Key ordering device, key ordering method, and program

Abstract

The present invention provides a key ordering device, method, and program that approves a key ordering request based on key identification information as well as authentication information verifying the user's identity. [Solution] The duplicate key ordering device includes a receiving unit that, at the time of registration, receives key identification information that identifies the original key 25 entered from the terminal 20, and personal authentication information transmitted from the server on the condition that the user's identity has been authenticated by the server of an external authentication authority based on the input of authentication request information from the terminal, and stores them in a storage unit in association with each other; and an approval unit that, at the time of ordering a duplicate key 65, receives the input of key identification information from the terminal and also receives personal authentication information transmitted from the authentication authority server 30 on the condition that the user's identity has been authenticated by the authentication authority server 30 based on the input of authentication request information from the terminal, and approves the duplicate key order if the key identification information and personal authentication information at the time of ordering a duplicate key are associated in the storage unit.

Description

Technical Field

[0004] ,

[0003] , , , , , , ,

[0005] ,

[0001] The present invention relates to a duplicate key ordering device, a duplicate key ordering method, and a program.

Background Art

[0002] Patent Document 1 describes that "in one aspect of the present invention, a duplicate key ordering method is provided. The duplicate key ordering method may include a verification step of verifying first information obtained by an ordering terminal from at least one of a master key and accessories linked to the master key, and second information regarding the shape of the key managed by a management server." [Prior Art Document] [Patent Document] [Patent Document 1] JP-A-2022-073257

Summary of the Invention

[0003] In a first aspect of the present invention, a duplicate key ordering device is provided. The duplicate key ordering device may include a reception unit that, at the time of registration, receives key identification information for identifying a key input from a terminal and personal authentication information transmitted from a server of an external authentication institution on the condition that the person has been authenticated by the server based on an input of authentication request information for requesting personal authentication from the terminal, and stores them in a storage unit in association with each other. Any of the duplicate key ordering devices may, at the time of duplicate key ordering, receive an input of key identification information from a terminal, and receive personal authentication information transmitted from the server on the condition that the person has been authenticated by the server of the authentication institution based on an input of authentication request information from the terminal, and may include an approval unit that approves an order for a duplicate key when the key identification information at the time of duplicate key ordering and the personal authentication information at the time of duplicate key ordering are associated with each other in the storage unit.

[0004] In any of the above duplicate key ordering devices, the authentication request information may be information read by the terminal from an IC card issued by a public authentication institution.

[0005] In any of the above-mentioned key ordering devices, the reception unit may request an image of the key on the terminal during registration, and upon receiving the image, store the key identification information and the user authentication information in association with each other in the storage unit.

[0006] In any of the above-mentioned key ordering devices, the storage unit may store the key identification information and the key shape in association. In any of the above-mentioned key ordering devices, the receiving unit may, upon receiving the image, analyze the key shape from the image and, on the condition that it has confirmed the analyzed shape with the shape stored in the storage unit, store the personal authentication information in the storage unit.

[0007] A second aspect of the present invention provides a method for ordering a duplicate key. The duplicate key ordering method may include a registration step of receiving key identification information that identifies a key entered from a terminal and personal authentication information transmitted from an external authentication authority's server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and storing them in a storage unit in association with each other. Either of the above duplicate key ordering methods may include a duplicate key ordering step of receiving key identification information from a terminal and personal authentication information transmitted from the server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and approving the duplicate key order if the key identification information and personal authentication information at the time of the duplicate key order are associated in the storage unit.

[0008] A third aspect of the present invention provides a program that is executed by a computer. The program may implement a registration function that allows the computer to receive key identification information that identifies a key entered from a terminal, and personal authentication information transmitted from an external authentication authority's server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and to store them in a storage unit in association with each other. Any of the above programs may implement a duplicate key ordering function that allows the computer to receive key identification information from a terminal, and to receive personal authentication information transmitted from the server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and to approve the duplicate key order if the key identification information and personal authentication information at the time of the duplicate key order are associated in the storage unit.

