Stop control system, service system, and stop control method

Abstract

For example, it provides a simple and secure mechanism for suspending services in the event of loss of items such as smartphones used for payments. [Solution] A stop control system for controlling the suspension of services provided to customers by a service system, comprising a control device and a storage device, wherein the storage device holds loss information, and the loss information includes information indicating a lost item and information indicating a person who lost something, and the control device distributes distribution information, which includes at least a part of the loss information, to multiple service systems, each providing predetermined services to multiple customers, and when additional information is received from any of the service systems, updates the loss information with the additional information, and distributes the distribution information, which includes at least a part of the updated loss information, to at least the service system other than the service system that sent the additional information, and when no additional information is received from any of the service systems, stops the distribution of the distribution information.

Description

Technical Field

[0006] , ,

[0005] , , ,

[0001] The present invention relates to a technique for stopping services such as settlement based on information acquired from users and business operators.

Background Art

[0002] As the background art of the present invention, there is a technique described in Japanese Unexamined Patent Application Publication No. 2006-216001 (Patent Document 1).

[0003] Patent Document 1 describes that "when a cardholder discovers the loss or theft of a card and is convinced that a skimmed counterfeit card has been used, only the minimum information of the card user is notified to all banks and all credit sales companies that are card-issuing companies at the same time, and the card-issuing company that has received the notification has a means to quickly process the suspension of card use, thereby minimizing the financial damage to the cardholder due to card crime, and by having a means to add a scramble code or use an encryption code to the PIN number by the selection of the cardholder so that a counterfeit card cannot be used, a card security system that can prevent card crime can be realized."

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In recent years, while the use of cashless settlement using so-called smartphones has been expanding, it has not advanced particularly among some groups such as the elderly. One of the reasons is the anxiety about the loss of smartphones.

[0006] Losing a smartphone used for cashless payments presents a problem because it requires contacting numerous contacts, including mobile phone carriers, credit card companies, and QR code payment providers, each individually looking up their contact information. Furthermore, while account numbers and other information need to be provided to these contacts, if this information is stored on the smartphone itself, the loss of the phone could render these numbers inaccessible. These issues are believed to contribute to the anxiety surrounding smartphone loss.

[0007] On the other hand, payment service providers also faced the problem of difficulty in making a definitive judgment on whether it was permissible to suspend a payment if they received incomplete information from a user, such as an unknown account number.

[0008] The above problem applies not only when a smartphone used for cashless payments is lost, but also, for example, when a wallet containing multiple credit cards is lost.

[0009] Patent Document 1 describes registering information on all card types held by a cardholder with a card security center, notifying the card security center of information such as the cardholder's name and date of birth when the cardholder becomes aware of the loss or theft of their card, and the card security center simultaneously notifying banks and credit companies of the loss or theft information for all cards registered by the cardholder.

[0010] According to the method described in Patent Document 1, there is only one contact point in case of card loss: the card security center. However, a means of logging in to this center is required, and if, for example, the smartphone containing the login information is lost, logging in becomes difficult. Furthermore, although the cardholder does not need to have information such as the card number, all registered cards, including those that have not been lost, will be suspended. In addition, there is no description of how the security center authenticates the cardholder when it receives contact from the cardholder, or how to verify the authenticity of the acquired information. Therefore, if the smartphone is lost, there is a risk of unauthorized login.

[0011] This invention has been made in view of the above problems, and aims to provide a simple and safe service suspension mechanism in the event of loss of an item, so that, for example, payments using smartphones can be used with peace of mind. [Means for solving the problem]

[0012] To solve at least one of the above problems, the present invention provides a stop control system for controlling the cessation of services provided to customers by a service system, comprising a control device and a storage device, wherein the storage device holds loss information, the loss information includes information indicating a lost item and information indicating a person who has lost something, the control device distributes distribution information including at least a part of the loss information to a plurality of service systems, each providing predetermined services to a plurality of customers, if it receives additional information to the distribution information from any of the service systems, it updates the loss information with the additional information, distributes the updated distribution information including at least a part of the loss information to at least the service system other than the service system that transmitted the additional information, and if it does not receive the additional information from any of the service systems, it stops distributing the distribution information. [Effects of the Invention]

[0013] According to one aspect of the present invention, a simple and secure mechanism for suspending services in the event of loss of an item such as a smartphone used for payment is provided. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments. [Brief explanation of the drawing]

[0014] [Figure 1] This is a block diagram showing an example of the overall system configuration of an embodiment of the present invention. [Figure 2] This is a block diagram showing an example of the hardware configuration of a computer system that implements the system of the embodiment of the present invention. [Figure 3] A sequence diagram showing an example of the process performed in the system of the embodiment of the present invention. [Figure 4] This is an explanatory diagram showing an example of lost information transmitted in an embodiment of the present invention. [Figure 5] This is a sequence diagram showing a specific example of the process performed in the system of the embodiment of the present invention. [Figure 6] This is an explanatory diagram showing an example of an evaluation criteria table held by the stop control system of an embodiment of the present invention. [Figure 7] This is an explanatory diagram showing a first example of customer information held by a service system according to an embodiment of the present invention. [Figure 8] This is an explanatory diagram showing an example of alert level update information held by the service system of an embodiment of the present invention. [Figure 9] This is an explanatory diagram showing a second example of customer information held by a service system according to an embodiment of the present invention. [Figure 10] This is an explanatory diagram showing a third example of customer information held by a service system according to an embodiment of the present invention. [Figure 11] This is an explanatory diagram showing a first example of the distribution information distributed by the stop control system of an embodiment of the present invention. [Figure 12] This is an explanatory diagram showing a first example of additional information transmitted by the service system of an embodiment of the present invention. [Figure 13]It is an explanatory diagram showing a second example of distribution information distributed by the stop control system of an embodiment of the present invention. [Figure 14] It is an explanatory diagram showing a second example of additional information transmitted by the service system of an embodiment of the present invention. [Figure 15] It is an explanatory diagram showing a third example of distribution information distributed by the stop control system of an embodiment of the present invention. [Figure 16] It is a sequence diagram showing an example of a filter list generation and sharing process executed in the system of an embodiment of the present invention. [Figure 17] It is a sequence diagram showing an example of a filter list generation process executed in the system of an embodiment of the present invention. [Figure 18] It is an explanatory diagram showing an example of a filter list table generated in the system of an embodiment of the present invention. [Figure 19] It is a sequence diagram showing an example of a probabilistic destination selection process executed in the system of an embodiment of the present invention.

Mode for Carrying Out the Invention

[0015] Hereinafter, embodiments of the present invention will be described based on the drawings.

[0016] FIG. 1 is a block diagram showing an example of the configuration of the entire system of an embodiment of the present invention.

[0017] The system of this embodiment is composed of a stop control system 100, a loss information registration system 110, and a plurality of service systems 120 (for example, service systems 120A, 120B, and 120C, etc.). These are communicably connected by a communication network 130.

[0018] The service suspension control system 100 is a system that controls the suspension of services such as cashless payments based on information from users of those services. For example, the service suspension control system 100 has functional units such as a lost information receiving unit 101, a distribution destination selection unit 102, a distribution destination probabilistic selection unit 103, an additional information receiving unit 104, and an information reliability evaluation unit 105, and it holds information such as lost information 106, an evaluation criteria table 108, and a filter list table 109. The lost information 106 includes additional information and reliability information 107.

