Authentication System

Abstract

To provide an authentication system which can unlock electric locks without downloading a dedicated application.SOLUTION: A connection processing unit of a communication terminal is connected to a web server using specific URL information from a web browser installed in a communication terminal. A reception processing unit of the communication terminal receives key information, which is information for unlocking the electric lock, and control data, which are data for controlling the web browser, from the web server. A control transmission processing unit of the communication terminal transmits the key information to an authentication device by controlling a terminal short-range communication unit by the web browser based on the received control data. A transmission processing unit of the web server transmits key information and control data to the communication terminal when the communication terminal is connected to the web server. A key information receiving unit of the authentication device receives key information from the communication terminal via an authentication short-range communication unit. An unlock processing unit of the authentication device unlocks the electric lock based on the received key information.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to authentication systems. [Background technology]

[0002] Patent Document 1 discloses a system for locking and unlocking an electric lock through a mobile terminal such as a smartphone. In this system, the mobile terminal connects to an electronic certificate issuing site through an Internet browser (i.e., a web browser). The mobile terminal then receives from the electronic certificate issuing site an electronic certificate indicating that the ID of the electric lock corresponds to the ID of the mobile terminal. When an unlocking app that requests unlocking is started on the mobile terminal, the mobile terminal transmits the electronic certificate stored in the memory unit of the mobile terminal to a lock control terminal of the electric lock by short-range wireless communication. The lock control terminal authenticates the mobile terminal based on the electronic certificate received from the mobile terminal and controls the electric lock. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-173523 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the system of Patent Document 1, a dedicated application software (hereinafter referred to as "app"), an unlocking app, is downloaded to a communication terminal such as a mobile terminal, and the electric lock is unlocked through the unlocking app. In other words, to unlock the electric lock, the user must download a dedicated app to the communication terminal, which is troublesome for the user.

[0005] One aspect of the present disclosure aims to provide an authentication system that can unlock an electric lock without downloading a dedicated app. [Means for solving the problem]

[0006] One aspect of the present disclosure is an authentication system including a communication terminal, an authentication device installed in an electric lock, and a web server. The communication terminal includes a terminal short-range communication unit, a connection processing unit, a reception processing unit, and a control transmission processing unit. The terminal short-range communication unit performs short-range wireless communication. The connection processing unit connects to the web server using specific URL information from a web browser implemented in the communication terminal. The reception processing unit receives key information, which is information for unlocking the electric lock, and control data, which is data for controlling the web browser, from the web server. The control transmission processing unit transmits the key information to the authentication device by the web browser controlling the terminal short-range communication unit based on the received control data. The web server includes a transmission processing unit. The transmission processing unit transmits the key information and the control data to the communication terminal when the communication terminal connects to the web server. The authentication device includes an authentication short-range communication unit, a key information receiving unit, and an unlocking processing unit. The authentication short-range communication unit performs short-range wireless communication. The key information receiving unit receives the key information from the communication terminal via the authentication short-range communication unit. The unlocking processing unit unlocks the electric lock based on the received key information.

[0007] According to this configuration, the web browser of the communication terminal controls the terminal short-range communication unit to transmit the key information to the authentication device and unlock the electric lock. Therefore, the electric lock can be unlocked without downloading a dedicated app for unlocking the electric lock to the communication terminal. This reduces the user's effort.

[0008] In one aspect of the present disclosure, the control transmission processing unit of the communication terminal may transmit the key information and the terminal ID to the authentication device by the web browser controlling the short-range wireless communication unit based on the control data received from the web server. The terminal ID is information for identifying the communication terminal. The authentication device may further include a storage processing unit and a determination unit. The storage processing unit stores the terminal ID received from the communication terminal in the storage unit. When the determination unit receives the terminal ID from the communication terminal after storing the terminal ID by the storage processing unit, it determines whether the terminal ID stored in the storage unit matches the received terminal ID. The unlocking processing unit may unlock the electric lock when the determination unit determines that the terminal ID stored in the storage unit matches the received terminal ID.

[0009] According to this configuration, after the terminal ID of the communication terminal is stored in the authentication device (for example, when the electric lock is unlocked for the second time or later), the communication terminal transmits the terminal ID to the authentication device, and the user of the communication terminal can unlock the electric lock without connecting to the web server. This reduces the user's trouble compared to a configuration in which the user must connect to the web server every time the electric lock is unlocked.

