System, server device, and method and program for controlling server device

Abstract

Provided is a system that maintains and improves the quality of services provided from an information distribution system. This system comprises a first server device and a second server device. The first server device stores a first ID necessary to provide a first service to a user who has logged into a first account, and accumulates data relating to the first service provided to the user. The second server device controls the distribution of the accumulated data for a user who has logged into a second account. The second server device associates the first ID, which is managed using the first account, with a second ID, which is managed using the second account. Then, when a user logs into the first account, the second server device requests that the user perform the same procedure as that for logging into the second account.

Description

[Technical field]

[0001] The present invention relates to a system, a server device, a control method for a server device, and a storage medium. [Background technology]

[0002] There is an information distribution system that provides personal information held by hospitals and other institutions to information recipient devices such as businesses based on the individual's consent. Such systems include, for example, information trading devices managed by information banks and the like, information source devices managed by information source companies, and information recipient devices managed by information recipients. The information trading devices store personal information acquired from the information source devices. The information trading devices transmit personal information desired by the utilizing business, etc. from the stored personal information to the information recipient devices.

[0003] For example, Patent Document 1 describes that an information management system, an information management method, and an information management program for conducting transactions using personal information of users are provided. The information management server of Patent Document 1 includes a registrant information storage unit that stores personal information of registrants, a provision history storage unit that stores a provision history of the personal information, and a control unit connected to a purchaser terminal. The control unit acquires information acquisition conditions from the purchaser terminal, and extracts personal information from the registrant information storage unit based on the information acquisition conditions. The control unit provides the extracted personal information to the purchaser terminal, and records the provision history of the personal information in the provision history storage unit. The control unit collects the provision fee based on the provision history recorded in the provision history storage unit, and returns a consideration to the registrant who provided the personal information based on the provision fee.

[0004] Furthermore, various technological developments relating to user authentication are underway.

[0005] For example, Patent Document 2 describes that an authentication technology using an IC tag with higher security is provided. The authentication system of Patent Document 2 includes at least one information terminal and at least one server. The authentication system includes a reading unit, an acquisition unit, a decryption unit, a verification unit, a first authentication unit, and a confirmation unit. The reading unit uses one or more PINs to read personal information and an electronic signature from an IC card that includes personal information including a face image of a legitimate owner of the IC card and an electronic signature generated based on the personal information and a private key. The acquisition unit acquires imaging data showing the face of the subject. The decryption unit decrypts the electronic signature using a public key corresponding to the private key. The verification unit verifies the validity of the personal information based on the decrypted electronic signature and the personal information. The first authentication unit performs face authentication using the imaging data and a face image included in the personal information. The verification unit performs identity verification of the subject based on the verification result of the validity of the personal information and the result of face authentication.

[0006] Patent Document 3 describes that an authentication system, an authentication server, an operator server, and a user terminal capable of appropriately determining a combination of authentication methods according to a service are provided. The user terminal of Patent Document 3 includes an authentication request unit that requests a service, and an authentication information transmission unit that transmits authentication information for each authentication method. The operator server includes a service point management unit that manages service points that indicate the security of authentication required by the service. The authentication server includes an authentication point management unit, an authentication method determination unit, and an authentication processing unit. The authentication point management unit manages authentication points that indicate the security obtained by the combination of authentication methods. The authentication method determination unit prioritizes and determines a combination with a small difference between the authentication point and the service point among combinations of authentication methods whose authentication points are equal to or greater than the service point. The authentication processing unit receives authentication information for each determined combination of authentication methods, and performs authentication processing.

[0007] Patent Document 4 describes that a network system capable of identifying the same user between user management systems of different systems is provided. The network system of Patent Document 4 includes first and second user management systems and a gateway server. The first user management system manages ID information in a first ID federation information table. The second user management system manages first and second intermediation ID information in a second ID federation information table. The gateway server manages ID information and second intermediation ID information in a third ID federation information table in association with each other. When a login request is made to one user management system via the other user management system, the gateway server detects second intermediation ID information or ID information corresponding to the notified ID information or second intermediation ID information from the third ID federation information table. The gateway server outputs the detected information to the other user management system. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] JP 2019-128648 A [Patent Document 2] JP 2019-050014 A [Patent Document 3] JP 2017-072979 A [Patent Document 4] JP 2013-114622 A Summary of the Invention [Problem to be solved by the invention]

[0009] In an information distribution system, advanced services can be provided by collecting personal data held by each service provider (service operator, data holder). In doing so, the data provided by the service provider must have a certain level of reliability. This is because using unreliable data (data provided by a service provider with a low level of security and low identity verification) will result in a decline in the overall quality of the services provided by the information distribution system.

[0010] This problem cannot be solved by applying the techniques disclosed in the above Patent Documents 1 to 4. In particular, Patent Documents 3 and 4 only disclose techniques related to authentication and identification of users.

[0011] A primary object of the present invention is to provide a system, a server device, a control method for a server device, and a storage medium that contribute to maintaining and improving the quality of services provided by an information distribution system. [Means for solving the problem]

[0012] According to a first aspect of the present invention, there is provided a system including a first server device that stores a first ID required to provide a first service to a user logged in to a first account and accumulates data related to the first service to be provided to the user, and a second server device that controls data distribution of the accumulated data for the user logged in to a second account, wherein after the first ID managed in the first account and the second ID managed in the second account are associated with each other, when the user logs in to the first account, the second server device requests the user to follow the same procedure as the procedure for logging in to the second account.

[0013] According to a second aspect of the present invention, there is provided a server device comprising: a communication control unit that communicates with a server, stores a first ID required to provide a first service to a user logged in to a first account, and accumulates data related to the first service to be provided to the user; a data distribution control unit that controls data distribution of the accumulated data for the user logged in to a second account; an ID federation management unit that associates a first ID managed in the first account with a second ID managed in the second account; and a login management unit that, after the first ID and the second ID are associated, requests the user to follow the same procedure as the procedure for logging in to the second account when logging in to the first account.

[0014] According to a third aspect of the present invention, there is provided a control method for a server device, which stores a first ID required to provide a first service to a user logged in to a first account, accumulates data related to the first service to be provided to the user, communicates with a server, controls data distribution of the accumulated data for the user logged in to a second account, associates a first ID managed in the first account with a second ID managed in the second account, and after the first ID and the second ID are associated, when the user logs in to the first account, requests the user to follow the same procedure as the procedure for logging in to the second account.

[0015] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium storing a program for causing a computer mounted on a server device that stores a first ID required to provide a first service to a user logged in to a first account and accumulates data related to the first service to be provided to the user and communicates with a server to execute the following processes: controlling data distribution of the accumulated data for the user logged in to a second account; associating a first ID managed in the first account with a second ID managed in the second account; and, after the first ID and the second ID are associated, requesting the user to follow the same procedure as the procedure for logging in to the second account when logging in to the first account. Effect of the Invention

[0016] According to each aspect of the present invention, a system, a server device, a control method for a server device, and a storage medium are provided that contribute to maintaining and improving the quality of services provided by an information distribution system. Note that the effects of the present invention are not limited to those described above. The present invention may achieve other effects instead of or in addition to the effects described above. [Brief description of the drawings]

[0017] [Figure 1] FIG. 1 is a diagram for explaining an overview of an embodiment. [Diagram 2] FIG. 2 is a flowchart showing an example of the operation of an embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the first embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Diagram 5] FIG. 5 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 6] FIG. 6 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 7] FIG. 7 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 8] FIG. 8 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a processing configuration of the portal server according to the first embodiment. [Figure 10] FIG. 10 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 11] FIG. 11 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 12] FIG. 12 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of a processing configuration of the distribution control server according to the first embodiment. [Figure 14] FIG. 14 is a diagram illustrating an example of the user information database according to the first embodiment. [Figure 15] FIG. 15 is a diagram illustrating an example of a part of the user information database according to the first embodiment. [Figure 16] FIG. 16 is a flowchart illustrating an example of the operation of the ID federation management unit according to the first embodiment. [Figure 17] FIG. 17 is a flowchart illustrating an example of the operation of the ID federation management unit according to the first embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a location information database according to the first embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. [Figure 20] FIG. 20 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 21] FIG. 21 is a diagram illustrating an example of a customer information database according to the first embodiment. [Figure 22]FIG. 22 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. [Diagram 23] FIG. 23 is a diagram for explaining ID federation according to the first embodiment. [Figure 24] FIG. 24 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the second embodiment. [Diagram 25] FIG. 25 is a diagram illustrating an example of a processing configuration of a hospital terminal according to the second embodiment. [Figure 26] FIG. 26 is a diagram illustrating an example of a processing configuration of a service server according to the second embodiment. [Figure 27] FIG. 27 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Figure 28] FIG. 28 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Figure 29] 29A and 29B are diagrams illustrating an example of a display of a hospital terminal according to the second embodiment. [Diagram 30] FIG. 30 is a diagram illustrating an example of a hardware configuration of the distribution control server according to the present disclosure. [Diagram 31] FIG. 31 is a diagram showing an example of a schematic configuration of an information distribution system according to a modification of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] First, an outline of one embodiment will be described. The reference numerals in the drawings are added to each element for convenience as an example to aid in understanding, and the description of the outline is not intended to be limiting. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between the blocks in each drawing include both bidirectional and unidirectional. The unidirectional arrows are used to diagrammatically indicate the flow of the main signal (data) and do not exclude bidirectionality. In this specification and the drawings, elements that can be similarly described may be given the same reference numerals to avoid redundant description.

[0019] The system according to an embodiment includes a first server device 101 and a second server device 102 (see FIG. 1). The first server device 101 stores a first ID required to provide a first service to a user who has logged in to a first account, and accumulates data related to the first service provided to the user. The second server device 102 controls the distribution of accumulated data for a user who has logged in to a second account. The second server device 102 associates a first ID managed in the first account with a second ID managed in the second account (associating IDs; step S1 in FIG. 2). Thereafter, when the user logs in to the first account, the second server device 102 requests the user to perform the same procedure as the procedure for logging in to the second account (request for login procedure; step S2).