[0009] It should be noted that the above summary of the invention does not enumerate all of its features. Furthermore, subcombinations of these features may also constitute an invention. [Brief explanation of the drawing]

[0010] [Figure 1] An example of a system including a key ordering device 100 is shown. [Figure 2] An example of a table stored in the storage unit 103 is shown. [Figure 3] An example of the blade portion of the original key 25 is shown. [Figure 4] An example of a table stored in the certification authority server 30 is shown. [Figure 5] An example of the screen of terminal 20 when communicating with the key ordering device 100 is shown. [Figure 6] This shows an example of the screen displayed on terminal 20 when registering the original key 25 to the duplicate key ordering device 100. [Figure 7] An example of the display screen for the user authentication application is shown. [Figure 8] This shows the operation flow of terminal 20, duplicate key ordering device 100, and certification authority server 30 when registering the original key 25. [Figure 9] An example of the screen displayed on terminal 20 when ordering a duplicate key is shown. [Figure 10] This diagram shows the operation flow of terminal 20, key ordering device 100, and authentication authority server 30 when ordering a duplicate key. [Figure 11] An example of a system according to another embodiment is shown. [Figure 12] Figure 11 shows the operation flow of the terminal 20, the key installation company server 70, the key ordering device 100, and the certification authority server 30 when ordering a duplicate key. [Figure 13] Examples of a computer 2200 in which multiple aspects of the present invention may be embodied in whole or in part are shown. [Modes for carrying out the invention]

[0011] The present invention will be described below through embodiments of the invention, but these embodiments are not intended to limit the invention as defined in the claims. Furthermore, not all combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0012] Figure 1 shows an example of a system including a key ordering device 100. In this system, the key ordering device 100, terminal 20, authentication authority server 30, key factory 60, and key management server 80 communicate with each other through a communication network 50. The communication network 50 is, for example, the Internet.

[0013] The key ordering device 100 registers the original key 25 owned by user 21. The key ordering device 100 then accepts an order for a duplicate key related to the registered original key 25 and decides whether to approve the order. If the key ordering device 100 approves the order, it sends a notification of approval to the key factory 60. The key factory 60 creates a duplicate key 65 and sends the duplicate key 65 to user 21.

[0014] The duplicate key ordering device 100 is operated and managed by, for example, a key manufacturer (also referred to as a lock manufacturer). The duplicate key ordering device 100 includes a reception unit 101, a storage unit 103, and an approval unit 105.

[0015] The original key 25 is a key that opens and closes the lock of the entrance to and exit from a building, and is an original key manufactured by a key manufacturer. The original key 25 is, for example, the key to the entrance door of the user 21's house. On the original key 25, key identification information for identifying the original key 25, such as a key number, is engraved. Key cuts are provided on the front and back of the original key 25, and the position and depth of the key cuts determine the blade shape of the original key 25. In addition to key cuts, dimples may be provided on the front and back of the original key 25.

[0016] The IC card 40 is issued to the user 21 and is owned by the user 21. Information unique to the IC card 40, such as a personal number, is stored electronically or magnetically on the IC card 40.

[0017] The terminal 20 is an information terminal operated by the user 21 and is, for example, a smartphone. A duplicate key ordering application and an authentication application are stored in the terminal 20. The duplicate key ordering application is an application for the user 21 to order a duplicate key. The authentication application is an application for requesting the authentication server 30 of the authentication institution to authenticate that the user 21 is the person himself.

[0018] The terminal 20 includes a card reader and a camera. The terminal 20 uses the card reader to read the personal number from the IC card 40 and transmits authentication request information for requesting the authentication server 30 of the authentication institution to authenticate that the user 21 is the person himself to the authentication server 30. The read personal number is included in the authentication request information. The key number is input by the user 21 into the terminal 20. Also, the terminal 20 uses the camera to take an image of the original key 25. As an example, the terminal 20 takes a front image of the original key 25. The terminal 20 transmits the input key number and the taken image of the original key 25 to the reception unit 101. The terminal 20 transmits the key number to the approval unit 105.

[0019] The certification authority server 30 is a device separate from the duplicate key ordering device 100. The certification authority server 30 is the same as or at least related to the issuer of the IC card 40 and is operated and managed by an administrator different from the administrator of the duplicate key ordering device 100. Therefore, it can be said that the certification authority server 30 is a server of an external certification authority with respect to the duplicate key ordering device 100. For example, the issuer of the IC card 40 and the operator of the certification authority server 30 are a public certification authority or an organization established by a plurality of companies. More specifically, the IC card 40 may be a My Number card, and the certification authority server 30 may be a server of the Local Public Entity Information System Agency. The IC card 40 and the certification authority server 30 are not only used for authentication related to the duplicate key ordering device 100 but may also be shared for authentication from other devices.