[0010] In one aspect of the present disclosure, the terminal short-range communication unit and the authentication short-range communication unit may perform short-range wireless communication based on the NFC standard. According to this configuration, it is possible to improve the reliability with which the communication terminal and the authentication device can transmit and receive key information and the like. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing the overall configuration of an authentication system. [Diagram 2] FIG. 2 is a block diagram showing the configuration of a communication terminal. [Diagram 3] FIG. 3 is a block diagram showing the configuration of the web server. [Figure 4] FIG. 4 is a block diagram showing the configuration of the authentication device. [Diagram 5]FIG. 5 is a sequence diagram showing the process executed by each device of the authentication system at the time of initial authentication. [Figure 6] FIG. 6 shows an application screen for a user to apply for the issuance of key information. [Figure 7] FIG. 7 shows an instruction screen that instructs the user to hold the communication terminal over the electric lock. [Figure 8] FIG. 8 is a sequence diagram showing the process executed by each device of the authentication system at the second or subsequent authentication times. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. [1. Configuration] 1 is a system for unlocking an electric lock 40 installed on a door using a communication terminal 10. The authentication system 1 includes the communication terminal 10, a web server 20, an authentication device 30, and the electric lock 40. <Communication terminal> The communication terminal 10 is a portable communication terminal such as a smartphone, a tablet terminal, etc. The communication terminal 10 includes a display unit 11, an input unit 12, a terminal communication unit 13, a terminal control unit 14, and a terminal storage unit 15, as shown in FIG.

[0013] The display unit 11 includes a display device capable of displaying images, such as a liquid crystal display or an organic EL display. The input unit 12 includes an input device for receiving various input operations. The input device of the input unit 12 includes, for example, a touch panel.

[0014] The terminal communication unit 13 is an interface for communicating with an external device, and includes a short-range communication unit 131 and an Internet communication unit 132. The short-distance communication unit 131 is an interface for performing short-distance wireless communication with an external device such as the authentication device 30. In this embodiment, the short-distance communication unit 131 performs NFC communication, which is short-distance wireless communication based on the NFC standard. NFC is an abbreviation for Near Field Communication. Specifically, the short-distance communication unit 131 performs FeliCa communication as NFC communication. Here, FeliCa communication refers to communication in the FeliCa (registered trademark) format. In the following, the short-distance communication unit 131 is also referred to as "NFC communication unit 131."

[0015] The Internet communication unit 132 is an interface for communicating with external devices such as the web server 20 via the Internet N. The terminal control unit 14 includes, for example, a CPU 141. The terminal storage unit 15 includes, for example, a semiconductor memory such as a ROM, a RAM, an NVRAM, or a flash memory. That is, the communication terminal 10 includes a microcomputer including the CPU 141 and the semiconductor memory. The terminal control unit 14 also realizes various functions by executing a program stored in a non-transient substantial storage medium. In this embodiment, the terminal storage unit 15 corresponds to the non-transient substantial storage medium that stores the program.

[0016] In this embodiment, a terminal ID and a web browser BR are stored in the terminal storage unit 15. The terminal ID here is information for identifying the communication terminal 10, and is a FeliCa IDm in this embodiment. Furthermore, the communication terminal 10 can connect to the Internet N using the web browser BR stored in the terminal storage unit 15, and can connect to an external device such as a web server 20 using the Internet N. Furthermore, the communication terminal 10 can use various search engines on the Internet N using the web browser BR.

[0017] Here, the web browser BR of this embodiment is a web browser compatible with the webNFC technology. The webNFC technology is a technology in which a web browser controls an NFC communication unit of a communication terminal to transmit and receive information by NFC communication. Specifically, when transmitting and receiving information by the webNFC technology, for example, the following procedure is performed. That is, first, a program for operating the NFC communication unit of the communication terminal is stored in advance in a web server. Then, when the communication terminal connects to the web server through the web browser, the web browser of the communication terminal reads the program stored in the web server and controls the NFC communication unit according to the program. Then, the NFC communication unit of the communication terminal performs NFC communication with surrounding devices. In this embodiment, as described later, key information is transmitted and received using this WebNFC technology. <Web server> The web server 20 is installed by a predetermined business entity on the Internet N. The web server 20 is a web server for providing a key information issuing service.

[0018] The key information issuing service here is a service that accepts an application for issuance of key information from a user of the service (a user of the communication terminal 10 in this embodiment) via the Internet N and issues the key information. Key information is information for unlocking an electric lock, such as a password. In the key information issuing service, as described below, the communication terminal 10 receives key information from the web server 20 and transmits the key information to the authentication device 30 of the electric lock 40 using WebNFC technology.

[0019] The web server 20 providing the key information issuing service includes a server communication unit 21, a server control unit 22, and a server storage unit 23, as shown in FIG. The server communication unit 21 is an interface for communicating with an external device such as the communication terminal 10 via the Internet N.

[0020] The server control unit 22 includes, for example, a CPU 221. The server storage unit 23 includes, for example, a semiconductor memory such as a ROM, a RAM, an NVRAM, or a flash memory. That is, the web server 20 includes a microcomputer including the CPU 221 and the semiconductor memory. The server control unit 22 also realizes various functions by executing a program stored in a non-transient substantial storage medium. In this embodiment, the server storage unit 23 corresponds to the non-transient substantial storage medium that stores the program.