[0020] There is a possibility that the procedure or method for logging in to the first account of the first server device 101 has a low security level (authentication strength) or a low identity verification level. Even in such a case, after the first ID of the first account is registered in the system (associated with the second ID), the second server device 102 requests the user to perform the same procedure as the procedure for logging in to the second account. That is, if multi-factor authentication combining ID authentication, biometric authentication, and the like is required for logging in to the second account, the second server device 102 also performs multi-factor authentication when logging in to the first account. That is, even if the system includes a service provider that employs a method with a low security level, etc., for authenticating a user, the system (the second server device 102) authenticates the user by a method with a high security level, etc., instead of the service provider. As a result, the identity, etc., of the user to whom the service provider with a low security level provides a service is more reliably guaranteed, and the reliability of the data accumulated by the service provider is also improved. The information distribution system uses data with guaranteed reliability, which allows for the improvement or maintenance of the services provided.

[0021] Specific embodiments will be described in more detail below with reference to the drawings.

[0022] [First embodiment] The first embodiment will be described in more detail with reference to the drawings.

[0023] [System Configuration] Fig. 3 is a diagram showing an example of a schematic configuration of an information distribution system according to the first embodiment. As shown in Fig. 3, participating members (actors) of the information distribution system include information distribution businesses and service businesses.

[0024] The information distribution business is an entity that provides services related to data distribution (information distribution services). The information distribution business includes a portal server 10 and a distribution control server 20.

[0025] The portal server 10 is a server device that provides a portal site that serves as an interface for users who use the information distribution service. When using the information distribution service, the users access the portal server 10.

[0026] The distribution control server 20 is a server device that controls (realizes) data distribution between service providers. The distribution control server 20 is a device that realizes data distribution of data stored in the service providers.

[0027] A service provider is an entity that provides a service to an individual. The service provider may be a private business or a public institution. Examples of the service provider include medical institutions (hospitals, pharmacies, etc.) that provide medical services to users, retailers, and healthcare providers that provide health services to customers.

[0028] Each service provider has a service server 30 for providing services to customers. The service server 30 is managed and operated by the service provider. The service server 30 accumulates data generated by the service provider in providing the service to the user and data necessary for providing the service to the user (accumulates user data). In other words, the service server 30 accumulates data related to the service provided to the user.

[0029] A user of the information distribution system uses a terminal 40 .

[0030] The devices shown in Fig. 3 are connected to each other via a network. For example, the distribution control server 20 and the service server 30 are connected by wired or wireless communication means and configured to be able to communicate with each other.

[0031] 3 is merely an example and is not intended to limit the configuration of the information distribution system disclosed in the present application. For example, an information distribution business operator may include two or more distribution control servers 20.

[0032] [System operation overview] Next, an outline of the operation of the information distribution system according to the first embodiment will be described.

[0033] In the first embodiment, a healthcare provider that provides health advice to users and an EC (Electronic Commerce) provider that sells products and the like on the Internet will be taken as examples of service providers and described below.

[0034] 3, the healthcare business operator has a service server 30-1, and the EC business operator has a service server 30-2. In the following description, the service servers 30-1 and 30-2 will be simply referred to as "service server 30" unless there is a special reason to distinguish between them.

[0035] To receive a service from a healthcare provider, the user needs to log in to an account (first account) managed by the service server 30-1. Specifically, the user logs in to the account by providing an ID and password to the service server 30-1. In addition, when the healthcare provider creates an account, no identity verification is performed.

[0036] The service server 30-1 (first server device) stores an ID (first ID; membership number, etc.) required to provide a first service (health advice) to a user who has logged in to the account. The service server 30-1 also accumulates data (e.g., exercise time, etc.) related to the service provided to the user.

[0037] Note that a description of the specific services provided by healthcare providers and EC businesses will be omitted. Healthcare providers collect (accumulate) data on users' diet and exercise, and provide advice based on the accumulated data. EC businesses provide commercial transaction services (online shopping) over a network.

[0038] There are two means of data distribution in the information distribution system: "sharing" and "provision." The distribution control server 20 (second server device) controls data distribution of the accumulated data of a user who logs in to an account (second account).

[0039] "Sharing" is a method for service providers to obtain data accumulated by other service providers. For example, data distribution through "sharing" is used when an e-commerce business obtains data generated by a healthcare business providing services to users.

[0040] Since "sharing" is used to improve the convenience of the service user himself, in principle, no compensation is generated for data distribution. In other words, "sharing" is used to utilize data accumulated by other service providers so that users can receive better services from the service providers.

[0041] "Provision" is a means by which data utilization businesses obtain data accumulated by other service businesses. For example, data distribution by "provision" is used when a pharmaceutical company obtains the results of a health check or medical examination from a medical institution.

[0042] "Provision" is a method used by data utilization businesses that do not provide services directly to users, and therefore, in principle, a fee is charged for data distribution. In other words, "provision" is used so that users can receive compensation from data utilization businesses.

[0043] In the first embodiment, the data distribution means for the stored data will be described by taking "sharing" as an example. However, it goes without saying that the stored data can also be the subject of data distribution by "provision."

[0044] <Create a system account> Users of the information distribution system must register in advance (user registration, system registration). More specifically, the user accesses the portal server 10 and performs the procedure for creating an account. In the following explanation, an account created in the information distribution system is referred to as a "system account."

[0045] In order to create a system account, the user operates the terminal 40 owned by the user to access the portal server 10. In response to the access from the terminal 40, the portal server 10 displays a WEB page for creating a system account.

[0046] The user performs an operation for generating a system account (e.g., pressing a prescribed button) and requests the portal server 10 to generate a system account (see FIG. 4). The portal server 10 acquires information required for generating a system account for the user. Specifically, the portal server 10 acquires the user's login information (login ID, password), personal information (name, date of birth, etc.), biometric information (e.g., face image), and identification documents (driver's license, etc.).

[0047] The portal server 10 transmits an "account creation request" including the acquired login information, personal information, biometric information, identification documents, etc. to the distribution control server 20 (step S01).

[0048] The distribution control server 20 performs identity verification using the biometric information included in the account creation request and the biometric information written on the identity verification document. If identity verification is successful, the distribution control server 20 creates a system account for the user. At that time, the distribution control server 20 creates a user ID (identifier) ​​for uniquely identifying the user in the information distribution system.

[0049] The distribution control server 20 stores the generated user ID, login information, personal information (such as name, date of birth, contact information), and biometric information of the user in association with each other. The distribution control server 20 stores this information in a "user information database." The details of the user information database will be described later.

[0050] The distribution control server 20 transmits the generated user ID to the portal server 10 (step S02). The portal server 10 issues the user ID acquired from the distribution control server 20 to the user (terminal 40) (step S03). The terminal 40 stores the issued user ID.

[0051] <Create a service account> In order to receive services from a service provider, a user needs to create an account with the service provider. More specifically, the user accesses the service server 30 managed by the service provider and performs user registration to create an account. In the following explanation, the account created by the service provider is referred to as a "service account."

[0052] To generate a service account, the user operates the terminal 40 owned by the user to access the desired service server 30. For example, a user who wishes to receive a service from a healthcare provider accesses the service server 30-1. In response to the access from the terminal 40, the service server 30 displays a WEB page for generating a service account.

[0053] When a user performs an operation for generating a service account (e.g., pressing a predetermined button), the service server 30 acquires information necessary for generating a service account for the user. Specifically, the service server 30 acquires the user's login information (login ID, password) and personal information (name, date of birth, etc.).

[0054] The service server 30 creates a service account for the user. The service server 30 creates identification information (ID, code) for identifying the user within its own company (service provider). In the following explanation, the identification information created by the service provider is referred to as a "personal identification ID." For example, a membership number, a patient registration card number, etc., correspond to the personal identification ID (personal identification code).

[0055] The service server 30 stores the user's login information, personal information, and individual identification ID in association with each other. The service server 30 stores this information in a "customer information database." The customer information database will be described in detail later.

[0056] The service server 30 issues the generated individual identification ID to the user (terminal 40). The terminal 40 stores the issued individual identification ID.

[0057] <Log in to your system account> To use the information distribution service, a user needs to log in to a system account. For example, the user requests the portal server 10 to log in to the system account by pressing a "login" button displayed on the portal site (see FIG. 5).

[0058] When a login request is made by the user, the portal server 10 redirects the user's login request to the distribution control server 20 (authentication redirection). Specifically, the portal server 10 transmits an "authentication request" to the distribution control server 20 (step S11).

[0059] Here, the information distribution system employs multi-factor authentication for authenticating users. Specifically, the distribution control server 20 and the terminal 40 execute the multi-factor authentication by transmitting and receiving different types of authentication information (step S12).

[0060] For example, the terminal 40 transmits login information (ID, password) to the distribution control server 20 as authentication information. When the distribution control server 20 succeeds in ID authentication (password authentication), it requests the terminal 40 to provide authentication information regarding biometric information. The terminal 40 acquires the biometric information of the user and transmits the biometric information to the distribution control server 20 as the second-stage authentication information. The distribution control server 20 performs biometric authentication using the biometric information.

[0061] The distribution control server 20 transmits the authentication result (authentication result by multi-factor authentication) to the portal server 10 (step S13). At that time, when the authentication is successful, the distribution control server 20 notifies the portal server 10 of the user ID of the user.

[0062] The portal server 10 determines the user corresponding to the notified user ID as the target of service provision. When the login to the system account is successful, the user can make setting changes and the like when using the information distribution system on the portal site.

[0063] <Login to the service account> A detailed description of the login to the service account is omitted. The user's terminal 40 and the service server 30 may authenticate the user using a pre-determined ID and password.

[0064] <ID linking> In order to target the data (user data) stored in the service server 30 for data distribution, the user needs to link the ID (user ID) of the system account and the ID (personal identification ID) of the service account. For example, in order to target the data stored by a healthcare provider for data distribution, the user needs to link (associate) the user ID of the information distribution system and the personal identification ID issued by the healthcare provider.

[0065] In the following description, linking (associating) the user ID of the system account and the personal identification ID of the service account is referred to as "ID linking".