[0020] The certification authority server 30 stores the personal number of the issued IC card 40. The certification authority server 30 may further store the personal authentication information in association with the personal number.

[0021] FIG. 2 shows an example of a table stored in the storage unit 103 of the duplicate key ordering device 100. The storage unit stores the "key number", "personal authentication information", and "numerical combination" in association with each other. The "numerical combination" is information indicating the shape of the original key 25. The said "numerical combination" is specified by the key manufacturer when the key manufacturer creates the original key 25 and is stored in the key management server 80. The "numerical combination" stored in the third column of the table is, as an example, an 18-digit numerical value. In other words, two sets of 9-digit numerical values are stored in the storage unit 103 as the "numerical combination". The 9-digit numerical value represents the position and depth of the key notches provided on the key.

[0022] To explain how to represent the position and depth of each key notch on a key using a combination of numerical values, refer to Figure 3. The upper part of Figure 3 schematically shows a magnified portion of the blade of the original key 25 from a front view image of the original key 25. The lower part of Figure 3 divides the blade of the original key 25 shown in the upper part into nine rows of lines in the longitudinal direction, and shows the name of each row and the numerical value of the key notch depth along each row. In the example in Figure 3, the numerical values ​​of the key notch depth on the upper part of the image and the numerical values ​​of the key notch depth on the lower part of the image are shown along each row of lines. A larger numerical value indicates a deeper key notch.

[0023] In the example shown in Figure 3, the blade shape of the original key 25 is represented by the 18-digit number combination "034002000 100210300", which is formed by sequentially arranging the numbers in the upper 1st to 9th columns and the lower 1st to 9th columns.

[0024] Figure 4 shows an example of a table stored in the authentication authority server 30. In the example shown in Figure 4, the personal number "1234 5678 9012" is stored in the authentication authority server 30 in association with the personal authentication information "00001". On the other hand, the personal number "9876 5432 1098" is not associated with personal authentication information.

[0025] Each time an IC card 40 is issued, the authentication authority server 30 stores the personal number of the IC card 40 in a table based on input from the administrator. At this point, the personal authentication information corresponding to the personal number, such as "9876 5432 1098" in Figure 4, is not stored in the table. When the authentication authority server 30 receives the first authentication request for the personal number from the key ordering device 100, it generates personal authentication information and stores it in the table in association with the personal number, such as "1234 5678 9012" in Figure 4. The personal authentication information is uniquely set for each personal number, but it is preferable that it is different from the personal number. Furthermore, it is preferable that the personal authentication information and the personal number cannot be inferred from one to the other.

[0026] Figure 5 shows an example of the display screen for the duplicate key ordering application. The duplicate key ordering application is used when registering the original key 25 with the duplicate key ordering device 100 and when ordering a duplicate key 65 from the duplicate key ordering device 100. Accordingly, in the example shown in Figure 5, when the duplicate key ordering application is launched, it displays a registration button 201 and an order button 203.

[0027] In the example shown in Figure 5, the text "Click here to register your original key" is displayed above the registration button 201, prompting user 21 who wishes to register their original key 25 to the key ordering device 100 to press the registration button 201. The text "Click here to order a key" is displayed above the order button 203, prompting user 21 who wishes to order a key 65 to press the order button 203.

[0028] Figure 6 shows an example of the screen displayed on terminal 20 during registration, and Figure 7 shows an example of the screen of the user authentication application. Figure 8 shows the operation flow of terminal 20, duplicate key ordering device 100, and authentication authority server 30 during the registration of the original key 25.

[0029] The key ordering application is launched, and when the registration button 201 shown in Figure 5 is pressed, the operation flow shown in Figure 8 is initiated. When the registration button 201 shown in Figure 5 is pressed, terminal 20 displays the screen shown in Figure 6 and accepts the input of a key number (step S101).

[0030] In the screen shown in Figure 6, the key number field 301 accepts the input of the key number of the original key 25. The words "Please enter the key number." are displayed at the top of the key number field 301, prompting the user 21 to enter the key number into the key number field 301.