[0019] The Lost Information Receiving Unit 101 receives lost information from the Lost Information Registration System 110 and stores it as Lost Information 106. The Distribution Destination Selection Unit 102 or the Distribution Destination Probabilistic Selection Unit 103 selects a service system 120 to which the distribution information, including at least a portion of the Lost Information 106, will be distributed. The Additional Information Receiving Unit 104 receives additional information and reliability information added to the distribution information by the service system 120 and stores it as additional information / reliability information 107 within the Lost Information 106. The Information Reliability Evaluation Unit 105 evaluates the reliability of the information based on the Lost Information 106.

[0020] As described above, the lost information 106 includes lost information obtained from the lost information registration system 110 and additional information / reliability information 107 added by the service system 120. The evaluation criteria table 108 is referenced by the information reliability evaluation unit 105 when evaluating the reliability of the information. The filter list table 109 is referenced by the distribution destination probabilistic selection unit 103 when selecting the distribution destination for the distribution information.

[0021] The lost item registration system 110 is a system that accepts registration of information regarding the loss of a smartphone or other device when a user loses it. Figure 1 shows only one lost item registration system 110, but in reality, multiple lost item registration systems 110 may be installed. For example, the lost item registration system 110 may be installed in police stations, police boxes, financial institution branches (post offices and banks, etc.), retail stores, etc.

[0022] In this embodiment, "loss" refers to any situation in which the whereabouts of an item owned by the user (e.g., a smartphone) become unknown. This includes situations such as misplacing an item due to the user's carelessness, losing an item due to dropping it, or being the victim of theft. Generally, it may not be possible to immediately determine the cause of the unknown whereabouts (e.g., misplacing or theft), but regardless of the cause, the situation in which the whereabouts of the item become unknown is described as "loss."

[0023] The lost item registration system 110 has a lost item registration unit 111 as its functional unit. For example, when a user realizes that they have lost their smartphone or other device, they report it to the nearest police station, police box, or store. The user, police officer, or store employee then operates the lost item registration system 110 to input information about the lost item. The lost item registration unit 111 receives the input information about the lost item and transmits it to the stop control system 100.

[0024] Multiple service systems 120 are systems operated by businesses that provide services such as payment to users. Figure 1 shows service systems 120A, 12B, and 120C as examples, but generally there are many more service systems 120. When explaining something that is common to all of service systems 120A, 120B, 120C, etc., they may be collectively referred to as service system 120. Similarly, the components of each service system 120 may be explained by adding sub-numbers such as "A," "B," and "C" to their reference references, or they may be explained in a common manner without adding sub-numbers.

[0025] The service system 120A has functional units for service suspension determination 121A, additional information addition 122A, and reliability information addition 123A, and holds customer information 124A and alert level update information 125A. The service suspension determination unit 121A determines whether or not to suspend a service (for example, a credit card payment service or a code payment service using a smartphone) provided by the operator of the service system 120A, based on the distribution information distributed from the suspension control system 100. The additional information addition unit 122A and the reliability information addition unit 123A compare the distribution information with the customer information 124, and, if possible, add additional information and reliability information to the distribution information.

[0026] Customer information 124A includes information about customers who are the target of services provided by the service provider operating the service system 120A. Alert level update information 125A includes information about updates to the alert level when the service provider provides services. Here, the alert level refers to, for example, the level of conditions for authenticating payments to deter impersonation of credit card users.

[0027] Service system 120A holds alert level update information 125A, but generally, service system 120 does not necessarily hold alert level update information 125. For example, service systems 120B and 120C, described later, do not hold alert level update information 125. Alert level update information 125 is held if necessary, depending on the content of each service provider's services.

[0028] The service system 120B holds the following functional units: a service suspension determination unit 121B, an additional information addition unit 122B, and a reliability information addition unit 123B, as well as customer information 124B. The functions of the service suspension determination unit 121B, the additional information addition unit 122B, and the reliability information addition unit 123B are the same as those of the service suspension determination unit 121A, the additional information addition unit 122A, and the reliability information addition unit 123A of the service system 120A, respectively. In addition, the customer information 124B includes information about customers to whom the operator of the service system 120B provides services.

[0029] The service system 120C holds functional units such as the service suspension determination unit 121C, the additional information addition unit 122C, and the reliability information addition unit 123C, as well as customer information 124C. The functions of the service suspension determination unit 121C, the additional information addition unit 122C, and the reliability information addition unit 123C are the same as those of the service suspension determination unit 121A, the additional information addition unit 122A, and the reliability information addition unit 123A of the service system 120A, respectively. In addition, the customer information 124C includes information about customers to whom the operator of the service system 120C provides services.

[0030] As will be discussed later, the items of information included in customer information 124 may differ depending on the necessity based on the content of the services provided by each business operator and the policies of each business operator. Therefore, even if the same distribution information is received, whether or not additional information and reliability information can be added to it, and what kind of information can be added, may differ depending on the business operator.

[0031] In the example above, each service system 120 is operated by a business that provides services such as payment to users, which are subject to the decision of whether or not to suspend the service. However, the service system 120 may also include those operated by other businesses. Examples of such businesses include local governments and mobile phone companies. In that case, the service system 120 does not have a service suspension decision unit 121, and only adds additional information and reliability information based on the customer information 124 it holds. Furthermore, for example, a service system 120 operated by a local government may hold resident information, etc., as information equivalent to customer information 124.

[0032] Details of the functions and information of each of the above systems will be described later.

[0033] Figure 2 is a block diagram showing an example of the hardware configuration of a computer system that implements the system of the embodiment of the present invention.

[0034] The stop control system 100, the lost information registration system 110, and each service system 120 in this embodiment shown in Figure 1 can each be implemented by a computer system. Figure 2 shows a computer system 200 as an example.

[0035] The computer system 200 includes a control unit (Central Processing Unit, CPU) 201, main memory 202, auxiliary storage 203, input device 204, output device 205, and communication device 206.

[0036] The main memory 202 and auxiliary memory 203 store programs and data used by the control device 201. For example, the loss information 106, evaluation criteria table 108, and filter list table 109 shown in Figure 1 are stored in the auxiliary memory 203 of the computer system 200 corresponding to the stop control system 100, and at least a portion of them may be stored in the main memory 202 as needed for processing. Similarly, customer information 124 and alert level update information 125 for each service system 120 are stored in the memory of the computer system corresponding to each service system 120.

[0037] The main memory 202 is a main memory composed of, for example, semiconductor memory, and is primarily used to hold the currently running program and data. For example, the program and data stored in the auxiliary memory 203 are loaded into the main memory 202 at startup or when needed. The control unit 201 performs various processes according to the program stored in the main memory 202. Various functional units are realized by the control unit 201 operating according to the program.

[0038] For example, the control device 201 of the computer system 200, which corresponds to the stop control system 100, executes a program to realize the functions of the lost information receiving unit 101, the distribution destination selection unit 102, the distribution destination probabilistic selection unit 103, the additional information receiving unit 104, and the information reliability evaluation unit 105. Similarly, the control device 201 of the computer system 200, which corresponds to the lost information registration system 110, executes a program to realize the function of the lost information registration unit 111. The control device 201 of the computer system 200, which corresponds to the service system 120, executes a program to realize the functions of the service stop determination unit 121, the additional information addition unit 122, and the reliability information addition unit 123.

[0039] The auxiliary storage device 203 is comprised of a large-capacity non-volatile storage device, such as a hard disk drive or a solid-state drive, and is used to retain programs and data for a long period of time.

[0040] The control device 201 can consist of a single processing unit or multiple processing units, and may include one or more arithmetic units or multiple processing cores. The control device 201 can be implemented as one or more central processing units, microprocessors, microcomputers, microcontrollers, digital signal processors, state machines, logic circuits, graphics processing units, chip-on systems, and / or any device that manipulates signals based on control instructions.