[0021] In this embodiment, the server storage unit 23 stores web page information, a generation algorithm GA, registration information, and control data. The web page information here refers to information on a web page (HTML code, scripting content, style sheet, image, etc.) displayed on the display unit 11 of the user's communication terminal 10 when using the key information issuing service. The web page information stored in the server storage unit 23 includes web page information showing a registration screen, an application screen, an instruction screen, etc., which will be described later.

[0022] The generation algorithm GA is a predetermined algorithm for generating key information. Specifically, the generation algorithm GA is an algorithm for generating key information based on a lock ID and date and time information. The lock ID here is information for identifying the electric lock to be unlocked, such as the serial number of the electric lock to be unlocked. That is, the server storage unit 23 stores in advance the lock ID of the electric lock to be unlocked (generally the lock IDs of multiple electric locks including electric lock 40), and the key information is generated using the lock ID.

[0023] On the other hand, the date and time information is information indicating the date and time of issue of the key information, the period during which the issued key information can be used effectively, etc. In this embodiment, as described later, a user of the key information issuing service applies for the issuance of key information by specifying the issue date and time of the key information. The generation algorithm GA also uses this date and time information to generate key information. Note that the key information generated by the generation algorithm GA may be, for example, a number of any number of digits.

[0024] On the other hand, the registration information is information that is registered in the server storage unit 23 by the user inputting various pieces of information when starting to use the key information issuing service. In this embodiment, the registration information includes a user ID for identifying the user, a password for personal authentication of the user, and the lock ID of the electric lock to be unlocked. That is, as described later, in this embodiment, the user specifies the electric lock to be unlocked when starting to use the key information issuing service.

[0025] On the other hand, the control data is data for controlling the web browser of the communication terminal. In other words, the control data is data including processing contents to be executed by the web browser of the communication terminal 10 or other communication terminal when the communication terminal 10 or other communication terminal connects to the web server 20. In this embodiment, the control data is a program for operating the short-range communication unit 131 of the communication terminal 10 to perform NFC communication. The control data includes a program for transmitting the key information acquired from the web server 20 to the authentication device 30 by NFC communication. In addition, the control data includes a program for transmitting the terminal ID of the communication terminal 10 together with the key information by NFC communication when the terminal ID of the communication terminal 10 is stored in the terminal storage unit 15 of the communication terminal 10. <Authentication device> The authentication device 30 is a device that receives authentication information and, if authentication is successful, unlocks the electric lock 40 connected to the authentication device 30. The authentication information here includes key information and a terminal ID transmitted from the communication terminal 10.

[0026] As shown in FIG. 4, the authentication device 30 includes an authentication communication unit 31, an authentication control unit 32, an authentication storage unit 33, and an unlocking control unit . The authentication communication unit 31 is an interface for performing short-distance wireless communication with an external device such as the communication terminal 10. In this embodiment, the authentication communication unit 31 performs NFC communication. Specifically, the authentication communication unit 31 performs FeliCa communication as the NFC communication. The authentication communication unit 31 periodically broadcasts an advertising signal having an ID or the like for identifying the authentication device 30 to the surrounding area, and communicates with the communication terminal 10 that responds to the advertising signal.

[0027] The authentication control unit 32 includes, for example, a CPU 321. The authentication storage unit 33 includes, for example, a semiconductor memory such as a ROM, a RAM, an NVRAM, or a flash memory. That is, the authentication device 30 includes a microcomputer including the CPU 321 and the semiconductor memory. The authentication control unit 32 also realizes various functions by executing a program stored in a non-transient substantial storage medium. In this embodiment, the authentication storage unit 33 corresponds to the non-transient substantial storage medium that stores the program.

[0028] In this embodiment, the authentication storage unit 33 stores a decryption algorithm DA and the lock ID of the electric lock 40. The decryption algorithm DA is an algorithm for decrypting the key information received from the communication terminal 10. In detail, the decryption algorithm DA in this embodiment is an algorithm for calculating the lock ID that is the basis for generating the key information from the key information generated by the generation algorithm GA stored in the server storage unit 23 of the web server 20 described above. In other words, the decryption algorithm DA is an algorithm for calculating backwards the lock ID from the key information received from the communication terminal 10.

[0029] In this embodiment, the authentication control unit 32 determines that authentication is successful when the key information obtained by reverse calculation using the decryption algorithm DA matches the lock ID of the electric lock 40 previously stored in the authentication memory unit 33.