[0066] To achieve ID federation, the user logs in to the system account. If the login is successful, the user performs the procedure for ID federation on the portal site (see FIG. 6). Specifically, the user operates the terminal 40 and presses a specific button to request the portal server 10 to issue a "federalization code."

[0067] The federation code is information (data) for achieving ID federation. More specifically, the federation code is a token with an expiration date that is linked to the system account (personal information such as name and identity verification information such as biometric information) of the user who wishes to federate the ID.

[0068] When an operation for issuing an association code is received, the portal server 10 transmits an "association code issuance request" to the distribution control server 20 (step S21).

[0069] In response to receiving the linkage code issuance request, the distribution control server 20 generates a linkage code and stores the generated linkage code in the user information database.

[0070] The distribution control server 20 transmits the generated linkage code to the portal server 10 (step S22). The portal server 10 transmits the received linkage code to the terminal 40 (step S23). The terminal 40 stores the received linkage code and manages it in a state where the user can view the linkage code.

[0071] After acquiring the federation code, the user logs in to the service account of the service provider with which the user desires to federate the ID. The user then performs the procedure for ID federation on a website provided by the service provider. For example, the user operates the terminal 40 and presses a specific button to request ID federation from the service server 30 (see FIG. 7).

[0072] When the user presses a predetermined button, the service server 30 acquires a link code from the user (step S31).

[0073] When the service server 30 acquires the linkage code, it requests the distribution control server 20 to execute ID linkage. Specifically, the service server 30 transmits an "ID linkage request" including the acquired linkage code, the personal identification ID of the user currently logged in to the service account, and the business code to the distribution control server 20 (step S32).

[0074] The business code is identification information (ID) for identifying a service business participating in the information distribution system. For example, different codes are assigned to a healthcare business (service server 30-1) and an EC business (service server 30-2).

[0075] The business code is shared by any means among the system participants (information distribution business, service business). For example, when a service business participates in the information distribution system, the information distribution business generates a business code to be assigned to the service business. The information distribution business notifies the service business of the generated business code.

[0076] When receiving an ID federation request, the distribution control server 20 searches the user information database using the federation code included in the ID federation request as a key, and identifies the corresponding user.

[0077] After that, the distribution control server 20 requests the terminal 40 held by the identified user to provide biometric information. Specifically, the distribution control server 20 transmits a "biometric information provision request" to the terminal 40 (step S33).

[0078] In response to receiving the biometric information provision request, the terminal 40 displays a GUI or the like for acquiring the biometric information (e.g., a facial image) of the user. The terminal 40 transmits the acquired biometric information (facial image) to the distribution control server 20 (step S34).

[0079] The circulation control server 20 performs biometric authentication (one-to-one authentication) using the biometric information (face image) of the user identified using the cooperation code and the biometric information provided from the terminal 40. That is, the circulation control server 20 verifies the identity of the user who requests ID cooperation through biometric authentication.

[0080] When the biometric authentication is successful, the circulation control server 20 executes ID cooperation. Specifically, the circulation control server 20 identifies the service provider from the business operator code included in the ID cooperation request, and stores the personal identification ID of the identified service provider in the user information database. That is, the circulation control server 20 registers the user ID of the system account and the personal identification ID in the user information database in association with each other.

[0081] For example, consider a user to whom a user ID of "#10" is assigned in the system account and a personal identification ID of "#100" is assigned in the service account. By performing ID cooperation, the two IDs (#10, #100) are registered in the system as the IDs of the same person for this user.

[0082] The circulation control server 20 notifies the service server 30 of the result of the ID cooperation process. The circulation control server 20 sends a response (positive response, negative response) to the ID cooperation request to the service server 30 (step S35).

[0083] The service server 30 notifies the user of the result of the ID cooperation process.

[0084] <Login to the service account after ID cooperation> When receiving a service from the service provider for which the ID cooperation has been completed, the user logs in to the service server 30 via the circulation control server 20. That is, the user logs in to the service server 30 by means of so-called SSO (Single Sign On).

[0085] Specifically, the user operates the terminal 40 to access the service server 30. When the user performs a login procedure on a web page provided by the service server 30, the service server 30 sends an authentication redirect to the distribution control server 20. Specifically, the service server 30 sends an authentication request to the distribution control server 20. At that time, the service server 30 sends the business code of the service business operator that operates the service server 30 and the address of the terminal 40 to the distribution control server 20.

[0086] When the distribution control server 20 receives the authentication request (authentication redirect), the distribution control server 20 requests the user to perform a procedure similar to the procedure when the user logs in to a system account. Specifically, the distribution control server 20 performs multi-factor authentication using different types of authentication information.

[0087] If the multi-factor authentication is successful, the distribution control server 20 reads out from the user information database the personal identification ID of the user identified by the authentication process that corresponds to the business code included in the authentication request.

[0088] The distribution control server 20 notifies the service server 30, which is the sender of the authentication request, of the read individual identification ID. Upon acquiring the individual identification ID, the service server 30 determines that the user of the individual identification ID has logged in.

[0089] In this way, the distribution control server 20 associates the individual identification ID managed by the service account with the user ID managed by the system account (performs ID federation). After the IDs are federated, when the user logs in to the service account, the distribution control server 20 requests the user to follow the same procedure as the procedure for logging in to the system account.

[0090] In addition, the portal server 10 (third server device) accepts a login request to a system account by a user, and requests authentication of the user from the distribution control server 20. The distribution control server 20 executes multi-factor authentication for the user, and notifies the portal server 10 of the result of the multi-factor authentication.

[0091] <Data storage and location information transmission> The service provider accumulates user data of the users. The service provider (service server 30) stores the personal identification code of each user and the data obtained as a result of the service provided, in association with each other.

[0092] Each time a service provider accumulates user data (data resulting from the provision of a service, data necessary for the provision of a service), the service provider transmits "location information" to the distribution control server 20. The location information is information on the storage location of the data accumulated at the service provider (data accumulation entity; service provider), etc. The location information includes a personal identification code, a business code, the type of accumulated data, etc.

[0093] The distribution control server 20 stores the acquired location information in a "location information database". The location information database will be described in detail later. The location information database stores a personal identification code, a business code, and a data type in association with each other.

[0094] <Data distribution through sharing> A service provider that wishes to obtain data accumulated by another service provider can obtain that data through "sharing."

[0095] Here, with reference to FIG. 8, a case will be described in which an EC business acquires data of a user U1 stored in a healthcare business through "sharing."

[0096] The service server 30-2 of the EC business that is the data sharing requester transmits a "data sharing request" to the distribution control server 20 (step S41).

[0097] Based on the sharing request, the distribution control server 20 identifies the target of data distribution (user U1) and the data accumulator (healthcare business operator) of the data to be distributed. The distribution control server 20 transmits an inquiry regarding data sharing to the terminal 40 possessed by the identified target person (user U1) (step S42).

[0098] The terminal 40 that receives the data sharing inquiry acquires the user's intention regarding data sharing. For example, the terminal 40 acquires the intention of the user U1 using a GUI (Graphical User Interface). In the above example, the terminal 40 displays a GUI with the content such as "By sharing the data of the healthcare provider with the EC business, you can receive better service. Do you want to share it?" and acquires the user's intention (agree or disagree to data sharing).

[0099] The terminal 40 transmits a response to the inquiry about data sharing (agreement to data sharing or refusal to data sharing) to the distribution control server 20 (step S43).

[0100] If the user's consent is obtained, the distribution control server 20 transmits a sharing instruction to the data accumulator (the service server 30-1 of the health care provider) (step S44).

[0101] The service server 30-1 of the healthcare provider that has received the sharing instruction refers to the customer information database and transmits the data of the user U1 (eg, exercise time, etc.) to the designated service server 30-2 with which the data is to be shared (step S45).

[0102] Next, each device included in the information distribution system according to the first embodiment will be described in detail.

[0103] [Portal Server] 9 is a diagram illustrating an example of a processing configuration (processing module) of the portal server 10 according to the first embodiment. Referring to FIG. 9, the portal server 10 includes a communication control unit 201, an account creation control unit 202, a login control unit 203, an ID federation control unit 204, and a storage unit 205.

[0104] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the distribution control server 20. The communication control unit 201 also transmits data to the distribution control server 20. The communication control unit 201 passes the data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 201. The communication control unit 201 has a function as a receiver that receives data from other devices and a function as a transmitter that transmits data to other devices.

[0105] The account generation control unit 202 is a means for controlling the generation of a system account. When a user performs a predetermined operation on the portal site, the account generation control unit 202 performs processing related to the generation of a system account for the user. For example, when the "create account" button is pressed on the portal site shown in Fig. 10, the account generation control unit 202 displays a GUI for acquiring the user's login information, etc.

[0106] For example, the account creation control unit 202 displays a GUI as shown in Fig. 11 on the terminal 40. The account creation control unit 202 acquires login information, personal information, biometric information, a copy of an identification document, and the like, using a GUI as shown in Fig. 11. Alternatively, the account creation control unit 202 may instruct the user to take a photograph of the face or an identification document in relation to the biometric information or the identification document.

[0107] When the account generation control unit 202 acquires the user's login information and the like from the terminal 40, it transmits the acquired information (login information, personal information, biometric information, and identification documents) to the distribution control server 20. The account generation control unit 202 transmits an "account generation request" including the login information and the like to the distribution control server 20.

[0108] The account creation control unit 202 receives a response (positive response, negative response) to the account creation request from the distribution control server 20.

[0109] When the distribution control server 20 succeeds in generating a system account (when it receives an affirmative response), the account generation control unit 202 transmits to the terminal 40 the user ID contained in the affirmative response.

[0110] If the distribution control server 20 fails to generate a system account (if a negative response is received), the account generation control unit 202 notifies the user of this fact.

[0111] The login control unit 203 is a means for controlling login to a system account. For example, when the "Login" button is pressed in FIG.

[0112] Specifically, the login control unit 203 transmits an "authentication request" including the address of the terminal 40 to the distribution control server 20. The login control unit 203 receives a response (positive response, negative response) to the authentication request from the distribution control server 20.