[0041] The input device 204 is a hardware device for users of each system to input instructions and information. The output device 205 is a hardware device that displays various images for input and output, such as a display device or a printing device. The communication device 206 is an interface for connection to the communication network 130.

[0042] The computer system 200 may include two or more control devices 201. Furthermore, the functions of each system shown in Figure 1 can be implemented in multiple computer systems 200. In this case, the multiple computer systems 200 communicate via a network. For example, some of the functions of the stop control system 100 in this embodiment may be implemented in one computer system 200, while other functions may be implemented in other computer systems 200. Also, the computer system 200 may be a so-called virtual server on the cloud. In this case, the computer system 200 shown in Figure 2 is realized using computing resources on the cloud.

[0043] Figure 3 is a sequence diagram showing an example of a process performed in the system of the embodiment of the present invention.

[0044] First, the lost information is entered into the lost information registration system 110 (step S301). For example, a user who realizes they have lost a smartphone or other device stops by a police box, and a police officer obtains the information from the user and enters it into the lost information registration system 110 installed at the police box. The lost information registration unit 111 of the lost information registration system 110 generates lost information 311 based on the entered information and transmits it to the stop control system 100. An example of lost information 311 will be described later (see Figure 4).

[0045] The stop control system 100 receives the loss information 311 (step S302), selects a service system 120 to which the information will be distributed (step S303), and distributes the distribution information 312 to the selected service system 120 (step S304). Step S302 is performed by the loss information receiving unit 101, and step S303 is performed by the distribution destination selection unit 102 or the distribution destination probabilistic selection unit 103. The distribution information 312 also includes at least a part of the loss information 311.

[0046] Each service system 120 that receives the distribution information 312 makes a decision on whether or not to stop the service and adds information based on the received distribution information 312 (step S305). Specifically, the service stop decision unit 121 of the service system 120 makes a decision on whether or not to stop the service, and if it decides to stop the service, it stops the service (step S306).

[0047] Furthermore, the additional information addition unit 122 compares the distribution information 312 with the customer information 124 to determine if there is any information that can be added to the distribution information 312, and if so, adds the information (step S307). In addition, the reliability information addition unit 123 compares the distribution information 312 with the customer information 124 to determine if reliability-indicating information can be added to the distribution information 312, and if so, adds the information (step S308). The service system 120 transmits the information added by the additional information addition unit 122 and the reliability information addition unit 123 as additional information 313 to the stop control system 100 (step S309).

[0048] The additional information receiving unit 104 of the stop control system 100 updates the loss information 106 by storing the received additional information 313 as additional information / reliability information 107.

[0049] Subsequently, the process returns to step S303, and the processes from step S303 onward are executed based on the updated loss information 106. Thereafter, the processes from steps S303 to S310 are repeatedly executed until a predetermined termination condition is met.

[0050] Figure 4 is an explanatory diagram showing an example of lost information 311 transmitted in an embodiment of the present invention.

[0051] Lost information 311 includes, for example, information classification 401, information item 402, content 403, source of information 404, and circumstances 405.

[0052] Information item 402 indicates the information items included in the lost item information 311, and information classification 401 indicates the classification of the information for each item. Content 403 indicates the value of each item, i.e., the content of the information for each item. Information source 404 indicates the source from which the information for each item was obtained. For example, if the information was reported by the user, information source 404 will be "Reported," and if the information was obtained from some reliable document (e.g., a driver's license or health insurance card), information source 404 will be the name of that document.

[0053] Status 405 indicates the accuracy (i.e., reliability) of the information in each item, and is based, for example, on the status of acquisition and verification of the information in each item. For example, if information based on a user's self-report has not been further verified, status 405 will be "Self-reported," and if the information has been verified by the sender of the lost item information 311 (e.g., a police station) based on some reliable document, status 405 will be "Sender verified."

[0054] Figure 4 shows, as an example, the loss information 311 generated when a user who has lost a smartphone or similar device visits the Marunouchi Police Station and enters the information into the lost information registration system 110 installed within the station. Among the information items 402, "Sender," "Recipient," and "Case Number" are information that identifies the loss information 311, and their information classification 401 is "Message Information." As described in the contents 403 of each item, the example in Figure 4 shows that the loss information 311 is information transmitted from the Marunouchi Police Station to the stop control system 100, and is identified by the case number "1000-001." In subsequent processing, the loss case based on this report will be identified by this case number.

[0055] Of the information items 402, "Name," "Address," and "Telephone Number" correspond to the attributes of the user who reported the loss, and their information classification 401 is "User Attributes." The content 403 for each item contains the user's name, address, and telephone number.

[0056] In the example in Figure 4, the source of information 404 for name and address is "insurance card," and its status 405 is "sender verified." This indicates that the user had their insurance card with them when they reported the loss, presented it to a police officer at Marunouchi Police Station, and the officer confirmed that the information was correct. On the other hand, the source of information 404 for telephone number is "declaration," and its status 405 is "self-declaration." This indicates that the telephone number listed was self-declared by the user, and no further verification was performed.

[0057] Of the information items 402, "smartphone" and "wallet" represent lost items reported by the user, and their information classification 401 is "lost item." Since this information is also based on the user's self-reporting, the information source 404 and situation 405 corresponding to each item are "reported" and "self-reported," respectively.

[0058] The shutdown control system 100 stores the received loss information 311 as loss information 106. If the shutdown control system 100 meets the evaluation criteria recorded in the evaluation criteria table 108, it updates the content of the loss information 106 according to those criteria, generates distribution information 312 based on the updated loss information 106, and distributes it to each service system 120. If the shutdown control system 100 obtains additional information 313 from any of the service systems 120, it adds the additional information 313 as additional information / reliability information 107, and if the added information meets the evaluation criteria recorded in the evaluation criteria table 108, it updates the loss information 106 according to those criteria. Then, the shutdown control system 100 generates distribution information 312 based on the updated loss information 106 and distributes it to each service system 120. The above process is repeatedly executed. Details of this process will be described later.

[0059] Figure 5 is a sequence diagram showing a specific example of the process performed in the system of the embodiment of the present invention.

[0060] Specifically, Figure 5 shows a concrete example of the repeated processing from step S303 onwards, which is executed when steps S301 and S302 shown in Figure 3 are performed and the stop control system 100 receives the loss information 311 shown in Figure 4 in step S302.

[0061] In a real system, it is expected that a very large number of service systems 120 will be connected. However, for illustrative purposes, Figure 5 shows an example of processing when three service systems 120A to 120C are connected. In this example, service system 120A is a system operated by credit card company A, and service systems 120B and 120C are systems operated by different code payment service providers B and C, respectively.

[0062] Note that while Figure 3 shows a single process for one service system 120 for illustrative purposes, in reality, multiple processes are executed for multiple service systems 120. Therefore, a process described as one step in Figure 3 may be executed multiple times in Figure 5. Similarly, a single transmission or reception of information shown in Figure 3 may be executed multiple times in Figure 5. These steps and information are identified in Figure 5 by adding branch numbers such as "-1" and "-2" to the reference codes shown in Figure 3.

[0063] When the stop control system 100 receives the loss information 311, it selects a distribution destination (step S303-1) and distributes the distribution information 312-1 to the selected distribution destination (step S304-1). In this example, since it is the first distribution, the distribution destination selection unit 102 selects all service systems 120A to 120C as distribution destinations.