[0030] The unlock control unit 34 transmits a control signal to an electric lock 40 connected to the authentication device 30 via a communication cable in accordance with the authentication result of the authentication control unit 32 . <Electric lock> The electric lock 40 is a lock that locks and unlocks by an electric signal. The electric lock 40 is connected to the authentication device 30 by a communication cable. When the electric lock 40 receives a control signal from the authentication device 30 via the communication cable, it locks and / or unlocks the door in response to the control signal.

[0031] [2. Processing] Next, the processes executed by each of the devices 10-40 of the authentication system 1 will be described. In the following, for ease of understanding, when describing the processes executed by the terminal control unit 14 of the communication terminal 10 according to a program, the terminal control unit 14 will not be described as the subject, but the communication terminal 10 will be described as the subject. Similarly, when describing the processes executed by the server control unit 22 of the web server 20 and the authentication control unit 32 of the authentication device 30 according to a program, the web server 20 and the authentication device 30 will be described as the subject.

[0032] In the following, first, a case where the user of the communication terminal 10 uses the key information issuing service to unlock the electric lock 40 for the first time (i.e., the first authentication) will be described with reference to Fig. 5. Then, a case where the user of the communication terminal 10 uses the key information issuing service to unlock the electric lock 40 again (i.e., the second or subsequent authentication) will be described with reference to Fig. 8. <First time authentication> 5, first, the user of the communication terminal 10 performs user registration in order to start using the key information issuing service. Specifically, in S100, the communication terminal 10 uses the web browser BR to search for the key information issuing service on the Internet N, and connects to the web server 20.

[0033] Then, in response to a request from the communication terminal 10, the web server 20 transmits registration screen information to the communication terminal 10 in S101. The registration screen information here is web page information showing a registration screen (not shown) which is a screen for the user to input registration information.

[0034] Next, in S102, the communication terminal 10 outputs a registration screen on the display unit 11 using the web browser BR based on the received registration screen information. Next, in S103, the communication terminal 10 accepts an input of registration information from the user via the input unit 12. In this embodiment, the user inputs a user ID and a password on the registration screen. The user also designates the electric lock 40 to be unlocked on the registration screen.

[0035] The specification for specifying the electric lock 40 to be unlocked on the registration screen is not particularly limited, but as an example, the electric lock 40 to be unlocked may be specified as follows: That is, a list of buildings in which electric locks are installed (branch No. 1 and branch No. 2 of rental office A, or branch No. 1 and branch No. 2 of facility B, etc.) is displayed on the registration screen, and the user selects from the list the building in which the electric lock 40 to be unlocked is installed. Then, the electric lock installed in the selected building (for example, the electric lock installed in branch No. 1 of rental office A) may be specified as the electric lock 40 to be unlocked.

[0036] Next, in S104, the communication terminal 10 transmits to the web server 20 via the Internet communication unit 132 the registration information including the user ID and password input in S103 and information identifying the electric lock 40 to be unlocked.

[0037] Next, in S105, the web server 20 stores (registers) the registration information received from the communication terminal 10 via the server communication unit 21 in the server storage unit . Next, in S106, the web server 20 transmits URL information to the communication terminal 10 via the server communication unit 21. The URL information here is URL information for connecting to the web server 20. Specifically, in this embodiment, the URL information transmitted in S106 is URL information for connecting to an application screen, which is a web page provided by the web server 20. The application screen is a screen for applying for the issuance of key information, and will be described in detail later. In addition, in this embodiment, the web server 20 transmits different URL information for each electric lock 40 to be unlocked by the user. That is, the web server 20 transmits URL information to the communication terminal 10 according to information identifying the electric lock 40 included in the registration information received from the communication terminal 10 in S104. Then, the user accesses the application screen corresponding to the electric lock 40 to be unlocked and applies for the issuance of key information.

[0038] For example, the user of the communication terminal 10 may receive the URL information from the web server 20 together with a message such as "From now on, if you wish to unlock the specified electric lock, please access the URL information."

[0039] Next, in S107, the communication terminal 10 connects to the web server 20 from the web browser BR using the URL information received in S106. Then, in response to the request from the communication terminal 10, the web server 20 transmits the application screen information to the communication terminal 10 in S108. The application screen information is web page information showing an application screen which is a screen for a user to input application information for applying for issuance of key information.

[0040] Next, in S109, the communication terminal 10 uses the web browser BR based on the application screen information received from the web server 20 to output an application screen as shown in FIG.

[0041] Next, in S110, the communications terminal 10 accepts input of application information from the user via the input unit 12. On this application screen, the user inputs a user ID, a password, and the issue date and time of the key information.

[0042] In this embodiment, key information that is valid only for a predetermined time from the issue date and time input by the user is issued. For example, if the user is close to the electric lock 40 that he or she wishes to unlock and wants to immediately unlock the electric lock 40, it is assumed that the user will input the current time or the time immediately following the current time as the issue date and time. After inputting the user ID, password, and issue date and time, the user presses the "Get key information" button on the application screen. This completes the input of application information including the user ID, password, and issue date and time information.