[0113] If the login fails (if a negative response is received), the login control unit 203 notifies the user accordingly. If the login is successful (if a positive response is received), the login control unit 203 notifies the user accordingly and stores the user ID included in the positive response as the ID of the system user (stores it as the user currently logged in).

[0114] The ID federation control unit 204 is a means for controlling the federation of the ID of a system account and the ID of a service account.

[0115] When a user who is logged in to a system account performs a predetermined operation (for example, pressing an ID federation button), the ID federation control unit 204 displays a GUI such as that shown in Fig. 12 on the terminal 40. The ID federation control unit 204 acquires information on service providers that are targets of ID federation using the GUI such as that shown in Fig. 12.

[0116] Upon acquiring information about the service provider (e.g., the business code of the service provider that is the target of ID federation), the ID federation control unit 204 sends a federation code issuance request to the distribution control server 20, the request including the user ID and business code of the logged-in user.

[0117] The ID federation control unit 204 receives a response (positive response, negative response) to the federation code issuance request.

[0118] If the federation code is not issued (if a negative response is received), the ID federation control unit 204 notifies the user that ID federation is not possible.

[0119] When the federation code is issued (when an affirmative response is received), the ID federation control unit 204 transmits the federation code to the terminal 40 together with the business code of the ID federation destination.

[0120] The storage unit 205 stores information necessary for the operation of the portal server 10. For example, the storage unit 205 stores table information in which names of service providers are associated with provider codes.

[0121] [Distribution control server] 13 is a diagram showing an example of a processing configuration (processing module) of the distribution control server 20 according to the first embodiment. Referring to FIG. 13, the distribution control server 20 includes a communication control unit 301, an account management unit 302, a login management unit 303, an ID federation management unit 304, a location information management unit 305, a data distribution control unit 306, and a storage unit 307.

[0122] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the service server 30. The communication control unit 301 also transmits data to the service server 30. The communication control unit 301 passes the data received from the other devices to the other processing modules. The communication control unit 301 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules transmit and receive data to and from the other devices via the communication control unit 301. The communication control unit 301 has a function as a receiving unit that receives data from the other devices and a function as a transmitting unit that transmits data to the other devices.

[0123] The account management unit 302 is a means for controlling and managing the user's system account.

[0124] The account management unit 302 receives an account creation request from the portal server 10. The account management unit 302 performs identity verification using the biometric information (facial image) acquired from the portal server 10 and the biometric information written on an identification document.

[0125] Specifically, the account management unit 302 generates feature amounts from each of the two pieces of biometric information (face images). Since existing technology can be used for the feature amount generation process, detailed explanations thereof will be omitted. For example, the account management unit 302 extracts the eyes, nose, mouth, etc. as feature points from the face image. After that, the account management unit 302 calculates the positions of the feature points and the distances between the feature points as feature amounts, and generates a feature vector (vector information that characterizes the face image) consisting of multiple feature amounts.

[0126] The account management unit 302 performs authentication processing (one-to-one authentication) using the two generated features. Specifically, the account management unit 302 calculates the similarity between the two features. The similarity may be calculated using a chi-square distance, Euclidean distance, or the like. Note that the greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

[0127] If the similarity is equal to or greater than a predetermined value, the account management unit 302 determines that the identity verification has been successful. If the similarity is smaller than the predetermined value, the account management unit 302 determines that the identity verification has failed.

[0128] If the identity verification fails, the account management unit 302 notifies the portal server 10 of the failure to create an account. Specifically, the account management unit 302 transmits to the portal server 10 a negative response to the account creation request.

[0129] If the identity verification is successful, the account management unit 302 generates a system account for the user. Specifically, the account management unit 302 generates a user ID for uniquely identifying the user in the information distribution system. The user ID may be any information that can uniquely identify the user. For example, the account management unit 302 may assign a unique value each time it processes an account creation request, and use the number as the user ID.

[0130] The account management unit 302 stores the generated user ID, login information, personal information (such as name, date of birth, contact information), and biometric information of the user in association with each other. The distribution control server 20 stores this information in a "user information database" (see FIG. 14).

[0131] As shown in Fig. 14, the user information database (DB; Data Base) has, in addition to a field for storing login information, etc., a field for storing information on ID federation (ID federation information), a field for storing a personal identification ID for each service provider, etc. Note that "HL" written in the personal identification ID field indicates the business code of the healthcare provider, and "EC" indicates the business code of the EC provider.

[0132] Also, while the ID federation information is shown collectively in FIG. 14, the actual ID federation information is associated with a user ID as a set of a federation code, a business code, and a validity period, as shown in FIG.

[0133] 14 and 15 are merely examples, and are not intended to limit the items to be stored in the user information database. For example, an identity verification document obtained from the portal server 10 may be registered in the user information database.

[0134] When the system account for the user is generated, the account management unit 302 notifies the portal server 10 that the account has been successfully generated. Specifically, the account management unit 302 transmits an affirmative response to the account generation request to the portal server 10. At that time, the account management unit 302 transmits the affirmative response including the generated user ID of the user to the portal server 10.

[0135] The login management unit 303 is a means for controlling and managing login to a system account by a user. When the login management unit 303 receives an authentication request (authentication redirect) from the portal server 10, the login management unit 303 controls multi-factor authentication for the terminal 40 whose address is included in the authentication request.

[0136] First, the login management unit 303 requests the provision of login information (a combination of an ID and a password) from the terminal 40. The login management unit 303 searches the user information database using the login information acquired from the terminal 40 as a key, and attempts to identify the corresponding user.

[0137] If the corresponding user is identified, the login management unit 303 determines that the first authentication using the initial authentication information (login information) was successful. If the corresponding user is not identified, the login management unit 303 determines that the first authentication using the initial authentication information was unsuccessful.

[0138] If the first authentication is successful, the login management unit 303 requests the terminal 40 to provide biometric information (facial image). The login management unit 303 attempts authentication using the biometric information acquired from the terminal 40 and the biometric information of the user identified in the first authentication. That is, the login management unit 303 performs a second authentication using the second authentication information (biometric information).

[0139] If the second authentication (biometric authentication) is also successful, the login management unit 303 determines that the multi-factor authentication for the user who possesses the terminal 40 has been successful. If the first or second authentication (biometric authentication) fails, the login management unit 303 determines that the multi-factor authentication for the user who possesses the terminal 40 has failed.

[0140] The login management unit 303 notifies the portal server 10 of the authentication result (result of multi-factor authentication). If the multi-factor authentication is unsuccessful, the login management unit 303 sends a negative response to the portal server 10. If the multi-factor authentication is successful, the login management unit 303 sends a positive response to the portal server 10. When notifying the portal server 10 of successful authentication, the login management unit 303 sends a positive response including the user ID of the user (person who successfully logged in).

[0141] The login management unit 303 processes an authentication request received from the service server 30 in the same manner as an authentication request received from the portal server 10. When the multi-factor authentication is successful, the login management unit 303 notifies the service server 30 of a personal identification ID corresponding to the business code included in the authentication request acquired from the service server 30.

[0142] The ID federation management unit 304 is a unit for controlling and managing ID federation. The operation of the ID federation management unit 304 will be described with reference to Figs.

[0143] The ID federation management unit 304 processes a "federalization code issuance request" received from the portal server 10. Fig. 16 is a flowchart showing an example of the operation of the ID federation management unit 304 when processing a federation code issuance request.

[0144] The ID federation management unit 304 searches the user information database using the user ID included in the federation code issuance request as a key, and attempts to identify the corresponding user (step S101).

[0145] If the identification of the user fails (step S102, No branch), the ID federation management unit 304 notifies the portal server 10 that the federation code cannot be issued. Specifically, the ID federation management unit 304 transmits a negative response to the federation code issuance request to the portal server 10 (step S103).

[0146] If the user is successfully identified (step S102, Yes branch), the ID federation management unit 304 generates a federation code (step S104). As described above, the federation code is a token with an expiration date that is linked to the system account of the user who desires ID federation. For example, the ID federation management unit 304 calculates a concatenation value of the user's user ID, the current time, the business code of the service business that is the target of ID federation, and the like, and generates a federation code by calculating a hash value of the calculated concatenation value.

[0147] The ID federation management unit 304 registers the generated federation code in the user information database (step S105). The ID federation management unit 304 associates the business code included in the federation code issuance request with the generated federation code and stores them in the user information database. At that time, the ID federation management unit 304 also registers the validity period of the federation code in the user information database. In the example of FIG. 15, the date and time when the validity period of the federation code ends is registered in the user information database.

[0148] The ID federation management unit 304 may set a predetermined period as the validity period, or may determine the validity period based on a predetermined rule, etc. For example, the ID federation management unit 304 may set a different validity period for each service provider.

[0149] When the generation and registration of the federation code is completed, the ID federation management unit 304 notifies the portal server 10 of the generated federation code. Specifically, the ID federation management unit 304 transmits an affirmative response (response to the federation code issuance request) including the generated federation code to the portal server 10 (step S106).

[0150] The ID federation management unit 304 also processes an "ID federation request" received from the service server 30. Fig. 17 is a flowchart showing an example of the operation of the ID federation management unit 304 when processing an ID federation request.

[0151] When receiving an ID federation request, the ID federation management unit 304 searches the user information database using the federation code included in the ID federation request as a key. If the search is successful, the ID federation management unit 304 verifies the validity period of the identified federation code (step S201).

[0152] If the validity period of the federation code has elapsed (step S202, No branch), the ID federation management unit 304 sets the result of the ID federation process to "ID federation failure" (step S203).

[0153] If the validity period of the linkage code has not expired (step S202, Yes branch), the ID linkage management unit 304 sends a "biometric information provision request" to the user's contact information (the address of terminal 40) identified based on the linkage code (step S204).

[0154] If the biometric information is not provided (if a negative response to the biometric information provision request is received; step S205, No branch), the ID federation management unit 304 sets the result of the ID federation process to "ID federation failure" (step S203).