[0064] Each service system 120A to 120C compares the distribution information 312-1 with the customer information 124A to 124C, etc., that it holds, and makes a stop decision and adds information (steps S305-1 to S305-3). If there is information to add, it is sent to the stop control system 100 as additional information 313; otherwise, the stop control system 100 is notified of this. Although omitted in Figure 5, in each of steps S305-1 to S305-3, each service system 120 executes steps S306 to S309 shown in Figure 3. The same applies to steps S304-4 to S305-7, which will be described later. In the example in Figure 5, service system 120A generates additional information 313-1 and sends it to the stop control system 100. The stop control system 100 receives the additional information 313-1 (step S310-1).

[0065] Next, the stop control system 100 selects a destination for the distribution information 312-2 updated by the additional information 313-1 (step S303-2), and distributes the distribution information 312-2 to the selected destination (step S304-2). In the example in Figure 5, the distribution information 312-2 has been updated by the additional information 313-1 from service system 120A, so it is known information to service system 120A. For this reason, the destination selection unit 102 selects all service systems 120 except service system 120A (i.e., service systems 120B and 120C) as destinations.

[0066] If the distribution information 312-2 is updated with additional information from multiple service systems 120, then from the perspective of any service system 120, the distribution information 312-2 will include unknown additional information 313 from service systems other than its own service system 120. Therefore, in this case, all service systems 120 will be selected as distribution destinations.

[0067] Service systems 120B and 120C each compare the distribution information 312-2 with the customer information 124B, 124C, etc., that they each hold, and make a stop decision and add information (steps S305-4, S305-5). If there is information to be added, they send it to the stop control system 100 as additional information 313, and if not, they notify the stop control system 100 of this. In the example in Figure 5, service system 120B generates additional information 313-2 and sends it to the stop control system 100. The stop control system 100 receives the additional information 313-2 (step S310-2).

[0068] Next, the stop control system 100 selects a destination for the distribution information 312-3 updated by the additional information 313-2 (step S303-3), and distributes the distribution information 312-3 to the selected destination (step S304-3). The selection of the distribution destination here is performed in the same way as in step S303-2. That is, since the distribution information 312-3 has been updated by the additional information 313-2 from service system 120B, the distribution destination selection unit 102 selects all service systems 120 except service system 120B (i.e., service systems 120A and 120C) as distribution destinations.

[0069] Service systems 120A and 120C each compare the distribution information 312-3 with the customer information 124A, 124C, etc., that they each hold, and make a stop decision and add information (steps S305-4, S305-5). If there is information to be added, they send it to the stop control system 100 as additional information 313, and if there is no information to be added, they notify the stop control system 100 of that fact. In the example in Figure 5, neither service system 120 generated additional information 313, so the stop control system 100 receives a notification indicating that (step S310-3).

[0070] The stop control system 100 was unable to update the distribution information 312-3 because it could not receive additional information 313 from any of the service systems 120 in step S310-3. Therefore, since there is no prospect of obtaining new additional information 313 even if the processing from step 303 onward is repeated, the stop control system 100 determines that the termination condition has been met and terminates the process.

[0071] Next, we will explain the details of the processing shown in Figure 5 by referring to an example of the information held by the stop control system 100 and each service system 120.

[0072] Figure 6 is an explanatory diagram showing an example of an evaluation criteria table 108 held by the stop control system 100 of the embodiment of the present invention.

[0073] The evaluation criteria table 108 shown in Figure 6 includes the source 601, information source 602, circumstances 603, and judgment 604. The source 601 indicates the source of the information. The information source 602 indicates the source from which the information was obtained, i.e., the initial source of the information. Circumstance 603 indicates how the reliability of the information is being evaluated. The judgment 604 indicates the result of the reliability judgment of the information corresponding to the combination of source 601, information source 602, and circumstances 603.

[0074] For example, the first record in the evaluation criteria table 108 shown in Figure 6 indicates that, regardless of the information source 602, if the information transmitted from the police station's lost information registration system 110 has been verified by the sender (i.e., the police station), then the information is considered to be highly reliable. For example, this applies when a police officer verifies a user's name, address, etc., based on their health insurance card, etc.

[0075] The second record indicates that if information obtained from information sources for service provision (for example, the debit account number of a credit card company) among the information held by the service system 120 is verified by the service system 120 and transmitted from the service system 120, then it is determined that the information has been verified to be highly reliable.

[0076] The third record indicates that if information obtained from the customer information 124 held by the service system 120 that is used for customer authentication (for example, the customer's phone number used for authentication) is verified by the service system 120 and transmitted from the service system 120, it is determined that the information has been verified to be highly reliable.

[0077] The fourth record indicates that if information obtained from customer information 124 held by the service system 120 that has been verified by some means (for example, name, address, etc. obtained during identity verification for financial services) is verified by the service system 120 and transmitted from the service system 120, then it is determined that the information has been verified to be highly reliable.

[0078] The fifth record is based on customer self-reporting among the customer information 124 held by the service system 120. Since information that has not undergone further verification (including verification by the sender) cannot be considered highly reliable, the reliability assessment remains unchanged.

[0079] Figure 7 is an explanatory diagram showing a first example of customer information 124 held by the service system 120 of the embodiment of the present invention.

[0080] Specifically, Figure 7 shows an example of customer information 124A held by a service system 120A operated by credit card company A.

[0081] The customer information 124A shown in Figure 7 includes the card number 701, name 702, address 703, and withdrawal account number 704. The card number 701 is the credit card number issued to each customer. The name 702 and address 703 are the name and address information of the customer that they declared when issuing the credit card, and are generally verified to be true by some means. The withdrawal account number 704 is the account number registered for payment using the credit card.

[0082] Figure 8 is an explanatory diagram showing an example of alert level update information 125 held by the service system 120 of an embodiment of the present invention.

[0083] Specifically, Figure 8 shows an example of alert level update information 125A held by a service system 120A operated by credit card company A.

[0084] Alert level update information 125A is information referenced to determine whether or not to update the alert level for credit card payments. Here, the alert level refers to, for example, the level of conditions required to authenticate credit card payments.

[0085] The alert level update information 125A shown in Figure 8 includes information classification 801, information item 802, content 803, and response 804. Information classification 801 and information item 802 indicate the classification and item of information to be referenced for determining whether to update the alert level, respectively. Content 803 and response 804 indicate the conditions that the information for each item must satisfy, and the response to update the alert level when those conditions are met, respectively.

[0086] For example, the first record of alert level update information 125A shown in Figure 8 indicates that no action will be taken if the customer loses their smartphone. The second record indicates that if the customer loses their wallet or bag, the alert level will be raised for subsequent payments made using that customer's credit card. This is because if a wallet or bag is lost, the credit card may also be lost, and this is to prevent fraudulent use by others. Here, one way to raise the alert level is to refuse card payments in a different industry or region than before.

[0087] The third record indicates that if a customer loses a credit card with the same card number as the one registered in customer information 124A, payments using that customer's credit card will be temporarily suspended.

[0088] Figure 9 is an explanatory diagram showing a second example of customer information 124 held by the service system 120 of the embodiment of the present invention.

[0089] Specifically, Figure 9 shows an example of customer information 124B held by the service system 120B operated by code payment service provider B.

[0090] The customer information 124B shown in Figure 9 includes customer number 901, name 902, address 903, deposit source account number 904, and authentication telephone number 905. Customer number 901 is the identification number for each customer. Name 902 and address 903 are the name and address information for each customer. Deposit source account number 904 is the account number from which each customer makes deposits when using code payment. Authentication telephone number 905 is the telephone number registered to authenticate each customer.

[0091] In this example, code payment provider B manages each customer's name and address, but this information may not be up-to-date. However, even if, for example, the address is not up-to-date, the code payment service can still be provided, and transactions such as charging from the account indicated by deposit source account number 904 can be performed.