[0043] In this embodiment, as described above, the communication terminal 10 acquires the application screen information from the web server 20 using the URL information corresponding to the electric lock 40 to be unlocked. Therefore, even if the user does not specify the electric lock 40 to be unlocked on the application screen, the electric lock 40 to be unlocked can be identified on the web server 20 side by simply applying for the issuance of key information through the application screen acquired from the web server 20.

[0044] Next, in S111, the communication terminal 10 transmits the application information accepted from the user to the web server 20 via the Internet communication unit 132. Next, in S112, the web server 20 performs personal authentication of the user using the application information received from the communication terminal 10. In S112, the web server 20 judges whether or not the user ID and password included in the received application information match the user ID and password included in the registration information registered in S105 described above. If the user ID and password match, the web server 20 judges that the personal authentication is successful. On the other hand, if at least one of the user ID and password does not match, the web server 20 judges that the personal authentication is not successful. In the example shown in FIG. 5, it is assumed that the user ID and password match and the personal authentication is successful. If the personal authentication is not successful, the processes from S113 onwards are not executed.

[0045] When the personal authentication is successful in S112, the web server 20 generates key information in the following S113. Specifically, the web server 20 generates the key information using the generation algorithm GA stored in the server storage unit 23, based on the lock ID (e.g., serial number, etc.) of the electric lock 40 to be unlocked, which is included in the registration information, and the issue date and time information, which is included in the application information received from the communication terminal 10.

[0046] Next, in S114, the web server 20 encrypts the key information generated in S113 using a predetermined encryption algorithm. Next, in S115, the web server 20 transmits the encrypted key information and the instruction screen information to the communication terminal 10 via the server communication unit 21. The instruction screen information here is web page information showing the instruction screen. The instruction screen is a screen that instructs the user to hold the communication terminal 10 over the electric lock 40 to be unlocked (i.e., to bring the communication terminal 10 close enough to the authentication device 30 for short-distance wireless communication).

[0047] Next, in S116, the communication terminal 10 acquires the control data stored in the server storage unit 23 of the web server 20. In particular, the communication terminal 10 acquires the control data by connecting to the web server 20 using the URL information transmitted in S106. Note that the timing of acquiring the control data is not limited to this, and the control data may be acquired at or before the timing of receiving the encrypted key information and the instruction screen information.

[0048] Next, in S117, the communication terminal 10 outputs the instruction screen shown in FIG.

[0049] In this embodiment, when personal authentication is successful, the instruction screen of Fig. 7 is displayed regardless of whether the current time or a time immediately after the current time is entered, or whether a certain time after the current time (for example, one hour) is entered on the application screen shown in Fig. 6. The instruction screen of Fig. 7 continues to be displayed on the display unit 11 until a certain time has passed since the issue date and time of the key information designated by the user, or until the user closes the web browser BR.

[0050] Next, in S118, the web browser BR of the communication terminal 10 controls the short-range communication unit 131 by WebNFC technology, and in S119, transmits the encrypted key information to the authentication device 30 via the short-range communication unit 131. Specifically, the web browser BR executes a program included in the control data received from the web server 20 in S116, and controls the short-range communication unit 131. Then, the web browser BR causes the short-range communication unit 131 to transmit the encrypted key information to the authentication device 30 by NFC communication.

[0051] Here, when the terminal ID of the communication terminal 10 is stored in the terminal storage unit 15 of the communication terminal 10, the web browser BR transmits the terminal ID together with the key information to the authentication device 30 by NFC communication. On the other hand, when the terminal ID of the communication terminal 10 is not stored in the terminal storage unit 15, the web browser BR transmits only the key information to the authentication device 30 by NFC communication. Note that in the example shown in Fig. 5, it is assumed that the terminal ID of the communication terminal 10 is stored in the terminal storage unit 15 and that the terminal ID is transmitted together with the key information.

[0052] Next, in S120, the authentication device 30 decrypts the encrypted key information received from the communication terminal 10. Specifically, the authentication device 30 uses a decryption algorithm DA stored in the authentication storage unit 33 to calculate backwards from the received key information the lock ID of the electric lock that was the basis for generating the key information.

[0053] Next, in S121, the authentication device 30 collates the key information. Specifically, the authentication device 30 determines whether or not the lock ID obtained by reverse calculation in S120 matches the lock ID previously stored in the authentication storage unit 33. Then, the authentication device 30 determines that the authentication is established if the lock IDs match, and determines that the authentication is not established if they do not match.

[0054] Here, the lock ID obtained by the reverse calculation in S120 is the lock ID of the electric lock 40 registered when the user started using the key information issuing service. Therefore, when the user tries to unlock the electric lock 40 registered when starting to use the service, the lock ID obtained by the reverse calculation in S120 (i.e., the lock ID of the registered electric lock 40) matches the lock ID of the electric lock 40 stored in the authentication storage unit 33 of the authentication device 30, and authentication is established.