[0155] When the biometric information is provided (when an affirmative response to the biometric information provision request is received; step S205, Yes branch), the ID federation management unit 304 executes biometric authentication (step S206). Specifically, the ID federation management unit 304 executes biometric authentication (one-to-one authentication) using the biometric information (face image) of the user identified using the federation code and the biometric information provided by the terminal 40.

[0156] If the biometric authentication fails (step S207, No branch), the ID federation management unit 304 sets the result of the ID federation process to "ID federation failure" (step S203).

[0157] If the biometric authentication is successful (step S207, Yes branch), the ID federation management unit 304 executes ID federation (step S208). Specifically, the ID federation management unit 304 identifies a service provider that is a target of ID federation from a provider code included in the ID federation request, and stores an individual identification ID generated by the identified service provider (an individual identification ID included in the ID federation request) in the user information database.

[0158] For example, in the example of FIG. 15, a user with user ID "uID01" has requested ID federation to the healthcare provider (see line 1). When ID federation is executed for that user, the personal identification ID of that user (personal identification ID generated by the healthcare provider) is set to the healthcare provider in the personal identification ID field shown in line 1 of FIG. 14. As a result, the user ID "uID01" of the user named U1 and the personal identification ID of the healthcare provider are registered in the system as the ID of the same person.

[0159] When ID federation is completed, the ID federation management unit 304 sets the result of the ID federation process to "ID federation successful" (step S209).

[0160] The ID federation management unit 304 notifies the service server 30 of the result of the ID federation process (step S210). If the ID federation is successful, the ID federation management unit 304 transmits a positive response to the service server 30. If the ID federation is unsuccessful, the ID federation management unit 304 transmits a negative response to the service server 30.

[0161] The location information management unit 305 is a means for managing location information acquired from a service provider. The location information management unit 305 stores the location information acquired from each service server 30 in a location information database (see FIG. 18). As shown in FIG. 18, the location information database stores a personal identification code, a business code, and a data type in association with each other. Note that the location information database shown in FIG. 18 is merely an example, and is not intended to limit the items to be stored. For example, the date and time when the location information was registered may be registered in the location information database.

[0162] The data distribution control unit 306 is a means for controlling the distribution of data stored by users (user data held by the service provider). For example, the data distribution control unit 306 controls data distribution related to "sharing."

[0163] The data distribution control unit 306 receives a sharing request from the service server 30. The sharing request includes the personal identification code of the user who is the target of data acquisition, the business code, the type of data that the data sharing destination wishes to acquire, information on the data sharing destination (data transmission destination), and the like.

[0164] The data distribution control unit 306 identifies the target of data distribution based on the personal identification code and business code included in the sharing request. Specifically, the data distribution control unit 306 refers to the user information database shown in FIG. 14 to identify the target.

[0165] The data distribution control unit 306 identifies a service provider that stores the necessary data using the identified user's personal identification code and the data type included in the sharing request. Specifically, the data distribution control unit 306 refers to the location information database shown in Fig. 18 and identifies a service provider that stores data corresponding to the data type included in the sharing request.

[0166] When the target of data distribution and the accumulator of the data to be distributed are specified, the data distribution control unit 306 makes an inquiry about data sharing to the target of data distribution. The inquiry about data sharing includes information such as the requester of data sharing, the data accumulator, and the type of data to be shared.

[0167] The data distribution control unit 306 receives a response to the data sharing inquiry from the terminal 40 .

[0168] If the user refuses data sharing, the data distribution control unit 306 notifies the data sharing request source that data sharing is not possible. If the user agrees to data sharing, the data distribution control unit 306 transmits a sharing instruction to the data accumulator.

[0169] The sharing instruction includes a personal identification code generated by the data accumulator, information regarding the data sharing destination, and the type of data to be shared.

[0170] The storage unit 307 stores information necessary for the operation of the distribution control server 20. The storage unit 307 stores at least biometric information for authenticating a user who logs in to a system account. A user information database is constructed in the storage unit 307. Furthermore, a database that stores names of service providers in association with their business codes and the like is constructed in the storage unit 307.

[0171] [Service Server] Fig. 19 is a diagram showing an example of a processing configuration (processing module) of the service server 30 according to the first embodiment. Referring to Fig. 19, the service server 30 includes a communication control unit 401, a customer management unit 402, a sharing request unit 403, a data accumulation unit 404, a data distribution unit 405, and a storage unit 406.

[0172] The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the distribution control server 20. The communication control unit 401 also transmits data to the distribution control server 20. The communication control unit 401 passes the data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 401. The communication control unit 401 has a function as a receiver that receives data from other devices and a function as a transmitter that transmits data to other devices.

[0173] The customer management unit 402 is a means for controlling and managing the customers of the service provider. Specifically, the customer management unit 402 generates service accounts for users and controls logins by users. Furthermore, the customer management unit 402 controls and manages ID federation.

[0174] When the user performs a predetermined operation on the WEB page, the customer management unit 402 displays a GUI or the like for acquiring a link code on the terminal 40. For example, the customer management unit 402 displays a screen as shown in FIG.

[0175] When acquiring the linkage code, the customer management unit 402 transmits to the distribution control server 20 an “ID linkage request” including the acquired linkage code, the user's personal identification ID, and the business code.

[0176] The customer management unit 402 receives a response (positive response, negative response) to the ID federation request from the distribution control server 20. The customer management unit 402 notifies the user of the result of ID federation (ID federation success, ID federation failure).

[0177] In addition, the customer management unit 402 stores the address of the terminal 40 used by the user who has succeeded in ID federation as an ID federation completed address. Specifically, the customer management unit 402 adds the address of the terminal 40 to an ID federation completed list.

[0178] The customer management unit 402 processes login to a service account of a user. When processing an operation related to a login of a user, the customer management unit 402 refers to the ID federation completed list and determines whether the login request is from a terminal 40 with which ID federation has been completed.

[0179] If the login request is from a terminal 40 for which ID federation has not been completed, the customer management unit 402 requests the provision of login information from the user's terminal 40. That is, the customer management unit 402 authenticates the user using a method unique to the service provider.

[0180] If the login request is from a terminal 40 for which ID federation has been completed, the customer management unit 402 transmits an authentication request to the distribution control server 20. The customer management unit 402 receives a response (positive response, negative response) from the distribution control server 20. The customer management unit 402 performs an operation according to the response from the distribution control server 20. In this way, for login processing related to a user for whom ID federation has been completed, the customer management unit 402 performs authentication redirection to the information distribution system, requesting the user to carry out a procedure equivalent to logging in to a system account.

[0181] A detailed description of the operation of the customer management unit 402 regarding the generation of a service account will be omitted because the operation is obvious to those skilled in the art.

[0182] When providing a service to a new customer, the customer management unit 402 may generate a personal identification ID for the customer. Alternatively, the customer management unit 402 may obtain a personal identification ID generated by a staff member of the service provider.

[0183] The sharing request unit 403 is a means for requesting the information distribution business operator to "share" the user's data. The sharing request unit 403 transmits a sharing request to the distribution control server 20 in response to an operation by a staff member of the service business operator or the like. Specifically, the sharing request unit 403 transmits a sharing request to the distribution control server 20, the sharing request including the personal identification code of the user who is the subject of data acquisition, the business code of the user's own device, the type of data desired to be acquired, information on the data sharing destination, and the like.

[0184] The data storage unit 404 is a means for storing user data of the user (data resulting from providing a service to the user or data necessary for providing a service to the user). The data storage unit 404 stores the user's personal identification code and the user data in a storage database in association with each other (see FIG. 21).

[0185] As shown in Fig. 21, the data accumulation unit 404 stores information on the generated data in a field corresponding to the type of the generated data. Note that Fig. 21 shows an example of an accumulation database constructed in the service server 30-1 of the healthcare provider.

[0186] Every time the data accumulation unit 404 stores data in the accumulation database, it transmits location information to the distribution control server 20. For example, when acquiring user data of a user with a personal identification code “HL21”, location information including the personal identification code “HL21”, the business code “healthcare business operator”, and the data type “exercise time” is transmitted to the distribution control server 20.

[0187] The data distribution unit 405 is a means for realizing data distribution by “sharing.” The data distribution unit 405 processes a “sharing instruction” received from the distribution control server 20.

[0188] When a sharing instruction is received, the data distribution unit 405 refers to the accumulation database and identifies an entry corresponding to the personal identification code and data type included in the sharing instruction. For example, when a sharing instruction including the personal identification code "HL21" and the data type "sleep time" is received, the data distribution unit 405 identifies the entry shown in the top row of FIG.

[0189] The data distribution unit 405 transmits the stored data described in the corresponding data type field of the identified entry to the data sharing destination designated in the sharing instruction.

[0190] The storage unit 406 stores information necessary for the operation of the service server 30 .

[0191] [Device] Examples of the terminal 40 include a mobile terminal device such as a smartphone, a mobile phone, a game machine, a tablet, etc., a computer (personal computer, notebook computer), etc. The terminal 40 can be any equipment or device that can accept user operations and communicate with the portal server 10, etc.

[0192] For example, when the terminal 40 receives a biometric information provision request from the distribution control server 20, it displays a GUI that prompts the user to take a face image (a so-called GUI that prompts the user to take a selfie) and acquires the user's biometric information. The terminal 40 transmits the acquired biometric information to the distribution control server 20 as a response to the biometric information provision request.

[0193] Furthermore, since the configuration of the terminal 40 is clear to those skilled in the art, detailed explanation will be omitted.

[0194] [System Operation] Next, the operation of the information distribution system according to the first embodiment will be described.

[0195] Fig. 22 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. With reference to Fig. 22, the system operation when realizing ID federation will be described.

[0196] The service server 30 acquires a federation code from a person who desires ID federation (step S301).

[0197] When the service server 30 acquires the linkage code, the service server 30 transmits an ID linkage request to the distribution control server 20 (step S302).

[0198] When receiving the ID federation request, the distribution control server 20 transmits a biometric information provision request to the terminal 40 of the ID federation applicant (step S303).