[0092] Figure 10 is an explanatory diagram showing a third example of customer information 124 held by the service system 120 of the embodiment of the present invention.

[0093] Specifically, Figure 10 shows an example of customer information 124C held by a service system 120C operated by a code payment service provider C.

[0094] The customer information 124C shown in Figure 10 includes customer number 1001, nickname 1002, and authentication telephone number 1003. Customer number 1001 is the identification number for each customer. Nickname 1002 is a nickname used to identify each customer. Authentication telephone number 1003 is a telephone number registered to authenticate each customer. In this example, since code payment service provider C only handles small-amount payments, it does not manage the customer's name or address.

[0095] Figure 11 is an explanatory diagram showing a first example of the distribution information 312 distributed by the stop control system 100 of the embodiment of the present invention.

[0096] Specifically, Figure 11 shows an example of the distribution information 312-1 distributed in step S304-1 of Figure 5. The stop control system 100 holds the loss information 311 shown in Figure 4 as loss information 106 and generates the distribution information 312-1 based on it. An example of the generation of distribution information 312-1 will be described below.

[0097] First, the content 403 corresponding to the "sender" in the lost information 311 shown in Figure 4 is "Marunouchi Police Station," and the status 405 corresponding to the "name" and "address" is "sender confirmed," which satisfies the conditions for the first record in the evaluation criteria table 108 shown in Figure 6. Therefore, the stop control system 100 updates the status 405 corresponding to the "name" and "address" in the lost information 311 to "confirmed" and retains it as lost information 106.

[0098] The stop control system 100 then sets the content 403 corresponding to the information items "source" and "destination" of the lost information 106 to "stop control system" and "card company A," respectively, and generates the distribution information 312-1. This indicates that the distribution information 312-1 is distributed from the stop control system 100 to the service system 120A operated by card company A.

[0099] In step S304-1, similarly, distribution information 312 for service system 120B operated by code payment service provider B and distribution information 312 for service system 120C operated by code payment service provider C are also distributed. In these distribution information 312s, the content 403 corresponding to "destination" is "code payment service provider B" and "code payment service provider C" respectively, and the rest is the same as distribution information 312-1.

[0100] Figure 12 is an explanatory diagram showing a first example of additional information 313 transmitted by the service system 120 of an embodiment of the present invention.

[0101] Specifically, Figure 12 shows an example of additional information 313-1 transmitted by the service system 120A in step S305-1 of Figure 5. This information is generated by the service system 120A by comparing the distribution information 312-1 shown in Figure 11 with the customer information 124A of credit card company A shown in Figure 7.

[0102] In this example, the contents of "name" and "address" 403 included in the distribution information 312-1 match the name 702 and address 703 of the first record in customer information 124A, and the status 405 of the "name" and "address" has been confirmed (i.e., it is reliable information), so it is identified that the lost user is the customer corresponding to that record.

[0103] This information alone is insufficient to determine whether or not a card issued by credit card company A has been lost. However, since "wallet" is registered as a lost item, the service suspension determination unit 121A of the service system 120A determines that there is a possibility of card loss. While it does not suspend the payment service using the card issued to the user, it updates the security check alert level for card payments based on the alert level update information 125A. As a result, security checks will become stricter when the card is used in the future.

[0104] Furthermore, the value of the withdrawal account number 704 corresponding to the "name" and "address" mentioned above can be obtained from the customer information 124A, and the credit card company A, which is the sender of the additional information 313-1, can verify its contents. For this reason, the additional information addition unit 122A and the reliability information addition unit 123A of the service system 120A generate additional information 313-1, which includes a record in which the information classification 401 is "user attribute", the information item 402 is "account number", the content 403 is the value of the withdrawal account number 704 obtained from the customer information 124A, the information source 404 is "withdrawal account number", and the status 405 is "sender verified", and transmits it to the stop control system 100. Of these, the "account number" may be added by the additional information addition unit 122A, the withdrawal account number and "sender verified" may be added by the reliability information addition unit 123A, or all of them may be added by the additional information addition unit 122A.

[0105] In the example above, since the distribution information 312-1 includes "name" and "address," and the reliability of that information is sufficiently high, the service system 120A transmits it as additional information 313-1, which includes the customer's withdrawal account number included in the customer information. If the reliability of that information is not sufficient (for example, if the situation 405 is "self-declared"), the service system 120A may decide not to transmit the withdrawal account number. Alternatively, the information to be included in additional information 313-1 may be selected according to the reliability level of the received distribution information 312. For this reason, each service system 120 may, after transmitting additional information 313 for a given case, generate and transmit new additional information 313 that includes information not included last time if it receives new distribution information 312 with higher reliability.

[0106] Furthermore, the first record in customer information 124B shown in Figure 9 also pertains to the same person as the first record in customer information 124A. However, the address of the customer in customer information 124B is not the most up-to-date information and does not match the distribution information 312-1. Therefore, the service system 120B cannot determine whether to suspend the service corresponding to that customer, nor can it generate the additional information 313.

[0107] On the other hand, the customer information 124C shown in Figure 10 does not include the customer's name or address, but it does include an authentication telephone number 1003. The authentication telephone number 1003 of the first record in the customer information 124C shown in Figure 10 is the same as the "telephone number" value in the distribution information 312-1. However, since the "telephone number" in the distribution information 312-1 is "self-reported," it is not possible to confirm whether the person reported it correctly (i.e., whether it is highly reliable). For this reason, the service system 120C cannot decide to suspend the service corresponding to that customer, nor can it generate the additional information 313.

[0108] Therefore, service systems 120B and 120C may notify the stop control system 100 that they were unable to generate additional information 313, or they may send empty additional information 313 to the stop control system 100.

[0109] Figure 13 is an explanatory diagram showing a second example of the distribution information 312 distributed by the stop control system 100 of the embodiment of the present invention.

[0110] Specifically, Figure 13 shows an example of the distribution information 312-2 distributed in step S304-2 of Figure 5. This is generated by the stop control system 100 updating the distribution information 312-1 shown in Figure 11 based on the additional information 313-1 shown in Figure 12. In this example, a record related to "user attributes" shown in Figure 12 is added to the end. The status 405 of that record is updated to "verified". This is because the information in that record satisfies the conditions of the second record in the evaluation criteria table 108 shown in Figure 6.

[0111] Figure 13 shows an example of distribution information 312-2 delivered to service system 120B operated by code payment service provider B. Therefore, the content 403 corresponding to "recipient" is "code payment service provider B". In step S304-2, similarly, distribution information 312 is also delivered to service system 120C operated by code payment service provider C. In this distribution information 312, the content 403 corresponding to "recipient" is "code payment service provider C".

[0112] Figure 14 is an explanatory diagram showing a second example of additional information 313 transmitted by the service system 120 of the embodiment of the present invention.

[0113] Specifically, Figure 14 shows an example of additional information 313-2 transmitted by the service system 120B in step S305-4 of Figure 5. This information is generated by the service system 120B by comparing the distribution information 312-3 shown in Figure 13 with the customer information 124B of code payment service provider B shown in Figure 9.

[0114] In this example, the content 403 of the "account number" included in the distribution information 312-2 matches the deposit source account number 904 of the first record in the customer information 124B, and the status 405 of the "account number" is "verified" (i.e., highly reliable), thus identifying the lost user as the customer corresponding to that record. In addition, the distribution information 312-2 includes "smartphone" as a lost item. From this, the service suspension determination unit 121B of the service system 120B determines that there is a high probability that the smartphone, which is a means of providing the payment service, has been lost, and suspends the service.

