 operates as notification unit 114 and transmits the processing result of the association release to first terminal 4. When the notification of the result is completed, the processing procedure for association release according to this operation example ends.

[0199] The above process is merely an example, and each step may be modified as much as possible. Furthermore, steps may be omitted, replaced, or added as appropriate in accordance with the embodiment.

[0200] For example, as described above, the transmission route of the release request is not limited to the example of FIG. 8C, and may be appropriately selected depending on the embodiment. The release request may be transmitted from the second terminal 5 (release request unit 514). The process of the release request may include authentication processing of at least one of the first target and the second target. Furthermore, the control unit 11 of the management server 1 may operate as the release unit 113 instead of the above step SZ20, and release the correspondence relationship when a predetermined release condition is met.

[0201] [Features] In this embodiment, in response to the occurrence of a usage relationship between a first target and a second target, authentication of each of the first target and the second target is performed using a time-limited certificate (C10, C20) by the process of step SC10. Each time-limited certificate (C10, C20) is configured to expire after the expiration date. This makes it possible to prevent the same time-limited certificate from being used permanently, which is expected to ensure security. Also, in step When authentication of both the first and second targets is established by processing of the SC20, a correspondence relationship between the first and second identifiers is set. By recording this association setting (association information D10), the usage relationship between the first and second targets can be traced. Therefore, according to this embodiment, the usage relationship between the first and second targets can be traced while ensuring security.

[0202] [4 Variations] Although the embodiment of the present disclosure has been described in detail above, the above description is merely an example of the present disclosure in every respect. It goes without saying that various improvements or modifications can be made without departing from the scope of the present disclosure. For example, the following modifications are possible. In the following, the same reference numerals are used for the same components as in the above embodiment, and the description of the same points as in the above embodiment is omitted as appropriate. The following modifications can be combined as appropriate.

[0203] <4.1> In the above embodiment, as one of the use cases, the linking information D10 may be used to exercise authority associated with one of the first and second objects from the other. In the examples of Figs. 2 and 5, as one example of the use form, a scene is assumed in which one object (user) exercises its authority through the other object (use object / mobile body). However, the form in which authority is exercised is not limited to such an example. In another example, the management system 100 may be configured so that the first object can exercise the authority of the other first object through the second object. And / or, the management system 100 may be configured so that the second object can exercise the authority of the other second object through the first object. That is, a proxy individual of one of the first and second objects may be configured so that the proxy request individual (target individual) of the one object can exercise the authority of the proxy request individual through the other object (any individual of the other object). In the examples of Figs. 2 and 5, the management system 100 may be configured so that a proxy user can exercise the authority of the target user (proxy requester) from the use object (mobile body).

[0204] The method of proxying the authority may be configured appropriately. As an example, the method of proxying the authority may employ any of the following three methods. In the following, for convenience of explanation, a case is assumed in which the first object and the second object are a user and a use object (moving object). That is, each proxy pattern in the examples of FIG. 2 and FIG. 5 will be explained. However, the scope of application of each proxy pattern may not be limited to a case in which the first object and the second object are a user and a use object. In addition, in each of the following proxy patterns, the user (first object) may be read as one of the first object and the second object, and the use object (second object) may be read as the other of the first object and the second object. Typically, the use object may be the above-mentioned moving object.

[0205] (1) First proxy pattern (proxy authentication / proxy linking) As a first proxy pattern, the management system 100 may be configured to set a correspondence relationship between the target user (proxy requester) and the usage object (second object) in response to authentication of the target user (first object) and the usage object (second object) being established through a proxy authentication process by the proxy user. The management system 100 may then be configured to permit the proxy user to proxy exercise the authority associated with the target user via the usage object while this correspondence relationship is set. The proxy user is an example of a proxy individual, and the target user (proxy requester) is an example of a proxy request individual (target individual).

[0206] That is, the user terminal related to the user (first terminal 4 in the example of FIG. 2) may be a proxy user terminal possessed by a proxy user who represents the user. In this case, when a usage relationship between the first object and the second object occurs, data exchange may be appropriately performed between the target user terminal, the proxy user terminal, and the loaded terminal. In one example, the usage relationship between the first object and the second object is realized by data communication between the target user terminal possessed by the user and the proxy user terminal, and This may occur at least via data communication between the proxy user terminal and the payload terminal.

[0207] The method of proxy authentication is not particularly limited and may be set appropriately according to the embodiment. The method of proxy authentication may be configured so that at least a part of the authentication process of the target user (first target) and the usage object (second target) in the above embodiment is executed by the proxy user terminal instead of the target user terminal. As an example, the method of proxy authentication may adopt one of the following two methods.

[0208] (1-1) Substitute pattern 1-1 FIG. 9 is a schematic diagram showing an example of a process of linking in a proxy pattern 1-1 according to this embodiment. FIG. 10 is a diagram showing an example of a processing procedure of linking in a proxy pattern 1-1 according to this embodiment. In the examples of FIGS. 9 and 10, the first terminal 4A is a proxy user terminal, and corresponds to the first terminal 4 in the examples of FIGS. 2 and 5 of the above embodiment. The first target is a target user (proxy requester) who requests a proxy. The target user terminal 6A is a terminal possessed by the target user. The hardware configurations of the first terminal 4A and the target user terminal 6A may be similar to the first terminal 4 and the like in the above embodiment. In the examples of FIGS. 9 and 10, a scene is assumed in which a first pattern of divided transmission is adopted as a transmission form of data used for authentication, the first identifier I10 passes through the first terminal 4A, and the first certificate C1 does not pass through the first terminal 4A.

[0209] First, the processes of steps SA10 to SA30 may be executed between the target user terminal 6A and the first server 2 in the same manner as in the above embodiment. As a result of the execution, a first time certificate C10 is issued, and the issued first time certificate C10 is notified to the target user terminal 6A and the management server 1. Furthermore, steps SB10 to SB30 may be executed between the second terminal 5 and the second server 3 in the same manner as in the above embodiment. As a result of the execution, a second time certificate C20 is issued, and the issued second time certificate C20 is notified to the second terminal 5 and the management server 1.

[0210] In step SD10, the control unit of the target user terminal 6A operates as a proxy designation unit and accepts the designation of a proxy user for the target user. The proxy user may be designated as appropriate. In a typical example, the target user terminal 6A may store an address book, and a proxy user may be selected from users registered in the address book. In another example, the target user terminal 6A may access a list of users via an external computer such as the first server 2, and accept the selection of a proxy user from users registered in the list. When a proxy user is designated, the control unit of the target user terminal 6A operates as a notification unit, exchanges data with the first terminal 4A of the proxy user designated by the target user, and notifies the target user that proxy authority has been granted. In response to this, the control unit of the first terminal 4A of the proxy user receives a notification of the grant of proxy authority from the target user terminal 6A. In one example, this notification may include the first identifier I10 (user identifier) ​​and contact information of the target user. The contact information may include a telephone number, an email address, account information for a contact application (e.g., a Social Networking Service application, etc.), an identification number, and a user ID. The proxy user terminal 6A may be a number or the like. As with the data exchange between the first terminal 4 and the second terminal 5, the data exchange between the target user terminal 6A and the first terminal 4A may be performed by wireless or wired data communication, or may be performed by a method other than data communication, such as reading a two-dimensional code. The target user terminal 6A may directly give the notice of the grant of the proxy authority to the first terminal 4A, or may indirectly send it via an external computer such as the first server 2. When data communication is adopted as a method of data exchange, the notice of the grant of the proxy authority is an example of data communication between the target user terminal and the proxy user terminal possessed by the user. As a result, the target user terminal 6A grants the authority to authenticate on behalf of the first terminal 4A, and causes the first terminal 4A to execute a process of setting a correspondence relationship with the object of use.