[0031] The key image field 303 accepts an image of the original key 25 taken by the terminal 20. The words "Please select an image of the key." are displayed at the top of the key image field 303, prompting the user 21 to enter an image of the original key 25 into the key image field 303. In the example shown in Figure 6, "Front view image" is displayed in the first column of the key image field 303, further prompting the user to enter a front view image of the original key 25 into the key image field 303.

[0032] Terminal 20 activates the authentication link 305 only if the two fields mentioned above are filled in. Note that the image for the original key 25 is not limited to an image taken by terminal 20, but may also be an image downloaded from outside terminal 20.

[0033] Terminal 20 further reads the personal number from the IC card 40 (same step S101). The text "Proceed to IC card authentication" attached to the authentication link 305 prompts the key ordering application to press the authentication link 305 to authenticate the IC card. When a valid authentication link 305 is pressed, the personal authentication application is launched. Figure 7 shows an example of the personal authentication application screen. Using the personal authentication application to read the personal number simplifies the design of the key ordering application. Alternatively, the key ordering application may be used to read the personal number. When the IC card is held over terminal 20 displaying the screen shown in Figure 6, the personal number is read from the IC card 40. Terminal 20 may also read the personal number from the IC card using a card reader.

[0034] Terminal 20 transmits the key number to the reception unit 101 of the key ordering device 100 via the key ordering application (step S103). Terminal 20 further transmits authentication request information, including the personal number, to the authentication authority server 30 via the personal authentication application (step S105).

[0035] The authentication authority server 30 receives authentication request information. The authentication authority server 30 refers to the table shown in Figure 4 and checks whether the personal number included in the received authentication request information is stored in the authentication authority server 30 (step S107). If the received personal number is not stored in the authentication authority server 30, the authentication authority server 30 sends an error value to the key ordering device 100 (step S109).

[0036] If the received personal number is stored in the authentication authority server 30, the authentication authority server 30 refers to the table shown in Figure 4 to confirm whether the received personal number is associated with personal authentication information (step S111). If the received personal number is not associated with personal authentication information, the authentication authority server 30 generates personal authentication information corresponding to the received personal number, associates the two and stores it in the authentication authority server 30, and transmits the generated personal authentication information to the reception unit 101 of the key ordering device 100 (step S113). If the received personal number is associated with personal authentication information, the authentication authority server 30 transmits the personal authentication information associated with the received personal number to the reception unit 101 of the key ordering device 100 (step S113).

[0037] As described above, regardless of whether the received personal number is associated with personal authentication information, the authentication authority server 30 checks whether the received personal number is stored in the authentication authority server 30. Since the authentication authority server 30 stores the personal numbers of all issued IC cards 40, if the received personal number is stored in the authentication authority server 30, it means that the IC card 40 with the received personal number actually exists. Therefore, upon receipt of the personal number, the authentication authority server 30 can consider the user 21 who held the IC card 40 over the terminal 20 to be the person who should be authenticated by the IC card 40. Based on this, the authentication authority server 30 transmits the personal authentication information to the key ordering device 100, provided that the user 21 has been authenticated as the person in question.

[0038] The reception unit 101 of the key ordering device 100 checks whether it has received user authentication information from the authentication authority server 30 (step S115). If the reception unit 101 has not received user authentication information from the authentication authority server 30, it sends a message to the terminal 20 indicating that the original key 25 cannot be registered (step S117). In this embodiment, when the reception unit 101 receives an error value from the authentication authority server 30, or when it does not receive user authentication information from the authentication authority server 30 within a certain period of time, it determines that it has not received user authentication information from the authentication authority server 30. In addition, in the above case, the reception unit 101 determines that it was not authenticated that user 21 is the person in question.

[0039] When the reception unit 101 receives user authentication information from the authentication authority server 30, it associates the key number from the terminal 20 with the user authentication information from the authentication authority server 30 and stores it in the table shown in Figure 2 of the storage unit 103 (step S119). In this embodiment, the reception unit 101 determines that the user authentication information has been received when it is received within the aforementioned time period. In this case, the reception unit 101 reads the "numerical combination" corresponding to the key number from the terminal 20 from the key management server 80 and stores it in the table shown in Figure 2, associating it with the key number from the terminal 20. Subsequently, the reception unit 101 sends a message to the terminal 20 indicating that registration is complete (step S121). This completes the operation flow shown in Figure 8.