[0199] In response to receiving the biometric information provision request, the terminal 40 acquires the biometric information of the user, and transmits the acquired biometric information (face image) to the distribution control server 20 (step S304).

[0200] The distribution control server 20 executes biometric authentication using the biometric information of the user identified using the link code and the biometric information provided by the terminal 40 (step S305).

[0201] If the biometric authentication is successful, the distribution control server 20 executes ID federation (step S306).

[0202] The distribution control server 20 notifies the service server 30 of the result of the ID federation (step S307).

[0203] The service server 30 notifies the user of the result of the ID federation (step S308).

[0204] In this way, when the portal server 10 accepts an ID federation procedure for a personal identification ID from a user, it requests the distribution control server 20 to issue an federation code. The distribution control server 20 generates an federation code linked to the user's system account, and transmits the generated federation code to the portal server 10. The portal server 10 notifies the user of the transmitted federation code.

[0205] The service server 30 acquires an association code from a user who desires ID federation, and transmits an ID federation request including a personal identification ID and the acquired association code to the distribution control server 20. The distribution control server 20 identifies the user who desires ID federation from the association code included in the ID federation request, and requests the identified user to provide biometric information. The distribution control server 20 performs biometric authentication using the biometric information acquired in response to the request and the biometric information stored in the system account, and if the biometric authentication is successful, associates the personal identification ID with the user ID.

[0206] As described above, in the information distribution system according to the first embodiment, a personal identification ID of a service account and a user ID of a system account are linked using a link code. Such ID linkage allows data stored by a service provider to be subject to data distribution. In addition, in the first embodiment, when receiving a service from a service provider with which ID linkage has been completed, the user is required to follow a procedure similar to that for logging in to a system account. As a result, high reliability can be given to data stored by a service provider with low authentication strength and identity verification strength.

[0207] Specifically, as shown in FIG. 23, when a system account of an information distribution system is generated, identity verification is performed using an identification document, and the identity verification strength for the user of the account is high. When a user logs in to a system account, multi-factor authentication such as a combination of ID authentication and biometric authentication is used, so the authentication strength for authenticating the authenticatee is also high. For example, a verification using an ID and a password is performed as a primary verification, and a verification (authentication) using biometric information is performed as a secondary verification, so that authentication with high strength is performed. In contrast, when an account of a service provider (e.g., a health care provider) is generated, identity verification is not performed, and the identity verification strength is low. When logging in to a service account of the service provider, only ID authentication using an ID and a password is performed, and the authentication strength for the authenticatee is also low. In the first embodiment, when a service is provided by a service provider with which ID federation has been completed (when logging in to a service account), the distribution control server 20 authenticates the authenticatee using single sign-on. As a result, the authentication strength and identity verification strength of the user who uses the service provider are ensured, and the reliability of the data accumulated by the service provider is improved.

[0208] As described above, in order to utilize user data accumulated by a service provider that does not require high identity verification or authentication strength when providing a service, it is necessary to increase the reliability of authentication by the service provider (service providing organization) that accumulates the data. Specifically, it is necessary to raise the authentication security level and identity verification level when accessing the service server 30 provided by the service provider to the same level as that of a system account. In order to raise the level, in the first embodiment, when receiving a service from a service provider (for example, when using a health app provided by a healthcare provider), an authentication request for the health app is redirected to an information distribution system. The information distribution system processes the authentication request for the health app (performs multi-factor authentication). As a result, the authentication security level when using the health app is raised to the level when using a personal portal. In addition, biometric authentication is performed when ID federation is performed using a federation code, so that the identity of the person using the health app and the person using the personal portal is confirmed. As a result, the identity verification level when using the health app is raised to the level when using a personal portal.

[0209] In this way, for example, applications provided by healthcare providers (health applications) may perform authentication using an ID and password, but do not perform biometric authentication, and therefore the authentication strength is low. In contrast, in the information distribution system according to the first embodiment, when a user uses a health application, the service account and system account are linked, and biometric authentication is required of the user. This makes it possible to increase the authentication strength when using applications such as health applications, and makes it possible to utilize user data accumulated by service providers such as healthcare providers.

[0210] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings.

[0211] In the first embodiment, ID linkage is described in the case where a user needs to log in to a service account managed by a service provider when receiving a service. In the second embodiment, a case where a personal identification ID of a service provider that does not need to log in is linked when receiving a service such as a hospital service is described.

[0212] The following description will focus on the differences between the first and second embodiments.

[0213] Fig. 24 is a diagram showing an example of a schematic configuration of an information distribution system according to the second embodiment. As shown in Fig. 24, the information distribution system according to the second embodiment includes a hospital terminal 50 installed inside a hospital and a service server 30-3 installed outside the hospital.

[0214] The hospital terminal 50 is used by staff of the service provider (hospital) that provides the second service, and is a terminal that stores the third ID and the user's personal identification information in association with each other. Specifically, the hospital terminal 50 stores the patient's personal information (such as name and date of birth), personal identification ID (for example, patient registration card number and health insurance card number), etc. The hospital terminal 50 is installed at a reception desk or the like. Hospital staff (hospital staff in the medical department or the like) use the hospital terminal 50 to perform their duties. The hospital terminal 50 is equipped with a camera device and is configured to be connectable to a network.

[0215] 25 is a diagram illustrating an example of a processing configuration (processing module) of the hospital terminal 50 according to the second embodiment. Referring to FIG. 25, the hospital terminal 50 includes a communication control unit 501, an ID federation instruction processing unit 502, and a storage unit 503.

[0216] The hospital terminal 50 executes processing related to the user ID of the system account and the individual identification ID of the hospital in response to an operation by the hospital staff member.

[0217] The communication control unit 501 is a means for controlling communication with other devices. For example, the communication control unit 501 receives data (packets) from the service server 30-3. The communication control unit 501 also transmits data to the service server 30-3. The communication control unit 501 passes the data received from the other devices to the other processing modules. The communication control unit 501 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules transmit and receive data to and from the other devices via the communication control unit 501. The communication control unit 501 has a function as a receiving unit that receives data from the other devices and a function as a transmitting unit that transmits data to the other devices.

[0218] The ID federation instruction processing unit 502 is a unit for processing instructions regarding ID federation from hospital staff. The ID federation instruction processing unit 502 will be described in detail later.

[0219] The storage unit 503 stores information necessary for the operation of the hospital terminal 50. A patient information database that stores information on patients is constructed in the storage unit 503. The patient information database stores the patient's identification information (personal information; name, date of birth, etc.) and personal identification ID (patient card number, etc.).

[0220] The service server 30-3 (fourth server device) accumulates a personal identification ID (such as a patient registration card number) necessary to provide a second service (medical service) to the user and data related to the second service to be provided to the user. The service server 30-3 is a server device (operation server) that stores data necessary for operating a data distribution service of patient user data (for example, medical examination results such as disease name).

[0221] The service server 30-3 provides an operation portal necessary for operating the hospital. The service server 30-3 stores the individual identification ID of the patient (user) and the user data (disease name, etc.) to be the subject of data distribution in association with each other.

[0222] The service server 30-3 also has a function related to ID linkage. That is, the service server 30-3 has a function of registering the individual identification ID (e.g., patient card number) of the patient in the system in order to make the accumulated data of the patient the subject of data circulation. Note that, unlike the first embodiment, the user cannot directly access the service server 30-3.

[0223] Fig. 26 is a diagram showing an example of a processing configuration (processing module) of a service server 30-3 according to the second embodiment. Referring to Fig. 26, a collation unit 407 is added to the configuration of the service server 30 according to the first embodiment.

[0224] Furthermore, the service server 30-3 differs from the service server 30 of the first embodiment in the operation of the ID federation function (customer management unit 402). Furthermore, the service server 30-3 includes an ID federation target database that stores information on those who wish to federate ID.

[0225] When a hospital-issued personal identification ID is to be the target of ID federation, the user operates the terminal 40 to log in to the system account. When carrying out the ID federation procedure, the user selects the hospital with which the user wishes to carry out ID federation.

[0226] The ID federation control unit 204 of the portal server 10 changes the request to the distribution control server 20 according to the information of the service provider entered by the user. Specifically, as described in the first embodiment, for a service provider that requires a user to log in to a service account when receiving a service, the ID federation control unit 204 requests the distribution control server 20 to issue a federation code.

[0227] On the other hand, as in the second embodiment, for a service provider (such as a hospital) that does not require a user to log in to a service account when receiving a service, the ID federation control unit 204 requests (requests) the distribution control server 20 to transmit the user's identity verification information. Specifically, the ID federation control unit 204 transmits a "request to transmit identity verification information" including the user's user ID and the provider code of the service provider (hospital) to the distribution control server 20 (step S51 in FIG. 27).

[0228] The ID linkage control unit 204 switches the request to the distribution control server 20 by referring to table information or the like that associates the business code with the service provision form of the service business (whether or not login to the service account is required).

[0229] When receiving the request to transmit personal identification information, the ID federation management unit 304 of the distribution control server 20 searches the user information database based on the user ID and identifies the corresponding user. The ID federation management unit 304 transmits the user ID, personal identification information (e.g., name or a combination of name and date of birth), and biometric information (e.g., face image) of the identified user to the hospital service server 30-3 (step S52).

[0230] The service server 30-3 stores the received user ID, personal identification information, and biometric information in an ID federation target database.

[0231] After completing the procedure for ID federation on the system account (portal server 10), the user visits the hospital. The user conveys the desire for ID federation to a hospital staff member at the hospital reception desk or accounting desk (see FIG. 28).

[0232] The hospital staff instructs the hospital terminal 50 to perform processing for ID federation. In response to the instruction, the ID federation instruction processing unit 502 acquires biometric information of the user in front of the hospital (the user who desires ID federation). The ID federation instruction processing unit 502 transmits a "matching request" including the acquired biometric information (face image) to the hospital service server 30-3 (step S61).

[0233] The matching unit 407 of the service server 30-3 executes a matching process (one-to-N matching; N is a positive integer, the same applies below) using the biometric information included in the matching request and the biometric information stored in the ID federation target database to identify the person who wishes to have ID federation and visited the hospital. The matching unit 407 transmits the identity verification information (for example, a name or a combination of a name and a date of birth) and the user ID of the identified user to the hospital terminal 50 (step S62).