[0211] In step SAB400A, the control unit of the first terminal 4A of the proxy user who has been granted proxy authority operates as a data exchange unit and executes data exchange with the second terminal 5. The control unit 51 of the second terminal 5 operates as a data exchange unit 512 and executes data exchange with the first terminal 4A. As with the data exchange between the first terminal 4 and the second terminal 5, the data exchange between the first terminal 4A and the second terminal 5 may be performed by wireless or wired data communication, or may be performed by a method other than data communication, such as reading a two-dimensional code. When data communication is adopted as the method of data exchange, the data exchange between the first terminal 4A and the second terminal 5 is an example of data communication between a proxy user terminal and a loading terminal.

[0212] In step SD20, the control unit of the first terminal 4A provides the first identifier I10 and the contact information to the second terminal 5. In response to this, the control unit 51 of the second terminal 5 acquires the first identifier I10 and the contact information from the proxy user. As a result, the first terminal 4A causes the second terminal 5 to notify the target user terminal 6A of an approval request for proxy association including an inquiry about the first certificate C1 of the target user, and to transmit to the management server 1 a request for association setting including an authentication request composed of the acquired first certificate C1 and the first identifier I10. Note that the method by which the second terminal 5 acquires these is not limited to this example. In another example, at least one of the first identifier I10 and the contact information may be input to the second terminal 5 by the proxy user operating the second terminal 5.

[0213] In step SD30, the control unit 51 of the second terminal 5 operates as a data exchange unit 512 and notifies the target user terminal 6A of an approval request for proxy association including an inquiry about the first certificate C1. In response to this, in step SA40A, the control unit of the target user terminal 6A accepts an operation from the target user as to whether or not to approve the proxy association. In response to the target user performing an operation for approval, the control unit of the target user terminal 6A operates as a data exchange unit and provides the second terminal 5 with the result of approval of the proxy association and the first certificate C1 of the target user. As a result, the target user terminal 6A causes the second terminal 5 to cooperate with the first terminal 4A and send a request for association setting to the management server 1. On the other hand, if the target user does not approve, the processing procedure for association setting by proxy authentication may be terminated as appropriate.

[0214] Basically, the data exchange in step SD30 and step SA40A may be performed by direct or indirect data communication using wireless or wired communication. In step SA40A, the control unit of the target user terminal 6A may directly or indirectly transmit the first time-limited certificate C10 issued by the first server 2 to the second terminal 5 as the first certificate C1. However, the method of data exchange between the second terminal 5 and the target user terminal 6A is not limited to this example, and in some cases, a method other than data communication, such as reading a two-dimensional code, may be used.

[0215] In step SB40, similarly to the above embodiment, the control unit of the second terminal 5 provides the second identifier I20 and the second certificate C2 to the first terminal 4A. The control unit of the first terminal 4A appropriately acquires the second identifier I20 and the second certificate C2 from the object of use. As a result, the second terminal 5 may cause the first terminal 4A to transmit a request for linking setting, including an authentication request composed of the second identifier I20 and the second certificate C2, to the management server 1.

[0216] In step SB50, the control unit of the first terminal 4A operates as a setting request unit and transmits a binding setting request including the second identifier I20 and the second certificate C2 to the management server 1. In step SA50, the control unit 51 of the second terminal 5 operates as a setting request unit 513 and transmits a binding setting request including the first identifier I10 and the first certificate C1 to the management server 1. In response to this, the management server 1 receives the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2.

[0217] After this, the management server 1 executes the processes from step SC10 onward in the same manner as in the above embodiment. As a result of the execution, if the matching of each certificate (C1, C2) and each time-limited certificate (C10, C20) is established, a correspondence relationship between the target user (first identifier I10) and the use object (second identifier I20) is established. When the correspondence relationship is established, the processing procedure for setting up a link by proxy authentication is completed. While the correspondence relationship is established, the proxy user can exercise the authority of the target user (proxy requester) from the use object.

[0218] In the above-mentioned proxy pattern 1-1, the notification route of the first identifier I10 and the first certificate C1 may not be limited to the above-mentioned example. The first identifier I10 may be notified directly or indirectly from the target user terminal 6A to the second terminal 5 without passing through the first terminal 4A at any timing such as step SA40A. In this case, the first identifier I10 may be omitted from the notification of the grant of the proxy authority. Also, the first certificate C1 may be given to the first terminal 4A at any timing such as step SD10. As a result, the first certificate C1 may be given from the first terminal 4A to the second terminal 5. In this case, the first certificate C1 may be omitted from the data given to the second terminal 5 in step SA40A. Also, the approval process of the proxy association may be omitted. When adopting a form in which the approval process of the proxy association is omitted and the first certificate C1 is given from the first terminal 4A to the second terminal 5, the processes of step SD30 and step SA40A may be omitted. In this case, the contact information of the target user may be omitted from the notification of the grant of the proxy authority and the data provided to the second terminal 5 in step SD20.

[0219] In addition, in the above-mentioned 1-1 proxy pattern, the transmission form of data used for authentication is not limited to the first pattern of divided transmission, and may be appropriately selected according to the embodiment. In another example, the transmission form of data used for authentication may adopt a form other than the first pattern of divided transmission among the above-mentioned transmission forms (the second to fourth patterns of divided transmission, other divided transmission, and batch transmission). In response to this, the processes of steps SD10 to SD30, step SA40A, step SA50, step SB40, and step SB50 may be appropriately changed. When adopting a form in which the second terminal 5 transmits at least a part of the target user's data (the first identifier I10 and the first certificate C1), the second terminal 5 may obtain the target user's data via the first terminal 4A, or may obtain the data from the target user (the target user terminal 6A) without passing through the first terminal 4A, as in the above. When the first terminal 4A transmits at least a part of the data of the target user, the first terminal 4A may acquire the data of the target user via the second terminal 5, or may acquire the data from the target user (target user terminal 6A) without passing through the second terminal 5. For example, the first terminal 4A may acquire the data of the target user via the second terminal 5 through the route of step SA40A and step SB40. The first terminal 4A may acquire the data of the target user from the target user (target user terminal 6A) through the route of step SD10 without passing through the second terminal 5. When the first terminal 4A transmits at least a part of the data of the usage object (the second identifier I20 and the second certificate C2), the first terminal 4A may appropriately acquire the data of the usage object from the usage object, similarly to the above. Similarly, the second terminal 5 may appropriately acquire the data of the usage object. In either form, if approval of proxy association is omitted and a form in which the target user terminal 6A provides data to the second terminal 5 is not adopted, the processes of steps SD30 and SA40A may be omitted.

[0220] Furthermore, in the above-mentioned proxy pattern 1-1, in step SD10, along with the designation of the proxy user, at least one of the expiration date of the proxy exercise and the authority (valid authority) permitting the proxy exercise may be designated. In response to this, designation information configured to indicate at least one of the designated expiration date and the valid authority may be generated. The designation information of at least one of the designated expiration date and the valid authority may be managed appropriately. In one example, the designation information may be transmitted from the target user terminal 6A to the first server 2, and may be associated with the first target information O10 (user information O10A) and managed in the first server 2. The first server 2 may notify the management server 1 of the designation information as appropriate. In another example, the designation information may be transmitted to the target user via at least one of the first terminal 4A and the second terminal 5 (i.e., together with the transmission of data used for authentication), The target user terminal 6A may notify the management server 1 of the specified information, and the management server 1 may manage the specified information in association with the associated information D10. In yet another example, the specified information may be directly or indirectly transmitted from the target user terminal 6A to the management server 1, and the specified information may be managed by the management server 1. In this case, similar to the divided transmission mode, the management server 1 may appropriately associate the specified information with the data used for authentication received from at least one of the first terminal 4A and the second terminal 5. The method of association may be similar to the method of association in the divided transmission mode. In one example, the data and the specified information received from at least one of the first terminal 4A and the second terminal 5 may include proxy information as shared information, and the data used for authentication may be associated with the specified information using this proxy information. The proxy information may be any information related to the proxy user. The proxy information may include, for example, attribute information of the proxy user (for example, personal information such as name, address, age, sex, contact information, etc.), identification information (for example, account name, identifier, etc.), etc. The proxy information may include unique information of the proxy. The unique information may be composed of any information, such as information derived from each object, information derived from each terminal, temporarily generated information, or information generated by any other method. The information derived from each object may be, for example, biometric information, uniquely assigned identification information, etc. The biometric information may be, for example, a face image, a fingerprint, a voiceprint, etc. The temporarily generated information may be the same as each of the time-limited certificates (C10, C20) described above. The information generated by any other method may include, for example, a password, a passcode, or other information other than a symbol string. The timing for specifying the valid authority and the expiration date need not be limited to step SD10. At least one of the valid authority and the expiration date may be specified at any timing before the correspondence is released.