[0040] Figure 9 shows an example of the screen of terminal 20 when ordering a duplicate key. Figure 10 shows the operation flow of terminal 20, duplicate key ordering device 100, and authentication authority server 30 when ordering a duplicate key.

[0041] The duplicate key ordering application is launched, and when the order button 203 shown in Figure 5 is pressed, the operation flow shown in Figure 10 is initiated. When the order button 203 shown in Figure 5 is pressed, terminal 20 displays the screen shown in Figure 9 and accepts input of the key number (step S201). On the screen in Figure 9, the key number field 401 is entered with the key number of the original key 25. Terminal 20 activates the authentication link 405 on the condition that the key number field 401 has been entered.

[0042] Terminal 20 further reads the personal number from the IC card 40 (same step S201). When a valid authentication link 405 is pressed in Figure 9, the personal authentication application is launched as shown in Figure 7. When the IC card is held over terminal 20, terminal 20 reads the personal number from the IC card 40. Terminal 20 may read the personal number from the IC card 40 using a card reader.

[0043] Terminal 20 transmits the key number to the approval unit 105 of the key ordering device 100 via the key ordering application (step S203), and the approval unit 105 accepts the key number input from terminal 20. Terminal 20 further transmits authentication request information including the personal number to the authentication authority server 30 via the personal authentication application (step S205).

[0044] The authentication authority server 30 receives authentication request information. The authentication authority server 30 refers to the table shown in Figure 4 and checks whether the personal number included in the received authentication request information is stored in the authentication authority server 30 (step S207). If the received personal number is not stored in the authentication authority server 30, the authentication authority server 30 sends an error value to the key ordering device 100 (step S209).

[0045] If the received personal number is stored in the authentication authority server 30, the authentication authority server 30 refers to the table shown in Figure 4 and checks whether the received personal number is associated with personal authentication information (step S211). If the received personal number is not associated with personal authentication information, the authentication authority server 30 generates personal authentication information corresponding to the received personal number, associates the two and stores it in the authentication authority server 30, and transmits the generated personal authentication information to the approval unit 105 of the key ordering device 100 (step S213). If the received personal number is associated with personal authentication information, the authentication authority server 30 transmits the personal authentication information associated with the received personal number to the approval unit 105 of the key ordering device 100 (step S213).

[0046] The approval unit 105 of the key ordering device 100 checks whether it has received personal authentication information from the authentication authority server 30 (step S215). In this embodiment, when an error value is received from the authentication authority server 30, or when personal authentication information is not received from the authentication authority server 30 within a certain period of time, the approval unit 105 determines that it has not received personal authentication information from the authentication authority server 30.

[0047] If the authentication information is not accepted, the approval unit 105 sends a message to the terminal 20 indicating that the order cannot be approved (step S217). At this time, the approval unit 105 also sends text information indicating that the identity of the user was not authenticated, such as "Your identity could not be authenticated. Please read another IC card."

[0048] When the Approval Unit 105 receives personal authentication information, it refers to the table shown in Figure 2 and checks whether the key number received from the terminal 20 and the personal authentication information received from the authentication authority server 30 are associated in the storage unit 103 (step S219). If the key number and personal authentication information are not associated, the Approval Unit 105 sends a message to the terminal 20 indicating that the order cannot be approved (step S221). At this time, the Approval Unit 105 also sends text information indicating that the user's identity has been verified but does not match the registered information stored in the storage unit, such as "The original key is not registered, or the personal number and key number do not correspond. Please register your original key." The Approval Unit 105 may also send a link to the screen shown in Figure 6 of the key ordering application.

[0049] As described above, the approval unit 105 sends a message to the terminal 20 indicating that the key order cannot be approved if, at least one of the following occurs: the approval unit 105 does not receive the user authentication information from the authentication authority server 30 when ordering a key; or the key number and user authentication information are not associated in the storage unit 103. It also sends information to the terminal 20 so that the user 21 can distinguish between the two cases described above.