[0234] The ID federation instruction processing unit 502 of the hospital terminal 50 extracts candidates (candidates) who wish to federate ID by searching the patient information database using the personal identification information acquired from the service server 30-3 as a key. The ID federation instruction processing unit 502 presents information about the extracted candidates who wish to federate ID to the hospital staff.

[0235] For example, when there is one candidate, the ID federation instruction processing unit 502 displays a GUI as shown in Fig. 29A. When there are multiple candidates, the ID federation instruction processing unit 502 displays a GUI as shown in Fig. 29B.

[0236] 29A and 29B, the ID federation instruction processing unit 502 displays a face image obtained by photographing the user in front of the user and the personal identification ID of the candidate extracted using the personal identification information. At that time, if multiple candidates are identified because patients with the same name are registered, the ID federation instruction processing unit 502 displays the personal identification IDs of the multiple candidates and displays a GUI that allows the hospital staff to select a person who wishes to have ID federation from the multiple candidates.

[0237] If there is only one candidate who wishes to federate IDs, the ID federation instruction processing unit 502 sends an ID federation request including the personal identification ID, user ID, and business code obtained by searching the patient information database to the distribution control server 20 (step S63 in FIG. 28).

[0238] If there are multiple people wishing to have their IDs linked, hospital staff will check the medical card or other documents submitted by the people wishing to have their IDs linked at the reception or when paying, and select the medical card number (personal identification ID) written on the medical card or other documents on the GUI shown in Figure 29B.

[0239] The ID federation instruction processing unit 502 transmits an ID federation request including the individual identification ID selected by the hospital staff, etc., to the distribution control server 20 (step S63 in FIG. 28).

[0240] The ID federation management unit 304 of the distribution control server 20 identifies the ID federation applicant based on the user ID included in the ID federation request. The ID federation management unit 304 sets the individual identification ID of the acquired business code for the identified user.

[0241] When the ID federation process is completed, the distribution control server 20 notifies the portal server 10 of the processing result (step S53 in FIG. 27). The portal server 10 notifies the user of the result of ID federation (ID federation success, ID federation failure). At that time, the portal server 10 may notify the user of the individual identification ID for which ID federation has been completed.

[0242] The user checks the result notified by the portal server 10. At that time, the user checks the personal identification ID (such as a patient registration card number) for which ID federation has been completed, and if it differs from the user's own personal identification ID, the user may request the portal server 10 to correct the personal identification ID. For example, the user may input the correct personal identification ID to the portal server 10. In this case, the portal server 10 may transmit an ID federation request including the personal identification ID to the distribution control server 20.

[0243] In this way, when the portal server 10 accepts a procedure for ID federation related to a personal identification ID (third ID) of a hospital or the like from a user, it requests the distribution control server 20 to transmit the identity verification information of the user who wishes to federate ID. In response to the request, the distribution control server 20 transmits the identity verification information and biometric information of the user who wishes to federate ID to the service server 30-3 (fourth server device). The hospital terminal 50 transmits a matching request including the biometric information of the user who wishes to federate ID to the service server 30-3. The service server 30-3 identifies the user who wishes to federate ID using the biometric information acquired from the hospital terminal 50 and the biometric information acquired from the distribution control server 20, and transmits the identity verification information of the identified user to the hospital terminal 50. The hospital terminal 50 transmits an ID federation request including the personal identification ID corresponding to the identity verification information acquired from the service server 30-3 to the distribution control server 20.

[0244] The hospital terminal 50 presents to the hospital staff a personal identification ID corresponding to the identity verification information acquired from the service server 30-3 and biometric information (face image) of the user who desires ID federation. At that time, if there are multiple candidates corresponding to the identity verification information acquired from the service server 30-3, the hospital terminal 50 presents the personal identification IDs of the multiple candidates to the hospital staff. The hospital terminal 50 transmits to the distribution control server 20 an ID federation request including an individual identification ID selected by the hospital staff from among the multiple personal identification IDs.

[0245] As described above, in the second embodiment, in order to utilize data (medical data) accumulated by a hospital or the like, a personal identification ID (such as a patient registration card number) managed by the hospital is registered in the system. When a user requests ID federation, the portal server 10 requests the distribution control server 20 to transmit the identity verification information of the ID federation applicant to the hospital's service server 30-3. The biometric information of the ID federation applicant is acquired by the hospital terminal 50, and the hospital terminal 50 requests the service server 30-3 to perform matching using the biometric information. The service server 30-3 identifies the ID federation applicant by matching processing using the biometric information, and transmits the identity verification information to the hospital terminal 50. The hospital terminal 50 identifies the ID federation applicant using the identity verification information notified by the service server 30-3 and the identity verification information (face details of the health insurance card stored by the hospital) in the patient information database. That is, the hospital terminal 50 performs primary matching using the identity verification information. When multiple ID federation applicants are extracted due to duplication of names, etc., the hospital terminal 50 presents a candidate list consisting of multiple ID federation applicants to the hospital staff. The hospital staff performs secondary matching using the presented candidate list and the patient card, etc. presented by the ID federation applicant to identify the final ID federation target patient. In this way, in the second embodiment, matching (authentication) using biometric information is performed as the primary matching, and visual matching by the hospital staff is performed as the secondary matching. In addition, since the candidate list includes a personal identification ID (such as a patient card number), the hospital staff can identify the ID federation applicant without inputting the number. Therefore, there is almost no load on the hospital staff. The hospital terminal 50 notifies the distribution control server 20 of an ID federation request including the personal identification ID of the ID federation applicant. The distribution control server 20 performs ID federation for the notified personal identification ID.

[0246] As described above, when using data managed by a hospital or the like that does not require logging in to a service account, logging in to a system account is required (multi-factor authentication is performed). Therefore, the authentication security level when using data stored in a hospital (medical data) is raised to the level when using an information distribution system. In addition, in hospitals, face-to-face identity verification (checking the patient's face) is performed when creating a patient card, and the level of identity verification is inherently high. In this respect, there is no problem. However, when linking the system's user ID and individual identification ID, if hospital staff are asked to input the patient card number into the system, the burden on the staff increases. Regarding this problem, in the second embodiment, the hospital terminal 50 automatically identifies the patient card number, eliminating the need to match IDs and reducing the burden on hospital staff.

[0247] Next, the hardware of each device constituting the information distribution system will be described.

[0248] The distribution control server 20 can be configured by an information processing device (so-called a computer), and has the configuration exemplified in Fig. 30. For example, the distribution control server 20 includes a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0249] However, the configuration shown in Fig. 30 is not intended to limit the hardware configuration of the distribution control server 20. The distribution control server 20 may include hardware not shown, and may not include the input / output interface 313 as necessary. Furthermore, the number of processors 311 and the like included in the distribution control server 20 is not intended to be limited to the example shown in Fig. 30, and for example, the distribution control server 20 may include multiple processors 311.

[0250] The processor 311 is, for example, a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0251] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0252] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a keyboard, a mouse, etc. that accepts user operations.

[0253] The communication interface 314 is a circuit, a module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0254] The functions of the distribution control server 20 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network, or updated using a storage medium storing the program. The processing modules may also be realized by a semiconductor chip.

[0255] The portal server 10, the service server 30, and the like can also be configured from information processing devices similar to the distribution control server 20, and their basic hardware configurations are no different from that of the distribution control server 20, so a description thereof will be omitted.

[0256] The distribution control server 20, which is an information processing device, is equipped with a computer, and the computer executes a program to realize the functions of the distribution control server 20. In addition, the distribution control server 20 executes a control method of the distribution control server 20 by the program.

[0257] [Variations] The configuration, operation, and the like of the information distribution system described in the above embodiment are merely examples, and are not intended to limit the system configuration, and the like.

[0258] In the above embodiment, the portal server 10 serves as an interface for system accounts. However, all or part of the functions of the portal server 10 may be performed by the distribution control server 20. The information distribution system does not need to include the portal server 10. In other words, the terminal 40 and the distribution control server 20 may directly transmit and receive a "linkage code issuance request" or an "ID linkage request."

[0259] In the above embodiment, the case where the distribution control server 20 has a function of managing users (account generation, login management) and a function of controlling data distribution has been described. However, these functions may be realized by different server devices. Specifically, a management server 21 that manages users and a control server 22 that controls data distribution may be included in the system (see FIG. 31). In this case, the management server 21 operates as a so-called eKYC (electronic Know Your Customer) server. The configurations, operations, etc. of the management server 21 and the control server 22 are clear from the operations according to the first and second embodiments, so a description thereof will be omitted.

[0260] In the above embodiment, the multi-factor authentication adopted by the information distribution system is described by taking as an example authentication using ID and password and authentication using biometric information. However, it is obvious that the multi-factor authentication is not limited to ID authentication and biometric authentication. For example, the information processing system may adopt email address authentication (terminal authentication) in which an email including a verification URL (Uniform Resource Locator) is sent to the email address.

[0261] In the above embodiment, a face image is used as biometric information. However, the biometric information may be a feature generated from a face image. For example, the feature may be registered instead of a face image when a system account is generated.

[0262] Furthermore, the information distribution system may utilize biometric information other than face images and feature amounts. That is, examples of biometric information include data (feature amounts) calculated from physical features unique to an individual, such as the face, fingerprint, voiceprint, veins, retina, and iris pattern. Alternatively, the biometric information may be image data such as a face image or fingerprint image. The biometric information may be any information that includes the physical features of a user.

[0263] In the above embodiment, the distribution control server 20 generates a character string consisting of a combination of numbers and letters as an association code and issues it to the user. In this case, the distribution control server 20 may issue a two-dimensional code into which the character string is converted to the user as the association code. In other words, the association code issued to the user is not limited to the character string shown in FIG. 20.