[0221] In the above-mentioned proxy pattern 1-1, the first terminal 4A may directly transmit the proxy information to the management server 1, or may indirectly transmit the proxy information via an external computer such as the second terminal 5. For example, the first terminal 4A may transmit the proxy information to the management server 1 in step SB50. The first terminal 4A may provide the proxy information to the second terminal 5 during data exchange and cause the second terminal 5 to transmit the proxy information to the management server 1. In this way, the management server 1 may distinguish whether the set correspondence is due to proxy association by generating the linking information D10 including the proxy information. Since the linking information D10 includes the proxy information, the proxy user who set the correspondence can be tracked. Using this proxy information, the user who can exercise the authority of the target user by proxy may be limited to the designated proxy user (user identified by the proxy information). Note that the method of distinguishing whether the correspondence is due to proxy association is not limited to this example. In another example, it may be possible to appropriately distinguish whether the request is due to proxy association in the data from each terminal (4, 5). In response to this, the management server 1 may generate association information D10 including information indicating whether or not the correspondence relationship is set by proxy association.

[0222] Also, in the above proxy pattern 1-1, the second terminal 5 may acquire the proxy information from the first terminal 4A. Then, when requesting approval of the proxy association in step SD30, the second terminal 5 may notify the target user terminal 6A of the acquired proxy information. This allows the target user to be informed of the proxy user performing the proxy association. In addition, in step SD10, the target user terminal 6A may generate designated proxy information indicating the designated proxy. The proxy information notified from the second terminal 5 may correspond to this designated proxy information. The target user terminal 6A may determine whether the proxy user performing the proxy association and the designated proxy user match by comparing the designated proxy information with the proxy information notified from the second terminal 5. When it is determined that the proxy user performing the proxy association and the designated proxy user match, the target user terminal 6A may automatically give the second terminal 5 an approval notice of the proxy association including the first certificate, or may permit the target user to perform an approval operation. It should be noted that the second terminal 5 does not necessarily have to acquire the proxy information from the first terminal 4A. For example, the second terminal 5 may acquire the proxy information from the proxy user without using the first terminal 4A, for example, by taking a picture of the proxy user with an image sensor. The verification of the proxy user and the notification of approval including the first certificate C1 do not necessarily have to be performed on the target user terminal 6A. At least one of the verification of the proxy user and the notification of approval may be performed on an external computer such as the first server 2.

[0223] The designated proxy information may include authentication information, and the proxy information may include proxy authentication information corresponding to the authentication information. The authentication information may be the same as the unique information. In one example, the authentication information may be temporarily generated information composed of, for example, a timestamp, a random number, a hash value, or the like. In this case, the authentication information may be appropriately generated by the target user terminal 6A or an external computer when the proxy is designated in step SD10. The target user terminal 6A may provide the authentication information to the first terminal 4A at any timing such as step SD10. The first terminal 4A may hold the authentication information as proxy authentication information and provide the proxy information including the proxy authentication information to the second terminal 5. Then, by matching the authentication information with the proxy authentication information, it may be determined whether the proxy user performing the proxy association and the designated proxy user match. A method for matching the designated proxy information and the proxy information may be appropriately selected according to the embodiment. In one example, the success or failure of the matching may be determined according to the degree of match between the designated proxy information and the proxy information. A trained model generated by machine learning may be used for the matching. When comparing, the designated agent information and the agent information may be compared directly, or may be compared indirectly after being converted into features, etc. In another example, the method of comparing the designated agent information and the agent information may be the same as the method of comparing the certificates described above.

[0224] In addition, in the above-mentioned proxy pattern 1-1, if there is no response from the target user terminal 6A within a certain period of time after notifying the approval request in step SD30, the second terminal 5 may notify the target user terminal 6A of a reminder to prompt the response in step SA40A. In addition, the approval process of the proxy association using the designated proxy information and the proxy information may be executed in an external computer such as the first server 2, not in the target user terminal 6A. In this case, when the proxy user is designated in step SD10, the designated proxy information may be provided to the external computer. If there is no response from the target user terminal 6A, the second terminal 5 may substitute the approval process by inquiring of this external computer. In addition, the first certificate C1 may also be provided to the external computer, and the second terminal 5 may acquire the first certificate C1 from the external computer in response to the proxy association being approved.

[0225] In addition, in the above-mentioned 1-1 proxy pattern, the correspondence relationship set in response to a proxy matching request may be appropriately released. As in the above-mentioned embodiment, the management server 1 may be configured to release the correspondence relationship upon receiving a release request from at least one of the first terminal 4A and the second terminal 5 or upon the establishment of a predetermined release condition. The release request and the predetermined release condition according to the above-mentioned embodiment may also be applied to this modified example. In addition, in this modified example, a predetermined release condition may be set in response to at least one of the expiration date and the valid authority of the proxy authority. For example, the release condition may be defined to release the correspondence relationship in response to the arrival of a specified expiration date. Also, the release condition may be defined to release the correspondence relationship by the exercise of the specified valid authority (i.e., the authority is extinguished / invalidated). Also, the release condition may be defined to release the previous correspondence relationship by proxy matching when the target user attempts to set a correspondence relationship with the use object in order to exercise the valid authority himself, resulting in a duplication of the settings of the correspondence relationship for the target user.

[0226] Furthermore, the management server 1 may be configured to cancel the correspondence in response to receiving a cancellation request from the target user terminal 6A. The target user terminal 6A may send the cancellation request directly to the management server 1, or indirectly via an external computer such as the first server 2. As in the above embodiment, the cancellation request from the target user terminal 6A may include at least one of the first identifier I10 and the second identifier I20 that specify cancellation, or may not include both the first identifier I10 and the second identifier I20. Furthermore, the proxy matching may be performed. When it is identified whether the correspondence relationship was established by proxy matching, the cancellation request from the target user terminal 6A may include only the first identifier I10, without including the second identifier I20, thereby specifying that the correspondence relationship established by proxy matching specified by the first identifier I10 should be cancelled.

[0227] In addition, in the above-mentioned proxy pattern 1-1, after the setting process of the correspondence relationship by proxy matching is completed, the control unit 11 of the management server 1 may operate as a notification unit 114 and directly or indirectly transmit a notification indicating the execution result of the setting process by proxy matching to at least one of the first terminal 4A, the second terminal 5, and the target user terminal 6A. When directly notifying the target user terminal 6A, the management server 1 may acquire the contact information of the target user terminal 6A at any timing. In one example, when adopting a form in which the contact information of the target user terminal 6A is exchanged between the first terminal 4A and the second terminal 5, at least one of the first terminal 4A and the second terminal 5 may transmit the contact information of the target user terminal 6A to the management server 1 at the time of the linking request. When adopting a form in which the target user terminal 6A performs data communication with the management server 1, the management server 1 may acquire the contact information of the target user terminal 6A in this data communication.

[0228] The processing procedure of FIG. 10 is merely an example, and each step may be changed as much as possible. In addition, the above processing procedure may be omitted, replaced, or added as appropriate according to the embodiment. For example, when adopting a form in which the first certificate C1 is notified from the target user terminal 6A to the second terminal 5 by the processing of step SA40A, the processing of steps SA10 to SA20 may be executed at any timing before step SA40A. The processing of steps SB10 to SB20 may be executed at any timing before step SB40. Step SB50 may be executed at any timing after step SB40. When not waiting until completion of the proxy approval, the processing of steps SB40 and SB50 may be executed at any timing after starting data exchange with the first terminal 4A. The processing of steps SB40 and SB50 may be executed before step SD20. The processing of step SB40 may be executed before step SD20, and the processing of step SB50 may be executed after step SD20. When at least one of the first certificate C1 and the first identifier I10 is notified in the process of step SA40A, the process of step SA50 may be executed at any timing after step SA40A. The process of step SA50 may be executed prior to step SB40.