[0055] 5, it is assumed that the lock IDs match and authentication is successful. If authentication is not successful in S121, the processes from S122 onwards are not executed. Next, in S122, the authentication device 30 stores in the authentication storage unit 33 the terminal ID received in S119.

[0056] Then, in S123, the authentication device 30 transmits an unlock control signal to the electric lock 40. The unlock control signal is a control signal for unlocking the electric lock 40. When S123 is executed, the electric lock 40 is unlocked. The above is the case of initial authentication. <Second and subsequent authentication attempts> Next, a case where the electric lock 40 that has been unlocked once according to the procedure in Fig. 5 is unlocked again (i.e., the second or subsequent authentication) will be described with reference to Fig. 8. In particular, in the example shown in Fig. 8, it is assumed that the terminal ID of the communication terminal 10 is transmitted from the communication terminal 10 to the authentication device 30 in S119 during the first authentication, and the terminal ID of the communication terminal 10 is stored on the authentication device 30 side.

[0057] First, the user of the communication terminal 10 brings the communication terminal 10 close enough to the electric lock 40 (i.e., the authentication device 30) to be unlocked to a distance where short-range wireless communication is possible. Then, the communication terminal 10 receives an advertising signal transmitted from the authentication device 30. Then, in response to the advertising signal, the communication terminal 10 transmits the terminal ID stored in the terminal storage unit 15 to the authentication device 30 via the short-range communication unit 131 by NFC communication in S201.

[0058] Next, in S202, the authentication device 30 performs a comparison. Specifically, the authentication device 30 determines whether or not the terminal ID stored in S122 of FIG. 5 described above matches the terminal ID received in S201. The authentication device 30 then determines that authentication is established if the terminal IDs match, and determines that authentication is not established if the terminal IDs do not match. In the example shown in FIG. 8, it is assumed that the terminal IDs match and authentication is established. If authentication is not established in S202, the process of S203 is not executed.

[0059] When the authentication is successful in S202, the authentication device 30 transmits an unlock control signal to the electric lock 40 in the following S203. As a result, the electric lock 40 is unlocked. The above is the process of each device 10, 30, 40 when the terminal ID of the communication terminal 10 is transmitted from the communication terminal 10 to the authentication device 30 at the time of the initial authentication and the terminal ID of the communication terminal 10 is stored on the authentication device 30 side. Note that, when the terminal ID of the communication terminal 10 is not stored in the terminal storage unit 15 of the communication terminal 10 at the time of the initial authentication and the terminal ID is not transmitted from the communication terminal 10 to the authentication device 30, the user of the communication terminal 10 reconnects to the application screen using the URL information acquired in S106 of Fig. 5. Then, the processes of S108 to S123 described above are executed again.

[0060] [3. Effects] According to the embodiment described above in detail, the following effects are achieved. (1) In this embodiment, the communication terminal 10 connects to the web server 20 using specific URL information from the web browser BR implemented in the communication terminal 10 (S107). Then, the communication terminal 10 receives key information and control data from the web server 20 (S115, S116). Then, the communication terminal 10 transmits the key information to the authentication device 30 by the web browser BR controlling the short-range communication unit 131 based on the received control data (S118, S119). Then, the authentication device 30 receives the key information from the communication terminal 10 via the authentication communication unit 31 (S119). Then, the authentication device 30 unlocks the electric lock 40 based on the received key information (S123).

[0061] Therefore, the web browser BR controls the short-range communication unit 131 to transmit the key information to the authentication device 30 and unlock the electric lock 40. In other words, the electric lock 40 is unlocked by utilizing the webNFC technology. Therefore, the electric lock 40 can be unlocked without downloading a dedicated app for unlocking the electric lock 40 to the communication terminal 10. This reduces the user's effort.

[0062] In particular, when unlocking an electric lock 40 using a dedicated app, it may be necessary to download an app corresponding to each electric lock 40 to be unlocked. In that case, if the user wants to unlock another electric lock 40, the user must download another app. In contrast, according to the authentication system 1 of this embodiment, even if the user wants to unlock another electric lock 40, the user can simply connect to the web server 20 using a specific URL corresponding to the electric lock 40 to be unlocked, obtain key information, and unlock the electric lock 40. This reduces the user's effort.

[0063] In addition, there may be cases where the electric lock 40 is to be unlocked on a spot basis (i.e., one-off) or suddenly, such as when unlocking an electric lock 40 installed on the door of a rental office. Even in such cases, the authentication system 1 of the present embodiment allows the electric lock 40 to be unlocked without downloading a dedicated app. This improves user convenience.