[0115] Code payment service provider B obtains the customer's telephone number and uses it for authentication when providing its service. Therefore, the reliability information addition unit 123B of the service system 120B generates additional information 313-2, which includes a record in which the information classification 401 is "User Attribute", the information item 402 is "Telephone Number", the content 403 is the value of the authentication telephone number 905 obtained from customer information 124B, the information source 404 is "Customer Information / Authentication Information", and the status 405 is "Sender Verified", and transmits it to the stop control system 100.

[0116] On the other hand, since the customer information 124C shown in Figure 10 does not include an account number, the service system 120C is unable to make a decision to suspend the service corresponding to that customer, nor is it able to generate the additional information 313.

[0117] Figure 15 is an explanatory diagram showing a third example of the distribution information 312 distributed by the stop control system 100 of the embodiment of the present invention.

[0118] Specifically, Figure 15 shows an example of the distribution information 312-3 distributed in step S304-3 of Figure 5. This is generated by the stop control system 100 updating the distribution information 312-2 shown in Figure 13 based on the additional information 313-2 shown in Figure 14. In this example, based on the record for "user attributes" shown in Figure 14, the information source 404 corresponding to "telephone number" is updated to "customer information / authentication information". Furthermore, since the information in the said record satisfies the condition of the third record in the evaluation criteria table 108 shown in Figure 6, the status 405 corresponding to "telephone number" is updated to "verified".

[0119] Service system 120A has already updated the service alert level and has sent supplemental information 313-1, and therefore has no further information to add. For this reason, service system 120A will not send any new supplemental information 313.

[0120] When the service system 120C received the distribution information 312-1, the telephone number included in the distribution information 312-1 matched the telephone number included in the company's customer information 124-C, but the reliability was low, so it was not possible to suspend the service. On the other hand, in the distribution information 312-3 received this time, the status 405 corresponding to the telephone number is "confirmed". Therefore, the service suspension determination unit 121C, along with the fact that the lost item is a "smartphone", determines that the loss will have an impact on the company's provision of services and suspends the provision of services to the customer in question (step S305-7).

[0121] On the other hand, service system 120C does not send new additional information 313 because it does not have any further information to add to the distribution information 312-3. As a result, stop control system 100 is unable to obtain new additional information 313 from any of the service systems 120 and terminates the iterative processing from step S303 onward.

[0122] Next, as another example of the recipient selection process, we will explain the probabilistic selection of recipients.

[0123] In the above embodiment, the distribution destination selection unit 102 selects all service systems 120 as the distribution destinations for the initial distribution information 312 when it receives loss information 311 for a certain case. Subsequently, if the distribution information 312 is updated by additional information from any one of the service systems 120, it selects all service systems 120 other than the source of the additional information 313 as the distribution destinations. This ensures that information is distributed without exception to all service systems 120 that provide services to the user related to the loss case, that is, all service systems 120 that may need to suspend services to the user and may be able to add information about the user.

[0124] However, this means that the information will also be distributed to service systems 120 that do not actually provide services to the user in question. Since the distributed information 312 may include personal information such as the user's name and address, it is desirable not to distribute the distributed information 312 to service systems 120 that do not provide services to the user in question in order to minimize the risk of misuse and leakage of personal information.

[0125] If the shutdown control system 100 were to retain customer information 124 for each service system 120, it could narrow down the distribution destinations to the minimum necessary based on that information. However, from the perspective of minimizing the risk of leakage, as described above, it is undesirable for the shutdown control system 100 to retain customer information 124 for each service system 120.

[0126] The following describes a probabilistic method for selecting distribution destinations to minimize risks such as data leaks, while excluding service systems 120 that do not provide services to users regarding lost data incidents from the information distribution destinations as much as possible.

[0127] Figure 16 is a sequence diagram showing an example of the filter list generation and sharing process performed in the system of the embodiment of the present invention.

[0128] The process shown in Figure 16 may be executed periodically (for example, once a month), or it may be executed whenever the customer information 124 of each service system 120 is updated.

[0129] First, each service system 120 extracts customer attribute information from customer information 124 (step S1601). For example, attribute information such as the customer's name, address, account number, and telephone number is extracted.

[0130] Next, each service system 120 generates a filter list based on the hash value of the attribute information of each extracted item (step S1602). Details of this process will be described later (see Figure 17).

[0131] Next, each service system 120 sends the generated filter list to the shutdown control system 100 (step S1603). The shutdown control system 100 updates the filter list table 109 by adding the filter lists received from each service system 120 (step S1604).

[0132] Figure 17 is a sequence diagram showing an example of the filter list generation process performed in the system of the embodiment of the present invention.

[0133] Specifically, Figure 17 shows an example of the process performed in step S1602 of Figure 16. The attribute value 1701 is the value of the customer attribute information extracted in step S1601. Figure 17 shows the account number of each customer as an example. The service system 120 generates an attribute hash value 1702 by performing an operation on the attribute value 1701 using a predetermined hash function (step S1704).

[0134] Next, the service system 120 generates a filter list 1703 by extracting some digits of the attribute hash value 1702 and then removing duplicates (step S1705). In the example in Figure 17, the top four digits of the attribute hash value 1702 are extracted. As a result, for example, "9d3be2cf9a4a...", "9d3bef0ed942...", and "9d3bebc03ee8..." included in the attribute hash value 1702 all become "9d3b", and duplicate removal is performed by deleting two of them.

[0135] Figure 17 shows an example of generating a filter list 1703 from the hash value of the account number. Similarly, hash values ​​are calculated for other attribute values ​​(e.g., name, address, etc.) of the customer information 124 held by each service system 120, and a filter list 1703 is generated based on these values.

[0136] The fewer digits in the hash value included in the filter list 1703, the lower the risk of the original attribute value being reconstructed from the hash value, and the amount of data to be stored and the resulting processing load are also reduced. On the other hand, duplication of hash values ​​generated from different attribute values ​​becomes more likely, which increases the likelihood of so-called false positives in the probabilistic destination selection process described later, where destinations that are not actually needed are selected.

[0137] The number of digits in the hash value to be included in the filter list 1703 can be determined by each service system 120, depending on the number of attribute values ​​held by each service system 120 and the degree of privacy protection required. However, the hash function used must be uniform across all systems, or at the very least, the shutdown control system 100 must know the hash function used by each service system 120.

[0138] Figure 18 is an explanatory diagram showing an example of a filter list table 109 generated in the system of the embodiment of the present invention.

[0139] The filter list table 109 includes the service system 1801, attribute 1802, and filter list 1803. The service system 1801 is information that identifies the service system 120 that generated the filter list 1703 (for example, the name of the business operator operating the service system 120). Attribute 1802 indicates the attribute value items that formed the basis for generating the filter list 1703 (for example, customer account number, name, address, etc.). The filter list 1803 corresponds to the filter list 1703 generated by each service system 120 for each attribute value.

[0140] The value of filter list 1803 corresponding to the attribute "account number" of the service system "Company D" shown in the example in Figure 18 is the same as filter list 1703 shown in Figure 17. Furthermore, filter lists generated from the hash values ​​of the attribute values ​​of each item in each service system, such as the filter list corresponding to "name" of "Company D" and the filter list corresponding to "account number" of "Company E," are registered in filter list table 109. As shown in Figure 18, the number of digits in the hash values ​​included in filter list 1803 may differ depending on the service system 120 or the type of attribute.

[0141] Figure 19 is a sequence diagram showing an example of a probabilistic destination selection process performed in the system of the embodiment of the present invention.

[0142] In this example, in the destination selection process (step S303) shown in Figure 3, instead of the destination selection unit 102 executing the process described with reference to Figures 3 and 5, the destination probabilistic selection unit 103 executes the processes in steps S1901 and S1902 shown in Figure 19.