[0264] In the above embodiment, a case has been described in which the user information database is configured inside the distribution control server 20, but the database may be constructed in an external database server or the like. That is, some of the functions of the distribution control server 20 may be implemented in another server. More specifically, the above-described "ID federation management unit (ID federation management means)", "data distribution control unit (data distribution control means)", etc. may be implemented in any of the devices included in the system.

[0265] Although the form of data transmission between each device (portal server 10, distribution control server 20, etc.) is not particularly limited, data transmitted between these devices may be encrypted. Personal information of users and the like is transmitted between these devices, and in order to appropriately protect this information, it is desirable to transmit and receive encrypted data.

[0266] In the flow charts (flow charts, sequence diagrams) used in the above description, multiple steps (processes) are described in order, but the order of execution of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the figures can be changed to a degree that does not interfere with the content, such as executing each process in parallel.

[0267] The above-mentioned embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. In addition, when a plurality of embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace a part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace a part of the configuration of an embodiment with another configuration.

[0268] From the above explanation, the industrial applicability of the present invention is clear, and the present invention can be suitably applied to an information distribution system that distributes stored data related to services provided to users.

[0269] A part or all of the above-described embodiments may be described as, but is not limited to, the following supplementary notes. [Appendix 1] a first server device that stores a first ID required to provide a first service to a user who has logged in to a first account and accumulates data related to the first service provided to the user; a second server device that controls data distribution of the stored data for the user who has logged in to a second account; Including, The system wherein, after a first ID managed by the first account and a second ID managed by the second account are associated with each other, when the user logs in to the first account, the second server device requests the user to follow the same procedure as the procedure for logging in to the second account. [Appendix 2] a third server device that accepts a login request to the second account by the user and requests the second server device to authenticate the user; 2. The system of claim 1, wherein the second server device performs multi-factor authentication on the user and notifies the third server device of the result of the multi-factor authentication. [Appendix 3] The system described in Appendix 2, wherein the second server device stores at least biometric information for authenticating the user logging in to the second account. [Appendix 4] When the third server device accepts an ID federation procedure for the first ID from the user, the third server device requests the second server device to issue a federation code; The second server device generates the link code associated with the second account of the user, and transmits the generated link code to the third server device; The system described in Appendix 3, wherein the third server device notifies the user of the transmitted link code. [Appendix 5] The first server device acquires the federation code from a user who desires the ID federation, and transmits an ID federation request including the first ID and the acquired federation code to the second server device; The second server device is Identifying a user who wishes to federate the ID from a federation code included in the ID federation request, and requesting the identified user to provide biometric information; The system described in Appendix 4, which performs biometric authentication using the biometric information acquired in response to the request and the biometric information stored in the second account, and if the biometric authentication is successful, associates the first ID with the second ID. [Appendix 6] a fourth server device that stores a third ID necessary for providing a second service to the user and data related to the second service to be provided to the user; a terminal used by a staff member of a service provider providing the second service, the terminal storing the third ID and the user's personal identification information in association with each other; Further comprising: The system described in Appendix 2, wherein the terminal executes processing related to linking the second ID and the third ID in response to the operation of the staff member. [Appendix 7] When the third server device accepts a procedure for ID federation regarding the third ID from the user, it requests the second server device to transmit identity verification information of the user who desires the ID federation; The second server device transmits, in response to the request, personal identification information and biometric information of the user who wishes to federate the ID to the fourth server device; The terminal transmits a matching request including biometric information of the user who desires to federate the ID to the fourth server device; The fourth server device identifies a user who wishes to perform the ID federation using the biometric information acquired from the terminal and the biometric information acquired from the second server device, and transmits personal identification information of the identified user to the terminal; The system described in Appendix 6, wherein the terminal sends an ID federation request to the second server device, the ID federation request including the third ID corresponding to the personal identification information acquired from the fourth server device. [Appendix 8] The terminal includes: The system described in Appendix 7, wherein the third ID corresponding to the personal identification information obtained from the fourth server device and the biometric information of the user who wishes to link the IDs are presented to the staff member. [Appendix 9] the terminal presents to the staff a plurality of the third IDs corresponding to the identity verification information acquired from the fourth server device; The system described in Appendix 7 or 8, wherein the ID integration request including a third ID selected by the staff from among the plurality of third IDs is sent to the second server device. [Appendix 10] The system according to any one of claims 1 to 9, wherein the multi-factor authentication includes authentication using an ID and a password, and authentication using biometric information. [Appendix 11] 11. The system of claim 10, wherein the biometric information is a facial image or a feature generated from the facial image. [Appendix 12] a communication control unit that stores a first ID required to provide a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with a server; a data distribution control unit that controls data distribution of the stored data for the user who has logged in to a second account; an ID federation management unit that associates a first ID managed by the first account with a second ID managed by the second account; a login management unit that requests the user to follow the same procedure as that for logging in to the second account when logging in to the first account after the first ID and the second ID are associated with each other; A server device comprising: [Appendix 13] A server device that stores a first ID required for providing a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with a server, Controlling data distribution of the stored data for the user who has logged in to the second account; Correlating a first ID managed by the first account with a second ID managed by the second account; A control method for a server device, wherein after the first ID and the second ID are associated with each other, when the user logs in to the first account, the user is requested to follow the same procedure as that for logging in to the second account. [Appendix 14] A computer installed in a server device stores a first ID required for providing a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with the server. A process of controlling data distribution of the stored data for the user who has logged in to a second account; A process of associating a first ID managed by the first account with a second ID managed by the second account; After the first ID and the second ID are associated with each other, when the user logs in to the first account, a process of requesting the user to follow the same procedure as that for logging in to the second account; A computer-readable storage medium that stores a program for executing the above.

[0270] The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be understood by those skilled in the art that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas. [Explanation of symbols]

[0271] 10 Portal Server 20 Distribution Control Server 21 Management Server 22 Control Server 30 Service Server 30-1 Service server 30-2 Service Server 30-3 Service Server 40 Terminals 50 Hospital terminals 101 First server device 102 Second server device 201 Communication control section 202 Account creation control unit 203 Login control section 204 ID linkage control unit 205 Storage section 301 Communication Control Unit 302 Account Management Department 303 Login Management Department 304 ID Linkage Management Department 305 Location Information Management Department 306 Data Distribution Control Unit 307 Storage section 311 Processor 312 Memory 313 Input / Output Interface 314 Communication Interface 401 Communication control section 402 Customer Management Department 403 Sharing Request Department 404 Data Storage Department 405 Data Distribution Department 406 Storage section 407 Matching Unit 501 Communication control section 502 ID linking instruction processing unit 503 Storage section

Claims

1. a first server device that stores a first ID required for providing a first service to a user who has logged in to a first account and accumulates data related to the first service provided to the user; a second server device that controls data distribution of the stored data for the user who has logged in to a second account; Including, The system further comprises: after a first ID managed in the first account and a second ID managed in the second account are associated with each other, when the user logs in to the first account, the second server device requests the user to follow the same procedure as that for logging in to the second account.

2. a third server device that accepts a login request to the second account by the user and requests the second server device to authenticate the user; The system according to claim 1 , wherein the second server device performs multi-factor authentication on the user and notifies the third server device of a result of the multi-factor authentication.

3. The system according to claim 2 , wherein the second server device stores at least biometric information for authenticating the user logging in to the second account.

4. When the third server device accepts a procedure for ID federation regarding the first ID from the user, the third server device requests the second server device to issue a federation code; The second server device generates the link code associated with the second account of the user, and transmits the generated link code to the third server device; The system according to claim 3 , wherein the third server device notifies the user of the transmitted link code.

5. The first server device acquires the federation code from a user who desires the ID federation, and transmits an ID federation request including the first ID and the acquired federation code to the second server device; The second server device is Identifying a user who desires to federate the ID from a federation code included in the ID federation request, and requesting the identified user to provide biometric information; The system according to claim 4, further comprising: performing biometric authentication using the biometric information acquired in response to the request and the biometric information stored in the second account; and, if the biometric authentication is successful, associating the first ID with the second ID.

6. a fourth server device that stores a third ID necessary for providing a second service to the user and data related to the second service to be provided to the user; a terminal used by a staff member of a service provider providing the second service, the terminal storing the third ID and the user's personal identification information in association with each other; Further comprising: The system according to claim 2 , wherein the terminal executes a process related to linking the second ID and the third ID in response to an operation by the staff member.

7. When the third server device accepts a procedure for ID federation regarding the third ID from the user, the third server device requests the second server device to transmit identity verification information of the user who desires the ID federation; The second server device transmits, in response to the request, personal identification information and biometric information of the user who wishes to federate the ID to the fourth server device; The terminal transmits a matching request including biometric information of the user who desires the ID federation to the fourth server device; The fourth server device identifies a user who wishes to perform the ID federation using the biometric information acquired from the terminal and the biometric information acquired from the second server device, and transmits personal identification information of the identified user to the terminal; The system according to claim 6 , wherein the terminal transmits, to the second server device, an ID federation request including the third ID corresponding to the personal identification information acquired from the fourth server device.

8. a communication control unit that stores a first ID required for providing a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with a server; a data distribution control unit that controls data distribution of the stored data for the user who has logged in to a second account; an ID federation management unit that associates a first ID managed by the first account with a second ID managed by the second account; a login management unit that requests the user to follow the same procedure as that for logging in to the second account when logging in to the first account after the first ID and the second ID are associated with each other; A server device comprising:

9. A server device that stores a first ID required for providing a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with a server, Controlling data distribution of the stored data for the user who has logged in to the second account; Correlating a first ID managed by the first account with a second ID managed by the second account; A control method for a server device, wherein after the first ID and the second ID are associated with each other, when the user logs in to the first account, the user is requested to follow the same procedure as that for logging in to the second account.

10. A computer installed in a server device stores a first ID required for providing a first service to a user who has logged in to a first account, accumulates data related to the first service provided to the user, and communicates with the server. A process of controlling data distribution of the stored data for the user who has logged in to a second account; A process of associating a first ID managed by the first account with a second ID managed by the second account; a process of requesting the user to follow the same procedure as that for logging in to the second account when the user logs in to the first account after the first ID and the second ID are associated with each other; A program for executing.

Images