[0064] (2) In this embodiment, the communication terminal 10 transmits the key information and the terminal ID to the authentication device 30 by controlling the short-range communication unit 131 by the web browser BR based on the control data received from the web server 20 (S118, S119). Then, the authentication device 30 stores the terminal ID received from the communication terminal 10 in the authentication storage unit 33 (S122). Then, after storing the terminal ID in the authentication storage unit 33, when the authentication device 30 receives the terminal ID from the communication terminal 10, it determines whether the terminal ID stored in the authentication device 30 matches the received terminal ID (S202). Then, when it is determined that the terminal ID stored in the authentication storage unit 33 matches the received terminal ID, the authentication device 30 unlocks the electric lock 40 (S203).

[0065] Therefore, after the terminal ID of the communication terminal 10 is stored in the authentication device 30 (for example, when unlocking the electric lock 40 for the second time or later), the user of the communication terminal 10 can unlock the electric lock 40 without connecting to the web server 20. This reduces the user's trouble compared to a configuration in which the user must connect to the web server 20 every time the electric lock 40 is unlocked.

[0066] (3) In this embodiment, the short-range communication unit 131 of the communication terminal 10 and the authentication communication unit 31 of the authentication device 30 perform NFC communication. Then, key information and the like are transmitted and received via NFC communication. Therefore, the reliability of transmitting and receiving key information and the like can be improved. That is, assume a case where the communication terminal 10 and the authentication device 30 transmit and receive key information and the like using a short-distance communication standard (e.g., BLE communication conforming to the BLE communication standard) that allows communication over a longer distance than NFC communication. In this case, if there is an obstacle between the communication terminal 10 and the authentication device 30, the transmission and reception of key information and the like may be hindered. In contrast, when transmitting and receiving key information and the like using NFC communication as in this embodiment, it is less likely that an obstacle will get between the communication terminal 10 and the authentication device 30 compared to BLE communication and the like, and the reliability of transmitting and receiving key information and the like can be improved.

[0067] In this embodiment, NFC communication corresponds to short-distance wireless communication, the short-distance communication unit 131 of the communication terminal 10 corresponds to a terminal short-distance communication unit, the authentication communication unit 31 of the authentication device 30 corresponds to an authentication short-distance communication unit, and the authentication storage unit 33 corresponds to a storage unit. In addition, the URL information received from the web server 20 in S106 corresponds to specific URL information, and S107 corresponds to processing as a connection processing unit. In addition, S115 and S116 correspond to processing as a reception processing unit, S115 and S116 correspond to processing as a transmission processing unit, S118 and S119 correspond to processing as a control transmission processing unit, and S119 corresponds to processing as a key information receiving unit. In addition, S122 corresponds to processing as a storage processing unit, S123 and S203 correspond to processing as an unlocking processing unit, and S202 corresponds to processing as a determination unit.

[0068] [4. Other embodiments] Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0069] (1) In the above embodiment, FeliCa communication is exemplified as the NFC communication performed between the communication terminal 10 and the authentication device 30, but the NFC communication is not limited to this. For example, the communication terminal 10 and the authentication device 30 may perform NFC communication in accordance with a communication standard such as MIFARE (registered trademark).

[0070] (2) In the above embodiment, NFC communication is exemplified as the short-distance wireless communication performed between the communication terminal 10 and the authentication device 30, but the short-distance wireless communication is not limited to this. For example, the communication terminal 10 and the authentication device 30 may perform short-distance wireless communication in accordance with a communication standard such as Bluetooth (registered trademark) or Bluetooth Low Energy (BLE).

[0071] (3) In the above embodiment, the FeliCa IDm is exemplified as the terminal ID, but the terminal ID is not limited to this. The terminal ID may be a MAC address, a telephone number of the user of the communication terminal 10, an email address, or the like. In other words, the terminal ID may be any information that can identify the communication terminal 10.

[0072] (4) In the above embodiment, the URL information for connecting to the application screen is exemplified as the specific URL information, but the specific URL information is not limited to this. The specific URL information may be any URL information for connecting to the web server 20, and may be, for example, URL information for connecting to a screen (web page) other than the application screen. In this case, the specific URL information may be URL information that enables the communication terminal 10 to acquire control data by connecting to the web server 20 using the URL information.

[0073] (5) In the above embodiment, the web browser BR of the communication terminal 10 transmits the key information and the terminal ID simultaneously in S119, but the timing of transmitting the key information and the terminal ID is not limited to this. For example, the communication terminal 10 may transmit the key information and the terminal ID at different times rather than simultaneously.

[0074] (6) In the above embodiment, the web server 20 may be configured with a plurality of servers. In this case, for example, the web server 20 may be configured with a plurality of servers, such as a server that provides a website for the key information issuing service, a server that generates and issues key information, and the like.