[0229] (1-2) Substitute pattern 1-2 FIG. 11 is a schematic diagram showing an example of a process of linking in the 1-2 proxy pattern according to the present embodiment. FIG. 12 is a diagram showing an example of a processing procedure of linking in the 1-2 proxy pattern according to the present embodiment. In the examples of FIG. 11 and FIG. 12, the first terminal 4B is a proxy user terminal, and corresponds to the first terminal 4 in the examples of FIG. 2 and FIG. 5 of the above embodiment and the first terminal 4A in the 1-1 proxy pattern. The first target is a target user (proxy requester) who requests a proxy. The target user terminal 6B is a terminal possessed by the target user, and corresponds to the target user terminal 6A in the 1-1 proxy pattern. The hardware configurations of the first terminal 4B and the target user terminal 6B may be the same as those of the first terminal 4 in the above embodiment. In the examples of FIG. 11 and FIG. 12, a scene is assumed in which the first pattern of divided transmission is adopted as the transmission form of data used for authentication, and the first identifier I10 and the first certificate C1 are not sent via the first terminal 4B.

[0230] First, steps SA10 to SA30 may be executed between the target user terminal 6B and the first server 2 in the same manner as in the above embodiment. As a result of the execution, a first time certificate C10 is issued, and the issued first time certificate C10 is notified to the target user terminal 6B and the management server 1. Furthermore, steps SB10 to SB30 may be executed between the second terminal 5 and the second server 3 in the same manner as in the above embodiment. As a result of the execution, a second time certificate C20 is issued, and the The second terminal 5 and the management server 1 are notified of the issued second time-limit certificate C20.

[0231] In step SE10, the control unit of the target user terminal 6B operates as a proxy designation unit and accepts the designation of a proxy user from the target user. The control unit of the target user terminal 6B operates as a notification unit and exchanges data with the first terminal 4B of the proxy user designated by the target user, and notifies the target user that the proxy authority has been granted. In response to this, the control unit of the first terminal 4B of the proxy user receives a notification of the grant of proxy authority from the target user terminal 6B. In one example, this notification may include authentication information. The authentication information may be the same as the proxy pattern 1-1 above. For example, the authentication information may be information that is temporarily generated. The first terminal 4B may hold the authentication information included in the received notification as proxy authentication information. Other processes in step SE10 may be the same as those in step SD10 above. When data communication is adopted as a method of data exchange, this notification of the grant of proxy authority is an example of data communication between the target user terminal and the proxy user terminal owned by the user. As a result, the target user terminal 6B grants the first terminal 4B the authority to authenticate on behalf of the first terminal 4B, and causes the first terminal 4B to execute a process of setting a correspondence relationship with the object of use.

[0232] In step SA40B, the control unit of the target user terminal 6B accepts the designation of the usage object for which proxy matching by the proxy user is permitted. The usage object for which proxy matching is permitted may be designated as appropriate according to the embodiment. In one example, the usage object of the second terminal 5, which is the other party of the data exchange, may be designated as the usage object for which proxy matching is permitted by directly exchanging data between the target user terminal 6B and the second terminal 5 using a method such as short-range wireless communication. In another example, the target user terminal 6B may access a list of usage objects via an external computer and designate the usage object for which proxy matching is permitted from the usage objects registered in the list. The list may include information such as identification information of each usage object and contact information of the second terminal 5. The list may be stored in the target user terminal 6B. The usage object may be designated manually by the target user, or may be designated by any information processing such as selecting a usage object that meets a condition. After the use object is designated, the control unit of the target user terminal 6B operates as a data exchange unit and notifies the second terminal 5 of the designated use object of the designated proxy information including the authentication information, the first identifier I10, and the first certificate C1 corresponding to the issued first time-limited certificate C10. The designated proxy information may be acquired as appropriate in response to the designation of the proxy user. The designated proxy information may be the same as the proxy pattern 1-1. In response to this, the second terminal 5 of the designated use object receives the designated proxy information including the authentication information, the first identifier I10, and the first certificate C1. Note that, in order for the proxy user to identify the use object designated, the information of the designated use object may be provided to the first terminal 4B from the target user terminal 6B or an external computer as appropriate. By the process of this step SA40B, the target user terminal 6B causes the second terminal 5 of the designated use object to execute a process of verifying the authenticity of the proxy user in response to the use application of the use object, and causes it to cooperate with the first terminal 4B of the proxy user and transmit a request for linking setting to the management server 1.

[0233] In step SAB400B, the control unit of the first terminal 4B of the proxy user who has been granted proxy authority operates as a data exchange unit and executes data exchange with the second terminal 5 of the specified object. The control unit 51 of the second terminal 5 operates as a data exchange unit 512 and executes data exchange with the first terminal 4B. The method of data exchange in step SAB400B may be the same as that in step SAB400A above. When data communication is adopted as the method of data exchange, the data exchange between the first terminal 4B and the second terminal 5 is an example of data communication between a proxy user terminal and a loading terminal.

[0234] In step SE20, the control unit of the first terminal 4B applies for use of the use object by providing the second terminal 5 with proxy information including proxy authentication information. As a result, the first terminal 4B makes the second terminal 5 verify the authenticity of the proxy, and in response to the verification of the proxy, manages a request for linking setting using the first identifier I10 and the first certificate C1 held by the first terminal 4B. The data is sent to server 1.

[0235] In step SE201, the control unit 51 of the second terminal 5 verifies the authenticity of the proxy user by comparing the proxy information included in the usage application with the designated proxy information received from the target user terminal 6B (i.e., executes authentication processing of the proxy user). Matching the proxy information with the designated proxy information includes matching the proxy authentication information with the authentication information. The control unit 51 of the second terminal 5 determines whether the proxy user has been verified based on the result of the comparison. If the proxy user has been verified, the control unit 51 of the second terminal 5 permits the proxy user to use the service object and enables subsequent processing related to proxy association. On the other hand, if the proxy user has not been verified, the processing procedure for setting association by proxy authentication may be terminated as appropriate.

[0236] In step SB40, similarly to the above embodiment, the control unit of the second terminal 5 provides the second identifier I20 and the second certificate C2 to the first terminal 4B. The control unit of the first terminal 4B appropriately acquires the second identifier I20 and the second certificate C2 from the object of use. As a result, the second terminal 5 may cause the first terminal 4B to transmit to the management server 1 a request for linking setting, including an authentication request configured by the second identifier I20 and the second certificate C2.

[0237] In step SB50, the control unit of the first terminal 4B operates as a setting request unit and transmits a binding setting request including the second identifier I20 and the second certificate C2 to the management server 1. In step SA50, the control unit 51 of the second terminal 5 operates as a setting request unit 513 and transmits a binding setting request including the first identifier I10 and the first certificate C1 to the management server 1. In response to these, the management server 1 receives the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2.

[0238] Thereafter, the management server 1 may execute the processes from step SC10 onwards, as in the above embodiment. As a result of the execution, if matching of each certificate (C1, C2) and each time-limited certificate (C10, C20) is established, a correspondence relationship between the target user (first identifier I10) and the use object (second identifier I20) is set. When the correspondence relationship is set, the processing procedure for setting association by proxy authentication ends. While the correspondence relationship is set, the proxy user can exercise the authority of the target user (proxy requester) from the use object.

[0239] In the above-mentioned 1-2 proxy pattern, the notification path of the first identifier I10 and the first certificate C1 is not limited to the above-mentioned example. At least one of the first identifier I10 and the first certificate C1 may be provided to the second terminal 5 via the first terminal 4B. In this case, at least one of the first identifier I10 and the first certificate C1 may be omitted from the data provided to the second terminal 5 in step SA40B.