[0050] The approval unit 105 approves the order for a duplicate key if it is matched in the storage unit 103. The approval unit 105 places an order for the production of the duplicate key with the key factory 60 (step S223). For example, the approval unit 105 sends an email to the key factory 60 containing information about the original key 25. The information about the original key 25 may include the "combination of numbers" shown in Figure 2. The approval unit 105 sends a message to the terminal 20 confirming that the order for the duplicate key has been approved (step S225). This completes the operation flow shown in Figure 10.

[0051] The key factory 60, having received an order for the production of a duplicate key from the approval department 105, produces the duplicate key 65 and sends the produced duplicate key 65 to the user 21. In this way, the user 21 can easily order a duplicate of the original key 25 using the IC card 40 and their personal number.

[0052] During registration and when ordering duplicate keys, the authentication authority server 30, which is external to the duplicate key ordering device 100, authenticates the user 21. This reduces management costs compared to the duplicate key ordering device 100 and the key maker issuing and managing personal identification numbers. Furthermore, by using the highly public IC card 40 and the authentication authority server 30, user convenience is enhanced, and the security of authentication using personal identification numbers can be expected. In addition, since the authentication authority server 30 authenticates using personal identification numbers, and the duplicate key ordering device 100 associates key numbers with personal identification information different from personal identification numbers, the security of the other can be maintained even if either the personal identification number or the personal identification information is leaked.

[0053] The certification authority server 30 may further communicate with the terminal 20 using public-key cryptography when registering the original key 25 and when ordering a duplicate key. This improves the reliability of communication between the certification authority server 30 and the terminal 20.

[0054] Furthermore, the reception unit 101 requests an image of the original key 25 from the terminal 20 during registration, but the received image may simply be stored in the duplicate key ordering device 100. In another embodiment, the reception unit 101 may store the key number and user authentication information in the storage unit 103, provided that it has received an image of the original key 25. That is, if the reception unit 101 does not receive an image of the original key 25, it may not register the key, regardless of whether the user has been authenticated, and may send a message to the terminal 20 indicating that it will not register the key.

[0055] In another embodiment, when the receiving unit 101 receives an image of the original key 25 during registration, it analyzes the shape of the original key 25 from the image of the original key 25. Image processing means such as smoothing (Gaussian filter), adaptive thresholding, morphological transformation (dilation), cropping, and Hough transform may be used to analyze the shape of the original key 25, or AI-based image recognition technology may be applied. The receiving unit 101 analyzes the shape of the original key 25 and identifies a combination of numerical values ​​corresponding to the shape of the original key 25.

[0056] The reception unit 101 stores the user authentication information in the storage unit 103, provided that it has confirmed the analyzed shape with the shape stored in the storage unit 103. The reception unit 101 confirms that the combination of numbers identified through analysis matches the combination of numbers associated with the received key number. The degree of matching between the two may be above a predetermined threshold, for example, at least 60%. This threshold is stored in the storage unit 103 in advance.

[0057] Figure 11 shows an example of a duplicate key ordering system according to another embodiment. The key installation company server 70 is a server managed by a key installation company (also called a lock installation company). A key installation company is, for example, a sash manufacturer. In this embodiment, when the approval unit 105 receives input of a key number via the key installation company server 70 during a duplicate key order, it requests the terminal 20 to input authentication request information.

[0058] Figure 12 shows the operation flow of terminal 20, key installation company server 70, key ordering device 100, and authentication authority server 30 when ordering a duplicate key. The operation flow shown in Figure 12 starts when the application for contacting the key installation company is launched. Terminal 20 accepts input of the key number and terminal 20's contact information (step S301). In this embodiment, the contact information is an email address. Terminal 20 sends the entered key number and email address to the key installation company server 70 (step S303), and the key installation company server 70 accepts input of the key number and terminal 20's contact information.

[0059] The key installation company server 70 transmits the received key number and email address to the approval unit 105 of the key ordering device 100 (step S305). The approval unit 105 receives the key number and email address and sends an authentication request email to the received email address (step S307). When terminal 20 receives the authentication request email, it launches the personal authentication application. Terminal 20 reads the personal number from the IC card 40 using the personal authentication application (step S309) and transmits authentication request information including the personal number to the authentication authority server 30 (step S311).

[0060] Step S313 is the same operation as step S207 shown in Figure 10. Similarly, each of steps S315 through S331 is the same operation as each of steps S209 through S225 shown in Figure 10.