[0075] (7) In S119 of the above embodiment, the communication terminal 10 does not have to transmit the terminal ID of the communication terminal 10 to the authentication device 30 even if the terminal ID of the communication terminal 10 is stored in the terminal storage unit 15. In this case, for example, when unlocking the electric lock 40 for the second time or later, the electric lock 40 may be unlocked by connecting to the web server 20 using a specific URL and executing the processes of S107 to S123 each time.

[0076] (8) In the above embodiment, for example, by adopting the following configuration, connection to the web server 20 may be omitted when unlocking the electric lock 40 for the second or subsequent times. That is, the communication terminal 10 stores the key information acquired from the web server 20 in its own terminal storage unit 15 (e.g., an NFC chip). Then, when unlocking the electric lock 40 for the second time or later, the communication terminal 10 transmits the key information stored in the communication terminal 10 to the authentication device 30. Then, it is considered that the authentication device 30 side collates the key information, thereby omitting the connection to the web server 20.

[0077] However, it is assumed that the communication terminal 10 does not have a function of writing key information to the terminal storage unit 15 such as an NFC chip that the communication terminal 10 has. In that case, when the authentication device 30 receives key information from the communication terminal 10 through NFC communication, and therefore through short-range wireless communication, the authentication device 30 may use its own writer function to write the received key information to the terminal storage unit 15 of the communication terminal 10. Then, in the second and subsequent unlocking operations, the communication terminal 10 transmits the key information written in the terminal storage unit 15 by the authentication device 30 to the authentication device 30, and the authentication device 30 collates the key information. The writer function is a function for writing data between the communication terminal 10 and an NFC-compatible device. With this configuration, the connection to the web server 20 may be omitted in the second and subsequent unlocking operations.

[0078] (9) The control units 14, 22, and 32 and the methods described herein may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control units 14, 22, and 32 and the methods described herein may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control units 14, 22, and 32 and the methods described herein may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible storage medium as instructions executed by a computer. The methods for realizing the functions of each unit included in the control units 14, 22, and 32 do not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0079] (10) Multiple functions possessed by one component in the above embodiments may be realized by multiple components, or one function possessed by one component may be realized by multiple components. Also, multiple functions possessed by multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0080] (11) In addition to the control units 14, 22, and 32 described above, the present disclosure can also be realized in various forms, such as a program for causing a computer to function as the control units 14, 22, and 32, a non-transient physical storage medium such as a semiconductor memory that stores this program, and a method in which a web browser BR controls the near-field communication unit 131 to unlock the electric lock 40. [Explanation of symbols]

[0081] 1... authentication system, 10... communication terminal, 13... terminal communication unit, 14... terminal control unit, 15: terminal storage unit, 20: web server, 21: server communication unit, 22: server control unit, 23: server storage unit, 30: authentication device, 31: authentication communication unit, 32: authentication control unit, 33: authentication memory unit, 34: unlocking control unit, 40: electric lock, 131...NFC communication unit, short-range communication unit, 132...Internet communication unit, BR...Web browser.

Claims

1. An authentication system including a communication terminal, an authentication device installed in an electric lock, and a web server, The communication terminal includes: a terminal short-range communication unit for performing short-range wireless communication; a connection processing unit that connects to the web server using specific URL information from a web browser implemented in the communication terminal; A reception processing unit that receives key information, which is information for unlocking the electric lock, and control data, which is data for controlling the web browser, from the web server; a control transmission processing unit that transmits the key information to the authentication device by controlling the terminal near field communication unit using a WebNFC technology by the web browser based on the received control data; Equipped with The web server includes: a transmission processing unit that transmits the key information and the control data to the communication terminal when the communication terminal connects to the web server; Equipped with The authentication device includes: an authentication short-range communication unit for performing short-range wireless communication; a key information receiving unit that receives the key information from the communication terminal via the authentication short-range communication unit; an unlocking processing unit that unlocks the electric lock based on the received key information; An authentication system comprising:

2. 2. The authentication system according to claim 1, the control transmission processing unit controls the terminal short-range communication unit using WebNFC technology by the web browser based on the received control data, thereby transmitting the key information and a terminal ID, which is information for identifying the communication terminal, to the authentication device; The authentication device includes: a storage processing unit that stores the terminal ID received from the communication terminal in a storage unit; a determination unit that, when receiving the terminal ID from the communication terminal after storing the terminal ID by the storage processing unit, determines whether or not the terminal ID stored in the storage unit matches the received terminal ID; Further comprising: An authentication system in which the unlocking processing unit unlocks the electric lock when the determination unit determines that the terminal ID stored in the memory unit matches the received terminal ID.

3. The authentication system according to claim 1 or 2, The authentication system, wherein the terminal short-range communication unit and the authentication short-range communication unit perform short-range wireless communication based on the NFC standard.

Images