[0240] In addition, in the above-mentioned 1-2 proxy pattern, the transmission form of data used for authentication is not limited to the first pattern of divided transmission, and may be appropriately selected according to the embodiment. In another example, the transmission form of data used for authentication may adopt a form other than the first pattern of divided transmission among the above-mentioned transmission forms (the second to fourth patterns of divided transmission, other divided transmission, and batch transmission). In response to this, the processes of steps SE10, SE20, SA40B, SA50, SB40, and SB50 may be appropriately changed. When adopting a form in which the second terminal 5 transmits at least a part of the target user's data (the first identifier I10 and the first certificate C1), the second terminal 5 may obtain the target user's data via the first terminal 4B, or may obtain the data from the target user (the target user terminal 6B) without passing through the first terminal 4B, as in the above. When the first terminal 4B transmits at least a part of the data of the target user, the first terminal 4B may obtain the data of the target user via the second terminal 5, or may obtain the data from the target user (target user terminal 6B) without passing through the second terminal 5. For example, the first terminal 4B may perform steps SA40B and S The first terminal 4B may acquire the data of the target user via the second terminal 5 via the route of step SE10, without passing through the second terminal 5. When adopting a form in which the first terminal 4B transmits at least a portion of the data of the usage object (second identifier I20 and second certificate C2), the first terminal 4B may acquire the data of the usage object from the usage object as appropriate, similar to the above. Similarly, the second terminal 5 may acquire the data of the usage object as appropriate.

[0241] Also, in the above-mentioned proxy pattern 1-2, the use object in step SA40B may typically be specified as a specific individual. However, the method of specifying the use object may not be limited to this example. In another example, the use object may not be specified as a specific individual, but may be specified in any range, such as belonging to a specific management organization. In this case, the data sent in advance, such as the designated agent information, may be held in an external computer such as the first server 2. The second terminal 5 may download data from the target user terminal 6B from the external computer as a pre-processing of step SE20. The data to be downloaded may be selected as appropriate. For example, the target user may be specified by an operation by the proxy user, data from the first terminal 4B, etc., and the second terminal 5 may download data corresponding to the specified target user. The target user may be specified as appropriate by the first identifier I10, etc. After downloading the data, the second terminal 5 may accept a use application by the proxy user and execute the processing of step SE201 and subsequent steps. In addition, even when the usage object is specified as a specific individual, the second terminal 5 may download data from the target user terminal 6B when the proxy user uses the usage object. For example, when the usage period of the usage object by the proxy user is specified in advance, the second terminal 5 may download data from the target user terminal 6B before the usage period arrives.

[0242] The processing procedure of FIG. 12 is merely an example, and each step may be changed as much as possible. In addition, the above processing procedure may be omitted, replaced, or added as appropriate according to the embodiment. For example, when adopting a form in which the first certificate C1 is notified from the target user terminal 6B to the second terminal 5 by the processing of step SA40B, the processing of steps SA10 to SA20 may be executed at any timing before step SA40B. The processing of steps SB10 to SB20 may be executed at any timing before step SB40. The notification of the grant of the power of attorney in step SE10 may be executed after step SA40B. The processing of step SE10 and the processing of step SA40B may be executed at least partially in parallel. The processing of step SA40B may be executed before step SE10. The processing of step SA50 may be executed at any timing after step SE201. The processing of step SA20 may be executed before step SB40. The process of step SA50 and the processes of steps SB40 and SB50 may be performed at least partially in parallel.

[0243] In addition, the configuration of the above-mentioned 1-1 proxy pattern may be applied as appropriate to the configuration of the 1-2 proxy pattern other than the above. For example, at least one of the expiration date of the proxy exercise and the authority (valid authority) that permits the proxy exercise may be specified in the 1-2 proxy pattern as well. The management server 1 may generate the linking information D10 including the proxy information. The management server 1 may generate the linking information D10 including information indicating whether or not the correspondence relationship is set by proxy linking. The correspondence relationship set in response to a proxy linking request may be released in the same manner as the above-mentioned 1-1 proxy pattern. The control unit 11 of the management server 1 may transmit a notification indicating the execution result of the setting process by proxy linking to at least one of the first terminal 4B, the second terminal 5, and the target user terminal 6B.

[0244] (2) The second proxy pattern As a second proxy pattern, the management system 100 grants proxy authority to the proxy user but The authentication process may be configured to be performed by the target user. That is, the user terminal associated with the user (first terminal 4 in the example of FIG. 2) may be a target user terminal possessed by the target user. In one example, the usage relationship between the first target and the second target may be created by data communication being performed between the target user terminal and the loading terminal through a proxy user terminal possessed by a proxy user who represents the target user.

[0245] FIG. 13 is a schematic diagram showing an example of a process of linking in the second proxy pattern according to the present embodiment. FIG. 14 is a diagram showing an example of a processing procedure of linking in the second proxy pattern according to the present embodiment. In FIG. 13 and FIG. 14, the first target is a target user (proxy requester) who requests a proxy. The first terminal 4C is a target user terminal, and corresponds to the first terminal 4 in the examples of FIG. 2 and FIG. 5 in the above embodiment. The proxy user terminal 6C is a terminal possessed by the proxy user. The proxy user is an example of a proxy individual, and the target user (proxy requester) is an example of a proxy request individual (target individual). The hardware configurations of the first terminal 4C and the proxy user terminal 6C may be the same as those of the first terminal 4 in the above embodiment. In the examples of FIG. 13 and FIG. 14, a scene is assumed in which the first pattern of divided transmission is adopted as the transmission form of data used for authentication.

[0246] First, the processes of steps SA10 to SA30 may be executed between the first terminal 4C and the first server 2 in the same manner as in the above embodiment. As a result of the execution, a first time certificate C10 is issued, and the issued first time certificate C10 is notified to the first terminal 4C and the management server 1. Furthermore, steps SB10 to SB30 may be executed between the second terminal 5 and the second server 3 in the same manner as in the above embodiment. As a result of the execution, a second time certificate C20 is issued, and the issued second time certificate C20 is notified to the second terminal 5 and the management server 1.

[0247] In step SF10, the control unit of the first terminal 4C operates as a proxy designation unit and accepts the designation of a proxy user for the target user. The designation of a proxy user may be performed in the same manner as in step SD10 and the like. When a proxy user is designated, the control unit of the first terminal 4C operates as a notification unit and exchanges data with the proxy user terminal 6C of the designated proxy user, and notifies the grant of proxy authority. In response to this, the proxy user terminal 6C receives a notification of the grant of proxy authority from the first terminal 4C. In one example, this notification may include the contact information of the target user. As with the data exchange between the first terminal 4 and the second terminal 5, the data exchange between the proxy user terminal 6C and the first terminal 4C may be performed by wireless or wired data communication, or may be performed by a method other than data communication, such as reading a two-dimensional code. In addition, the first terminal 4C may directly give the notification of the grant of proxy authority to the proxy user terminal 6C, or may indirectly send it via an external computer such as the first server 2. As a result, the first terminal 4C may cause the proxy user terminal 6C to execute intermediate processing for data exchange with the second terminal 5.

[0248] In step SF20, the control unit of the proxy user terminal 6C operates as a data exchange unit and executes data exchange with the second terminal 5. The control unit 51 of the second terminal 5 operates as a data exchange unit 512 and executes data exchange with the proxy user terminal 6C. As with the data exchange between the first terminal 4 and the second terminal 5, the data exchange between the proxy user terminal 6C and the second terminal 5 may be performed by wireless or wired data communication, or may be performed by a method other than data communication, such as reading a two-dimensional code. The control unit of the proxy user terminal 6C provides the second terminal 5 with the contact information of the target user. As a result, the proxy user terminal 6C causes the second terminal 5 to start data exchange with the first terminal 4C and to transmit a request for linking setting to the management server 1 by coordinating with the first terminal 4C. The processes of steps SF10 and SF20 are an example of an intermediation by a proxy user terminal possessed by a proxy user.