[0061] In any of the above embodiments, when the authentication authority server 30 receives the first authentication request for the personal number from the key ordering device 100, it generates personal authentication information and stores it in the table in association with the personal number. Alternatively, the authentication authority server 30 may generate personal authentication information at the time the personal number is stored in the table and store it in the table in association with the personal number.

[0062] Furthermore, the authentication authority server 30 may also be shared to perform authentication for authentication requests from devices other than the key ordering device 100. In that case, if the authentication request from the other device is made before the one from the key ordering device 100, the authentication information may be generated at that point and stored in a table in association with the personal number.

[0063] Figure 13 shows an example of a computer 2200 in which multiple aspects of the present invention may be embodied in whole or in part. A program installed on the computer 2200 can cause the computer 2200 to function as an operation or one or more sections of an apparatus according to an embodiment of the present invention, or to execute such operation or one or more sections, and / or to cause the computer 2200 to execute a process or a stage of such process according to an embodiment of the present invention. Such a program may be executed by the CPU 2212 to cause the computer 2200 to perform a particular operation associated with some or all of the blocks in the flowcharts and block diagrams described herein.

[0064] The computer 2200 according to this embodiment includes a CPU 2212, RAM 2214, a graphics controller 2216, and a display device 2218, which are interconnected by a host controller 2210. The computer 2200 also includes input / output units such as a communication interface 2222, a hard disk drive 2224, a DVD-ROM drive 2226, and an IC card drive, which are connected to the host controller 2210 via an input / output controller 2220. The computer also includes legacy input / output units such as a ROM 2230 and a keyboard 2242, which are connected to the input / output controller 2220 via an input / output chip 2240.

[0065] The CPU 2212 operates according to programs stored in the ROM 2230 and RAM 2214, thereby controlling each unit. The graphics controller 2216 acquires image data generated by the CPU 2212 either in the frame buffer provided in RAM 2214 or within itself, and displays the image data on the display device 2218.

[0066] The communication interface 2222 communicates with other electronic devices via a network. The hard disk drive 2224 stores programs and data used by the CPU 2212 in the computer 2200. The DVD-ROM drive 2226 reads programs or data from the DVD-ROM 2201 and provides them to the hard disk drive 2224 via the RAM 2214. The IC card drive reads programs and data from the IC card and / or writes programs and data to the IC card.

[0067] The ROM 2230 stores boot programs and / or programs that depend on the computer 2200's hardware, which are executed by the computer 2200 when activated. The input / output chip 2240 may also connect various input / output units to the input / output controller 2220 via parallel ports, serial ports, keyboard ports, mouse ports, etc.

[0068] The program is provided on a computer-readable medium such as a DVD-ROM 2201 or an IC card. The program is read from the computer-readable medium and installed on a hard disk drive 2224, RAM 2214, or ROM 2230, which are also examples of computer-readable medium, and executed by the CPU 2212. The information processing described within these programs is read by the computer 2200, resulting in coordination between the program and the various types of hardware resources described above. The apparatus or method may be configured to realize the manipulation or processing of information in accordance with the use of the computer 2200.

[0069] For example, when communication is performed between a computer 2200 and an external device, the CPU 2212 may execute a communication program loaded into RAM 2214 and, based on the processing described in the communication program, instruct the communication interface 2222 to perform communication processing. Under the control of the CPU 2212, the communication interface 2222 reads transmission data stored in a transmission buffer processing area provided in a recording medium such as RAM 2214, a hard disk drive 2224, a DVD-ROM 2201, or an IC card, transmits the read transmission data to the network, or writes received data received from the network to a reception buffer processing area provided on the recording medium.

[0070] Furthermore, the CPU 2212 may read all or necessary parts of files or databases stored on external storage media such as the hard disk drive 2224, DVD-ROM drive 2226 (DVD-ROM 2201), or IC card into the RAM 2214, and perform various types of processing on the data in the RAM 2214. The CPU 2212 then writes the processed data back to the external storage media.