[0143] When the probabilistic destination selection unit 103 generates distribution information 312 from the loss information 106, it calculates the hash value of the attribute value of each item corresponding to the user attribute of the loss information 106 and extracts a value of a predetermined number of digits, similar to when generating the filter list 1703 (step S1901). Then, the probabilistic destination selection unit 103 checks whether the extracted value is registered in the filter list table 109 (step S1902).

[0144] If the retrieved value is registered in the filter list table 109, it is highly likely that the service system 120 corresponding to the value in the registered filter list 1803 is providing services to the user of the lost information 106. For this reason, the distribution destination probabilistic selection unit 103 selects the corresponding service system 120 as the distribution destination for the information.

[0145] On the other hand, service systems other than the service system 120 corresponding to the value in the registered filter list 1803 (i.e., unsupported service systems 120) are unlikely to be providing services to the user of the lost information 106. For this reason, the probabilistic distribution destination selection unit 103 excludes the unsupported service systems 120 from the information distribution destinations.

[0146] In general, the same hash value can be generated from different values. In addition, in this embodiment, some digits of the hash value are extracted and duplicates are removed to generate a filter list. Therefore, there is a possibility that a service system 120 that does not actually provide services to users may be selected as a destination for information distribution. However, probabilistically, it can be expected that most of the service systems 120 that do not provide services to users will be excluded from distribution destinations, thereby significantly reducing the risk of information leakage.

[0147] The number of digits in the hash value used in the filter list 1803 can be used to control the probability of selecting a service system 120 that does not actually provide services to users as a destination for information distribution, i.e., the probability of a false positive.

[0148] In the example above, probabilistic selection is performed based on a hash value obtained using a single hash function, but it is also possible to use multiple hash functions. In that case, for example, a so-called Bloom filter may be used.

[0149] Specifically, a bit sequence of a predetermined length is prepared, in which all bits are initially set to 0. Each service system 120 obtains multiple hash values ​​by inputting each attribute value of the customer information 124 it holds into multiple hash functions, and sets the bit corresponding to each hash value in the prepared bit sequence to 1. This is done for all attribute values ​​held by each service system 120, and the resulting bit sequence (i.e., information showing all combinations of multiple hash values ​​generated from the attribute values ​​of the customer information 124) is stored in the stop control system 100 as a Bloom filter for each service system 120.

[0150] The stop control system 100 obtains multiple hash values ​​by inputting the user attribute values ​​contained in the loss information 106 into the same multiple hash values ​​as described above, and selects a service system 120 that generates a bit sequence in which all bits corresponding to those multiple hash values ​​are 1 (i.e., a service system 120 that generates a hash value with the same combination as the combination of multiple hash values ​​generated from the loss information 106) as the destination for the distribution information 312. It is known that this reduces the probability of false positives compared to when a single hash value is used.

[0151] Furthermore, the shutdown control system 100 may transmit dummy distribution information to prevent the misuse of personal information contained in the distribution information 312. Dummy distribution information includes information about non-existent lost items belonging to non-existent users, unrelated to any actual loss that has occurred, and may be generated by the shutdown control system 100 at random times and transmitted to the all-service system 120.

[0152] For example, the stop control system 100 may distribute dummy distribution information at a frequency equivalent to or more than the distribution information 312 containing actual loss information. As a result, the distribution information acquired by each service system 120 will include a large amount of dummy distribution information, reducing its value as a list of users' personal information. This reduces the incentive to illegally acquire and misuse the distribution information.

[0153] The system of the embodiment of the present invention may be configured as follows, for example.

[0154] (1) A stop control system (e.g., stop control system 100) that controls the suspension of services provided to customers by a service system, comprising a control device (e.g., control device 201) and a storage device (e.g., main storage device 202 and auxiliary storage device 203), wherein the storage device holds loss information (e.g., loss information 106 held based on loss information 311), the loss information includes information indicating a lost item (e.g., information item 402 corresponding to "lost item") and information indicating a person who lost something (e.g., information item 402 corresponding to "user attribute"), and the control device distributes information including at least a portion of the loss information. The system distributes the information to multiple service systems, each providing predetermined services to multiple customers (for example, steps S303 and S304). If additional information is received from any of the service systems, the system updates the lost information with the additional information (for example, step S310). The system then distributes the information, including at least a portion of the updated lost information, to service systems other than the one that sent the additional information (for example, steps S303 and S304 from the second time onward). If no additional information is received from any of the service systems, the system stops distributing the information.

[0155] This allows for a simple and secure service suspension mechanism to be implemented, as even if the information obtained from the user who lost their device is insufficient, the missing information can be supplemented with information obtained from the service provider, increasing its reliability and providing it to the service provider.

[0156] (2) The stop control system described in (1) above, wherein the loss information further includes information indicating the reliability of the information indicating the lost item and the information indicating the person who lost the item (e.g., situation 405), and the additional information includes at least one of the following: information of a new item to be added to the distribution information (e.g., information to be added to the distribution information as a new record), and information indicating the reliability of the information of the item included in the distribution information (e.g., information indicating the reliability of the information of the record in the distribution information), and the control device updates the loss information by adding the information of the new item and updating the reliability information based on the additional information.

[0157] This allows for increased reliability by supplementing insufficient information obtained from the user who lost their device with information acquired from the service provider, even if the information obtained from the user is insufficient.

[0158] (3) The stop control system described in (2) above, wherein the loss information further includes information indicating the source of the loss information (for example, content 403 corresponding to "source"), and information indicating the source of the information indicating the lost item and the person who lost the item (for example, source 404), the storage device holds evaluation criteria information (for example, evaluation criteria table 108) indicating criteria for evaluating the reliability of the information based on the source of the information, the source of the information, and the reliability verification status, and the control device updates the reliability information included in the loss information based on the loss information, the additional information, and the evaluation criteria information (for example, steps S302, S310).

[0159] This ensures that the reliability of the information is appropriately evaluated according to predetermined standards.

[0160] (4) The stop control system described in (1) above, wherein the control device obtains from each of the service systems a list of predetermined partial digits of the hash value of the information relating to each customer held by each of the service systems (e.g., a filter list 1703), and if the predetermined partial digits of the hash value of the value of the item included in the lost information are included in the list obtained from any of the service systems, the control device selects that service system as the destination for the distribution information (e.g., steps S1901, S1902), and distributes the distribution information to the service system selected as the destination (e.g., step S304).

[0161] This reduces the amount of information sent to unnecessary recipients, thereby lowering the risk of misuse and leakage of personal information.

[0162] (5) The stop control system described in (1) above, wherein the control device obtains from each service system information (for example, a so-called Bloom filter) that indicates a combination of multiple hash values ​​of information about each customer held by each service system, generated based on a plurality of hash functions, and if a combination of hash values ​​of the values ​​of the items included in the lost information, generated based on the plurality of hash functions, is included in the combination obtained from any of the service systems, the control device selects that service system as the destination for the distribution information and distributes the distribution information to the service system selected as the destination.

[0163] This reduces the amount of information sent to unnecessary recipients, thereby lowering the risk of misuse and leakage of personal information.

[0164] (6) The stop control system described in (1) above, wherein the control device further generates dummy distribution information that includes information about a non-existent person, and distributes the dummy distribution information to the plurality of service systems.

[0165] This reduces the usefulness of the distributed data and lowers the risk of misuse and leakage of personal information.