[0249] In step SAB400C, the control unit 51 of the second terminal 5 operates as a data exchange unit 512 and accesses the contact information received from the proxy user terminal 6C to convert the contact information received from the first terminal 4C into a contact information. The control unit of the first terminal 4C operates as a data exchange unit and executes data exchange with the second terminal 5 in response to access from the second terminal 5. Basically, data exchange between the first terminal 4C and the second terminal 5 may be performed by wireless or wired data communication. However, the data exchange in step SAB400C does not necessarily have to be performed by data communication. In another example, data exchange between the first terminal 4C and the second terminal 5 may be performed by a method other than data communication, such as reading a two-dimensional code. In this case, the contact information of the target user may be omitted from the data in steps SF10 and SF20. The processing in step SF20 may simply trigger the data exchange in step SAB400C.

[0250] The processes of step SA40C and step SB40C may be similar to step SA40 and step SB40 in the above embodiment. Step SA50 and step SB50 may be executed similarly to the above embodiment, etc. As a result of the execution, the management server 1 receives the first identifier I10, the first certificate C1, the second identifier I20, and the second certificate C2.

[0251] Thereafter, the management server 1 may execute the processes from step SC10 onwards, as in the above embodiment. As a result of the execution, in response to the successful matching of each certificate (C1, C2) and each time-limited certificate (C10, C20), a correspondence relationship between the target user (first identifier I10) and the use object (second identifier I20) is set. When the correspondence relationship is set, the processing procedure for linking setting by the second proxy pattern ends. While the correspondence relationship is set, the proxy user can exercise the authority of the target user (proxy requester) from the use object.

[0252] The process procedure of FIG. 14 is merely an example, and each step may be changed as much as possible. In addition, the above process procedure may be omitted, replaced, or added as appropriate depending on the embodiment. For example, the processes of steps SA10 to SA20 may be executed at any timing before step SA40C. The processes of steps SB10 to SB20 may be executed at any timing before step SB40C. The process of step SB50 may be executed before step SA40C. When adopting a form in which data exchange between the first terminal 4C and the second terminal 5 is performed by data communication, the processes of steps SA40C and SA50 may be executed at any timing after access from the second terminal 5. The processes of steps SA40C and SA50 may be executed at least partially in parallel with the processes of steps SB40C and SB50. At least a part of the processes of steps SA40C and SA50 may be executed before step SB50. The process of step SA50 may be executed before step SB50. When the first terminal 4C and the second terminal 5 are connected before the process of step SB40C, the processes of steps SA40C and SA50 may be executed prior to step SB40C.

[0253] In addition, the configuration of the above embodiment may be applied as appropriate to the configuration of the second proxy pattern other than the above. For example, the transmission form of data used for authentication may be a form other than the first divided transmission pattern (the second to fourth patterns of divided transmission, other divided transmission, batch transmission) among the above transmission forms. In response to this, the processes of steps SA40C, SA50, SB40C, and SB50 may be changed as appropriate.

[0254] Furthermore, the configurations of the above-mentioned 1-1 proxy pattern and 1-2 proxy pattern may be applied as appropriate to the configurations of the second proxy pattern other than the above. For example, in the second proxy pattern, at least one of the expiration date of the proxy exercise and the authority (valid authority) that permits the proxy exercise may also be specified. The management server 1 may generate linking information D10 including the proxy information. The management server 1 may generate linking information D10 including information indicating whether or not the correspondence relationship is set by proxy linking. The proxy information is transmitted from the proxy user terminal 6C to the second terminal 5. In step SB40C, the information may be provided to the first terminal 4C via the proxy user terminal 6C. In this way, the first terminal 4C may check whether the access from the second terminal 5 is an access mediated by the designated proxy user. The management server 1 may transmit a notification indicating the execution result of the association setting to at least one of the first terminal 4C, the second terminal 5, and the proxy user terminal 6C. The set correspondence relationship may be released in the same manner as in the proxy pattern 1-1 above. In another example, the management server 1 may be configured not to accept a release request from the proxy user terminal 6C. In yet another example, the management server 1 may be configured to accept a release request from the proxy user terminal 6C via the first terminal 4C or the second terminal 5.

[0255] (3) The third proxy pattern The first and second proxy patterns allow the proxy user to exercise the authority of the target user while the correspondence between the target user and the usage object is set. In contrast, as a third proxy pattern, the management system 100 may be configured to allow the target user to exercise the proxy authority granted by another user while the correspondence between the target user and the usage object is set. That is, the management system 100 may be configured to link the proxy requester and the usage object, rather than linking the proxy requester and the usage object. In the third proxy pattern, the user terminal related to the user (the first terminal 4 in the example of FIG. 2) may be the target user terminal possessed by the user. One of the first identifier I10 and the second identifier I20 corresponding to the user (the first identifier I10 in the example of FIG. 2) may be associated with the proxy authority of another user other than the user.

[0256] FIG. 15 is a schematic diagram showing an example of a process of linking in the third proxy pattern according to the present embodiment. FIG. 16 is a diagram showing an example of a procedure for granting proxy authority in the third proxy pattern according to the present embodiment. In FIG. 15 and FIG. 16, the first target is a user to whom proxy authority is granted. The first terminal 4D is a target user terminal, and corresponds to the first terminal 4 in the examples of FIG. 2 and FIG. 5 in the above embodiment. The other user terminal 6D is a terminal possessed by another user (proxy requester) who requests the target user to act as a proxy. Typically, the other user is a user other than the target user who has an account in the same service (first server 2) as the target user. The target user is an example of a proxy individual, and the other user (proxy requester) is an example of a proxy request individual (other individual). The hardware configurations of the first terminal 4D and the other user terminal 6D may be similar to those of the first terminal 4 in the above embodiment.

[0257] First, in step SG10, the control unit of the other user terminal 6D operates as a proxy designation unit and accepts the designation of a proxy user for the proxy requester (other user). The designation of a proxy user may be performed in the same manner as in step SD10 above.

[0258] In step SG101, the control unit of the other user terminal 6D accesses the first server 2. The control unit 21 of the first server 2 operates as an authentication unit and executes user authentication of the other user terminal 6D that has accepted the access. The user authentication may be performed as appropriate. Typically, the authentication process in step SG101 is a login process. When the authentication is established, the control unit 21 of the first server 2 grants the proxy authority to the target user designated as the proxy user in response to a request from the other user terminal 6D. The granting of the proxy authority may be expressed in any data format. In one example, the control unit 21 may associate the information of the proxy requester (for example, the identifier of the proxy requester) with the user information O10A of the target user designated as the proxy user as the process of granting the proxy authority. Associating the information of the proxy requester with the user information O10A of the target user is an example of associating the proxy authority of another user other than the target user with the first identifier I10 of the target user. The management system 100 may be configured as appropriate so that the authority can be exercised in the proxy mode by associating the information of the proxy requester.

[0259] In step SG20, the control unit 21 of the first server 2 detects a user who has been granted the proxy authority of another user. The controller 21 transmits a notification to the first terminal 4D of the target user designated as the proxy user to inform the user that the proxy has been granted. The controller 21 may transmit the notification of the grant of proxy authority directly to the first terminal 4D, or may transmit it indirectly via an external computer such as another user terminal 6D. When the notification of the grant of proxy authority is completed, the procedure of granting proxy authority in the third proxy pattern ends. In one example, the first terminal 4D may execute a linking process for setting a correspondence relationship with the object of use by the target user, regardless of the process of granting proxy authority in FIG. 16. In another example, the notification of the grant of proxy authority may be a trigger to execute the linking process. The process from step SA10 and step SB10 may be executed before the process of steps SG10 to SG20 for granting proxy authority, or may be executed at least partially in parallel with or after the process. A series of processes from step SA10 and step SB10 for setting a correspondence relationship between the target user (first terminal 4D) and the object of use (second terminal 5) may be the same as those in the above embodiment. As a result of executing the association process, if authentication (certificate matching) of both the target user and the use object is established, a correspondence relationship between the target user and the use object is established. When the correspondence relationship is established, the processing procedure for setting the association by the third proxy pattern is completed. While the correspondence relationship is established, the target user (proxy user) can exercise the authority of another user (proxy requester) from the use object.