[0071] Various types of information, such as various types of programs, data, tables, and databases, may be stored on the recording medium and subjected to information processing. The CPU 2212 may perform various types of processing on the data read from RAM 2214, including various types of operations, information processing, conditional judgments, conditional branching, unconditional branching, information retrieval / replacement, etc., as described throughout this disclosure and specified by the program instruction sequence, and write the results back to RAM 2214. The CPU 2212 may also retrieve information in files, databases, etc., within the recording medium. For example, if multiple entries are stored in the recording medium, each having an attribute value of a first attribute associated with an attribute value of a second attribute, the CPU 2212 may search among the multiple entries for an entry that matches the condition for which the attribute value of the first attribute is specified, read the attribute value of the second attribute stored in that entry, and thereby obtain the attribute value of the second attribute associated with the first attribute that satisfies a predetermined condition.

[0072] The programs or software modules described above may be stored on or near computer 2200 on a computer-readable medium. Alternatively, recording media such as hard disks or RAM provided within a server system connected to a dedicated communication network or the Internet can be used as computer-readable media, thereby providing programs to computer 2200 via the network.

[0073] Although the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications or improvements can be made to the above embodiments. It will be clear from the claims that such modified or improved forms may also be included in the technical scope of the present invention.

[0074] It should be noted that the execution order of operations, procedures, steps, and stages in the apparatus, systems, programs, and methods shown in the claims, specifications, and drawings is not explicitly stated as "before," "prior to," etc., and that these can be implemented in any order unless the output of a previous process is used in a later process. Even if the operation flow in the claims, specifications, and drawings is described using phrases such as "first," "next," etc. for convenience, it does not mean that it is essential to perform the operations in that order. [Explanation of Symbols]

[0075] 20 Terminal, 21 User, 25 Original Key, 30 Authentication Authority Server, 40 IC Card, 50 Communication Network, 60 Key Duplication Factory, 65 Duplicate Key, 70 Key Installation Service Server, 80 Key Management Server, 100 Duplicate Key Ordering Device, 101 Reception Unit, 103 Storage Unit, 105 Approval Unit, 201 Registration Button, 203 Order Button, 301, 401 Key Number Field, 303 Key Image Field, 305, 405 Authentication Link

Claims

1. A receiving unit receives key identification information that identifies the key entered from the terminal during registration, and personal authentication information that is transmitted from the server of an external authentication authority on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and stores them in a storage unit in association with each other. When a duplicate key is ordered, the system accepts key identification information from the terminal, and, on the condition that the user's identity is authenticated by the authentication authority's server based on the input of authentication request information from the terminal, accepts user authentication information transmitted from the server, and approves the duplicate key order when the key identification information and user authentication information at the time of the duplicate key order are associated in the storage unit. A key ordering device equipped with the following features.

2. The key ordering device according to claim 1, wherein the authentication request information is information read by a terminal from an IC card issued by a public certification body.

3. The key ordering device according to claim 1, wherein the reception unit requests an image of the key on the terminal during registration, and, on the condition that the image has been received, stores the key identification information and the personal authentication information in association with each other in the storage unit.

4. The storage unit stores the key identification information and the key shape in association. The key ordering device according to claim 3, wherein the receiving unit, upon receiving the image, analyzes the shape of the key from the image and, on the condition that it has confirmed the analyzed shape with the shape stored in the storage unit, stores the personal authentication information in the storage unit.

5. A registration step involves receiving key identification information that identifies a key entered from a terminal, and personal authentication information transmitted from an external authentication authority's server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and storing them in a storage unit in association with each other. The system accepts input of key identification information from the terminal, and, on the condition that the user's identity is authenticated by the authentication authority's server based on the input of authentication request information from the terminal, accepts user authentication information transmitted from the server, and approves the key order when the key identification information and user authentication information at the time of the key order are associated in the storage unit. A method for ordering duplicate keys that includes the following features.

6. On the computer, A registration function that receives key identification information that identifies a key entered from a terminal, and personal authentication information transmitted from an external authentication authority's server on the condition that the user's identity has been authenticated by the server based on the input of authentication request information from the terminal, and stores them in a storage unit in association with each other. The system accepts input of key identification information from a terminal, and, on the condition that the user's identity is authenticated by the authentication authority's server based on the input of authentication request information from the terminal, accepts user authentication information transmitted from the server, and approves the key order if the key identification information and user authentication information for the key order are associated in the storage unit. A program that makes this possible.

Images