[0166] (7) A service system (e.g., service system 120) that provides predetermined services to customers, comprising a control device (e.g., control device 201) and a storage device (e.g., main storage device 202 and auxiliary storage device 203), wherein the storage device holds customer information (e.g., customer information 124) for the service, and when the control device receives distribution information (e.g., distribution information 312) which includes information indicating a lost item, information indicating a person who lost the item, and information indicating the reliability of the information indicating the lost item and the person who lost the item, it determines, based on the distribution information and the customer information, whether it is necessary to stop providing the service to any customer, and the distribution The system determines whether it is possible to add information on new items to the information and to add information indicating the reliability of the items included in the distributed information (for example, steps S306 to S308). If it is necessary to stop providing the service to any customer, the system stops providing the service to that customer (for example, step S306). If it is possible to add information on new items to the distributed information and to add information indicating the reliability of the items included in the distributed information, the system generates additional information including such information (for example, steps S307 to S308) and transmits the additional information to the source of the distributed information (for example, step S309).

[0167] This allows us to provide information that other companies may be able to use to decide whether to suspend their services, while also enabling us to make appropriate decisions about suspending our own services.

[0168] (8) In the service system described in (7) above, the control device determines that it is necessary to suspend service to a customer if the person indicated by the distribution information is the same as any of the customers included in the customer information, and the customer is determined to be highly reliable based on the reliability information included in the distribution information. If the person indicated by the distribution information is the same as any of the customers included in the customer information, and the customer is determined to be highly reliable based on the reliability information included in the distribution information (for example, step S306), and the customer information includes information on items not included in the distribution information with respect to the customer, or includes information on the reliability of the items included in the distribution information, the control device determines that it is possible to add information on new items to the distribution information and add information indicating the reliability of the items included in the distribution information (for example, steps S307 to S308).

[0169] This allows us to provide information that other companies may be able to use to decide whether to suspend their services, depending on the reliability of the information we distribute, while also enabling us to make appropriate decisions about suspending our own services.

[0170] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are explained in detail for a better understanding of the present invention, and are not necessarily limited to those having all of the configurations described. Furthermore, it is possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is possible to add configurations from other embodiments to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0171] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by a processor interpreting and executing programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in storage devices such as non-volatile semiconductor memory, hard disk drives, and SSDs (Solid State Drives), or in computer-readable non-temporary data storage media such as IC cards, SD cards, and DVDs.

[0172] Furthermore, the control lines and information lines shown are those deemed necessary for explanation purposes, and do not necessarily represent all control lines and information lines in the actual product. In practice, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0173] 100 Stop Control System 101 Lost Information Receiving Unit 102 Distribution Destination Selection Department 103 Probabilistic Selection Unit for Distribution Destinations 104 Additional Information Receiving Unit 105 Information Reliability Evaluation Department 106 Lost Information 107 Additional Information / Reliability Information 108 Evaluation Criteria Table 109 Filter List Table 110 Lost Information Registration System 111 Lost Information Registration Department 120A~120C Service System 121A~121C Service Stop Decision Unit 122A~122C Additional Information Section 123A~123C Reliability Information Addition Section 124A~124C Customer information 125A Alert Level Update Information 130 Communication Networks

Claims

1. A service system that controls the interruption of services provided to customers by the service system, A control device and a memory device are included. The aforementioned storage device holds the lost information, The aforementioned loss information includes information indicating the lost item and information indicating the person who lost it. The control device is Distribution information, including at least a portion of the aforementioned lost information, is distributed to multiple service systems, each providing predetermined services to multiple customers. If additional information is received from any of the service systems, the lost information is updated with the additional information. Distribution information, including at least a portion of the updated loss information, is distributed to at least service systems other than the service system that transmitted the additional information. A stop control system characterized by stopping the distribution of the distribution information if the additional information is not received from any of the service systems.

2. A stop control system according to claim 1, The aforementioned loss information further includes information indicating the reliability of the information indicating the lost item and the information indicating the person who lost the item, The additional information includes at least one of the following: information on new items to be added to the distribution information, and information indicating the reliability of the information on items included in the distribution information. The stop control system is characterized in that the control device updates the lost information by adding information about the new item and updating the reliability information based on the additional information.

3. A stop control system according to claim 2, The aforementioned loss information further includes information indicating the source of the loss information, information indicating the source of the information indicating the lost item and the person who lost the item, The storage device holds evaluation criteria information that indicates criteria for evaluating the reliability of information based on the source of the information, the information source, and the status of reliability verification. The control device is characterized by updating the reliability information included in the loss information based on the loss information, the additional information, and the evaluation criteria information.

4. A stop control system according to claim 1, The control device is A list of predetermined partial values ​​from the hash values ​​of the information about each customer held by each service system is obtained from each service system. If the value of a predetermined portion of the hash value of an item included in the loss information is included in a list obtained from any of the service systems, then that service system is selected as the destination for the distribution information. A stop control system characterized by distributing the distribution information to a service system selected as the distribution destination.

5. A stop control system according to claim 1, The control device is Information is obtained from each of the service systems that represents a combination of multiple hash values ​​of information about each customer held by each of the service systems, generated based on multiple hash functions. If a combination of hash values ​​of items included in the lost information, generated based on the aforementioned plurality of hash functions, is included in a combination obtained from any of the service systems, then that service system is selected as the destination for the distribution information. A stop control system characterized by distributing the distribution information to a service system selected as the distribution destination.

6. A stop control system according to claim 1, The stop control system is further characterized by the control device generating dummy distribution information containing information about a non-existent person, and distributing the dummy distribution information to the plurality of service systems.

7. A service system that provides a predetermined service to a customer, A control device and a memory device are included. The storage device holds customer information for the service, The control device is Upon receiving distribution information including information indicating a lost item, information indicating the person who lost the item, and information indicating the reliability of the information indicating the lost item and the person who lost the item, the system determines, based on the distribution information and the customer information, whether it is necessary to suspend the provision of the service to any of the customers, and whether it is possible to add information on new items to the distribution information and to add information indicating the reliability of the items included in the distribution information. If it becomes necessary to suspend the provision of the aforementioned services to any customer, the provision of the aforementioned services to that customer shall be suspended. If it is possible to add information on new items to the aforementioned distribution information and to add information indicating the reliability of the items included in the aforementioned distribution information, then additional information including such information is generated. A service system characterized by transmitting the aforementioned additional information to the source of the distribution information.

8. A service system according to claim 7, The control device is If the person indicated in the distribution information is the same as any of the customers included in the customer information, and the customer is deemed highly reliable based on the reliability information included in the distribution information, then it is determined that it is necessary to suspend services to that customer. A service system characterized in that, if the person indicated in the distribution information is the same as any of the customers included in the customer information, and the customer information is determined to be highly reliable based on the reliability-indicating information included in the distribution information, and the customer information includes information on items not included in the distribution information with respect to that customer, or includes information on the reliability of the items included in the distribution information, then it is determined that at least one of the following is possible: adding information on new items to the distribution information and adding information indicating the reliability of the items included in the distribution information.

9. A stop control system is a stop control method that controls the stop of services provided to customers by a service system, The stop control system comprises a control device and a storage device. The aforementioned storage device holds the lost information, The aforementioned loss information includes information indicating the lost item and information indicating the person who lost it. The aforementioned stop control method is, The control device distributes distribution information, which includes at least a portion of the lost information, to multiple service systems, each providing predetermined services to multiple customers; When the control device receives additional information for the distribution information from any of the service systems, the procedure includes updating the lost information with the additional information, The control device provides a procedure for distributing distribution information, which includes at least a portion of the updated loss information, to service systems other than the service system that transmitted the additional information, A stop control method characterized by including a step of stopping the distribution of the distribution information if the control device does not receive the additional information from any of the service systems.

Images