[0260] The processing procedure in FIG. 16 is merely an example, and each step may be changed as much as possible. In addition, steps may be omitted, replaced, or added as appropriate to the above processing procedure depending on the embodiment. For example, in a case where a list of users is held accessible from the first server 2 and a proxy user is designated on the first server 2, the processing of step SG10 may be executed by the first server 2 via the other user terminal 6D after the other user terminal 6D accesses the first server 2. In this case, the processing of step SG101 may be executed prior to step SG10.

[0261] In addition, the configuration of the above-mentioned 1-1 proxy pattern and the like may be applied as appropriate to the configuration of the third proxy pattern other than the above. For example, in the third proxy pattern as well, the management server 1 may generate the linking information D10 including the proxy information. At least one of the expiration date of the proxy exercise and the authority (valid authority) permitting the proxy exercise may be specified. In this case, the proxy authority granted by another user may be extinguished upon the arrival of the specified valid authority. The granted proxy authority may be extinguished by the exercise of the specified valid authority. In addition, the first server 2 may be configured to delete the proxy authority granted by another user in response to a request from the other user (proxy requester).

[0262] In the third proxy pattern, when the above steps SG10 to SG20 are processed, the first server 2 may issue a time-limited certificate to the other user in relation to the grant of the proxy authority. The validity period of this time-limited certificate may be set according to the expiration date of the proxy authority. This time-limited certificate may be notified to at least one of the first terminal 4D and the management server 1. When exercising the proxy authority, authentication using this time-limited certificate may be performed at any timing. For example, the time-limited certificate of the other user may be included in the notification of the grant of the proxy authority, and the target user may give the external system SY1 a certificate corresponding to the time-limited certificate included in the notification of the grant of the proxy authority in any manner. The external system SY1 may send the certificate to the management server 1 or the first server 2 and request a comparison with the time-limited certificate. When the comparison between the time-limited certificate and the certificate is established, the external system SY1 may permit the proxy exercise of the target authority.

[0263] (Features) According to this modification, each user can exercise the authority of the proxy requester on behalf of the user through the use object. This can increase the scalability of the authority exercise. For example, assume a situation in which the authority information includes information regarding an electronic prescription and the target authority is to receive medicine prescribed by an electronic prescription. In this case, the user does not have to pick up the prescribed medicine himself / herself. Even if the user does not have to be a user himself / herself, by granting proxy authority to another user, such as a taxi driver, the user can request the other user to collect the prescribed medicine via a mobile device.

[0264] <4.2> In the above embodiment, the comparison (authentication of each target) of each certificate (C1, C2) and each time-limited certificate (C10, C20) is performed by the management server 1. However, the entity that performs the comparison process does not need to be limited to the management server 1. In another example, the management server 1 may request each server (2, 3) to perform the comparison process by sending each certificate (C1, C2) to each server (2, 3). In this way, the comparison process may be performed by each server (2, 3).

[0265] Furthermore, in the above embodiment, authentication processing of the first target and the second target is executed in response to a request for linking setting from at least one of the first terminal 4 (4A to 4D) and the second terminal 5. However, the timing of executing the authentication processing is not limited to this example. Before sending a request for linking setting to the management server 1, authentication processing of each target may be executed in advance between at least one of the first terminal 4 (4A to 4D) and the second terminal 5 and each server (2, 3). Furthermore, authentication processing of either the first target or the second target may be omitted.

[0266] For example, the management system may include a first server and a management server. The first server may be configured to issue a first time-limited certificate in relation to a first identifier of a first target, transmit the issued first time-limited certificate to a first terminal of the first target, receive a first certificate corresponding to the first time-limited certificate from a second terminal of a second target in response to the occurrence of a usage relationship between the first target and the second target, compare the received first certificate with the issued first time-limited certificate, and return the result of the comparison to the second terminal. The first time-limited certificate may be configured to be revoked after a validity period. The management server may be configured to set a correspondence relationship between the first identifier and the second identifier in response to a request from the second terminal when the comparison is successful.

[0267] Fig. 17 shows an example of the process of linking according to this modified example. Fig. 18 shows an example of the processing procedure of linking according to this modified example. The examples of Fig. 17 and Fig. 18 assume a situation in which authentication processing of a first target is executed and authentication processing of a second target is omitted.

[0268] First, between the first terminal 4 and the first server 2, the processes of steps SA10 and SA20 may be executed in the same manner as in the above embodiment. As a result of the execution, a first time certificate C10 is issued, and the issued first time certificate C10 is notified to the first terminal 4. At this time, the first server 2 may store the issued first time certificate C10 in association with the first identifier I10 (the corresponding first target information O10 of the first target). That is, the first time certificate C10 may be saved as the first target information O10. The notification to the management server 1 (step SA30) may be omitted. In step SA40, the control unit 41 of the first terminal 4 operates as the data exchange unit 412, and provides the issued first time certificate C10 to the second terminal 5 as the first certificate C1. Also, the control unit 41 provides the first identifier I10 to the second terminal 5. In response to this, the control unit 51 of the second terminal 5 appropriately acquires the first identifier I10 and the first certificate C1 from the first target. The method of acquiring the first identifier I10 and the first certificate C1 may be the same as in the above embodiment.

[0269] In step SH10, the control unit 51 of the second terminal 5 operates as an authentication request unit and transmits an authentication request including the first identifier I10 and the first certificate C1 to the first server 2. In step SH101, in response to receiving the authentication request, the control unit 21 of the first server 2 operates as a matching unit and matches the received first certificate C1 with the corresponding first time-limited certificate C10. The corresponding first time-limited certificate C10 may be acquired as appropriate. In one example, the issued first time-limited certificate C10 may be stored as first target information O10, and the control unit 21 extracts the corresponding first time-limited certificate C10 by searching the first target information O10 using the first identifier I10 as a query. In step SH20, control section 21 operates as notification section 212 and returns the result of the matching to second terminal 5. In response, control section 51 of second terminal 5 receives the result of the matching.

[0270] In step SH201, it is determined whether or not the first certificate C1 and the first time-limited certificate C10 match based on the received comparison result. If the comparison is successful, the control unit 51 proceeds to the next step SH30. On the other hand, if the comparison is not successful, the control unit 51 may omit the process of step SH30 and appropriately end the processing procedure for setting the association according to this modified example.

[0271] In step SH30, the control unit 51 operates as a setting request unit 513 and transmits a request for linking setting including the first identifier I10 and the second identifier I20 to the management server 1. In response to this, the management server 1 receives a request for linking setting from the second terminal 5. In step SC20, the control unit 11 of the management server 1 operates as a setting unit 112 and sets a correspondence (linking) between the first identifier I10 and the second identifier I20 specified by the request for linking setting. After setting the correspondence, the control unit 11 operates as a notification unit 114 and may transmit a notification indicating a processing result of the linking setting to the second terminal 5. When the linking setting is completed, the processing procedure for the linking setting according to this modified example ends.

[0272] In this modified example, the management server 1 may appropriately verify that the matching has been established in the first server 2. In one example, the control unit 21 of the first server 2 may also transmit the result of the matching to the management server 1. For example, the authentication request may further include the second identifier I20. When the matching is established, the control unit 21 may transmit the result of the matching including the first identifier I10 and the second identifier I20 to the management server 1. In this way, the control unit 21 may enable the management server 1 to request the association setting for the combination of the first identifier I10 and the second identifier I20 specified by the result of the matching. That is, in one example, the verification of the matching establishment may be configured by receiving the result of the matching. The management server 1 may be configured to hold the result of the matching from the first server 2, accept the request for the association setting for the combination of the first identifier I10 and the second identifier I20 specified by the result of the matching, and reject the other requests for the association setting.

[0273] In addition, in this modified example, the subject to be authenticated may not be limited to the first subject. In another example, instead of the authentication process of the first subject, the authentication process of the second subject may be executed. In yet another example, the authentication process of the second subject may be executed together with the authentication process of the first subject.

[0274] FIG. 19 is a schematic diagram showing another example of the process of the association setting according to this modified example. In the example of FIG. 19, a case is assumed in which the authentication process is performed on the second target instead of the authentication process on the first target. The processing procedure of FIG. 19 may be the same as the processing procedure of FIG. 17, except that the first target and the second target are interchanged. That is, the processing of steps SB10 and SB20 is performed between the second terminal 5 and the second server 3, whereby the second time certificate C20 is issued, and the issued second time certificate C20 is notified to the second terminal 5. In step SB40, the control unit 51 of the second terminal 5 provides the issued second time certificate C20 to the first terminal 4 as the second certificate C2. In addition, the control unit 51 provides the second identifier I20 to the first terminal 4. In step SI10, the control unit 41 of the first terminal 4 transmits an authentication request including the second identifier I20 and the second certificate C2 to the second server 3. In response to this, the control unit 31 of the second server 3 executes a process of comparing the second certificate C2 and the second time-limit certificate C20. In step SI20, the control unit 31 returns the result of the comparison to the first terminal 4. If the comparison result shows that the second certificate C2 and the second time-limit certificate C20 match, the control unit 41 of the first terminal 4 sends a request for linking setting, including the first identifier I10 and the second identifier I20, to the management server 1. In response to this, the control unit 11 of the management server 1 transmits the first identifier I10 and the second identifier I20 specified in the request for linking setting. A correspondence relationship between the first identifier I10 and the second identifier I20 is set. In another example, authentication processing for the first target and the second target may be performed by executing a series of processing in Fig. 17 and Fig. 19.

[0275] (Features) In this modified example, authentication processing is executed before a request for association setting. This reduces the processing load on the management server 1. Also, the processing time from the request for association setting to setting (generation of association information D10) can be shortened.

[0276] [5 Supplementary Note] The processes and means described in the present disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0277] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. Or, a process described as being performed by different devices may be executed by one device. In a computer system, the hardware configuration for implementing each function can be flexibly changed.

[0278] The present disclosure can also be realized by supplying a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors of the computer read and execute the program. Such a computer program may be provided to the computer by a non-transitory computer-readable storage medium connectable to the system bus of the computer, or may be provided to the computer via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk, etc.), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, a semiconductor drive (e.g., a solid-state drive), and any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0279] 1... management server, 11... control unit, 2...first server, 21...control unit, 3... second server, 31... control unit, 4...first terminal, 41...control unit, 5... second terminal, 51... control unit, C1...First certificate, I10...First identifier, O10…First target information, O10A…User information, C10: First time certificate, C2: Second Certificate, I20: Second Identifier, O20…second target information, O20A…mobile information, C20: Second time certificate, D10: Linking information, E10: Various information

Claims

1. A first server, A second server; and Management Server Equipped with The first server issuing a first time-limited certificate in association with a first identifier of a first subject; and notifying the management server of the issued first time-limited certificate; It is configured as follows: The second server, issuing a second timed certificate associated with a second identifier for a second subject; and notifying the management server of the issued second time-limited certificate; It is configured as follows: The management server includes: receiving a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target in response to a usage relationship being established between the first target and the second target; comparing the received first certificate and the second certificate with the first time-limit certificate and the second time-limit certificate notified from the first server and the second server; If the matching is established, a correspondence relationship between the first identifier and the second identifier is set, The first time-limited certificate and the second time-limited certificate are configured to expire after a validity period. Management system.

2. The management system according to claim 1 , wherein the management server is further configured to cancel the correspondence relationship upon receipt of a cancellation request from at least one of the first terminal and the second terminal or upon establishment of a predetermined cancellation condition.

3. receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes receiving the first identifier and the second identifier from at least one of the first terminal and the second terminal; The management system according to claim 1 .

4. Receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes: receiving the second certificate and the second identifier from the first terminal; and receiving the first certificate and the first identifier from the second terminal; Consists of: The management system according to claim 3.

5. Receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes: receiving the second certificate and the first identifier from the first terminal; and receiving the first certificate and the second identifier from the second terminal; Consists of: The management system according to claim 3.

6. The first certificate and the second certificate are transmitted from at least one of the first terminal and the second terminal. Receiving the document is receiving the first certificate and the second identifier from the first terminal; and receiving the second certificate and the first identifier from the second terminal; Consists of: The management system according to claim 3.

7. receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal comprises receiving the first certificate and the second certificate from one of the first terminal and the second terminal. The management system according to claim 1 .

8. one of the first object and the second object is a user; one of the first terminal and the second terminal corresponding to the user is a user terminal related to the user; the other of the first object and the second object is a use object used by the user, One of the first terminal and the second terminal corresponding to the object is a loading terminal that is loaded on the object. The management system according to any one of claims 1 to 7.

9. The object of use is a moving object. The management system according to claim 8.

10. The user terminal associated with the user is a proxy user terminal possessed by a proxy user who represents the user. The management system according to claim 8.

11. The usage relationship between the first target and the second target is generated through data communication between a target user terminal possessed by the user and the representative user terminal, and data communication between the representative user terminal and the loaded terminal. The management system according to claim 10.

12. The usage relationship between the first target and the second target is generated by data communication between the target user terminal possessed by the user and the loaded terminal through a proxy user terminal possessed by a proxy user who represents the user. The management system according to claim 8.

13. The user terminal related to the user is a target user terminal owned by the user, One of the first identifier and the second identifier, which corresponds to the user, is associated with a proxy authority of a user other than the user. The management system according to claim 8.

14. The management server receiving from a first server a first time-limited certificate issued in association with a first identifier of a first subject, the first time-limited certificate being configured to expire after a validity period; receiving from a second server a second time-limited certificate issued in relation to a second identifier of a second subject, the second time-limited certificate being configured to expire after a validity period; receiving a first certificate corresponding to the first time-limited certificate and a second certificate corresponding to the second time-limited certificate from at least one of a first terminal of the first target and a second terminal of the second target in response to a usage relationship being established between the first target and the second target; From the received first certificate and second certificate and the first server and the second server Comparing the notified first time certificate and the notified second time certificate, If the match is established, a correspondence relationship between the first identifier and the second identifier is set. To carry out Management method.

15. the management server further cancels the correspondence relationship upon receipt of a cancellation request from at least one of the first terminal and the second terminal or upon establishment of a predetermined cancellation condition. The management method according to claim 14.

16. Receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes: receiving the second certificate and the second identifier from the first terminal; and receiving the first certificate and the first identifier from the second terminal; Consists of: The management method according to claim 14.

17. Receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes: receiving the second certificate and the first identifier from the first terminal; and receiving the first certificate and the second identifier from the second terminal; Consists of: The management method according to claim 14.

18. Receiving the first certificate and the second certificate from at least one of the first terminal and the second terminal includes: receiving the first certificate and the second identifier from the first terminal; and receiving the second certificate and the first identifier from the second terminal; Consists of: The management method according to claim 14.

19. one of the first object and the second object is a user; one of the first terminal and the second terminal corresponding to the user is a user terminal related to the user; the other of the first object and the second object is a use object used by the user, One of the first terminal and the second terminal corresponding to the object is a loading terminal that is loaded on the object. The management method according to any one of claims 14 to 18.

20. On the first terminal, sending a request for issuance of a first time-limited certificate to a first server in relation to a first identifier of a first subject; receiving the issued first time-limited certificate from the first server; When a relationship of use occurs between the first object and the second object, providing the received first time-limited certificate as a first certificate to a second terminal of the second target, thereby causing the second terminal to transmit the first certificate to a management server; obtaining from the second terminal a second certificate corresponding to a second time-limited certificate issued by a second server in relation to a second identifier of the second object; and transmitting the acquired second certificate to the management server to request setting of a correspondence relationship between the first identifier and the second identifier; In order to execute program.

Images