Location verification system, location verification method, and program

Abstract

Provided are a coverage verification system, a coverage verification method, and a non-transitory computer-readable medium capable of appropriately certifying the location of a user. This coverage verification system includes: a user terminal (1) comprising a biometric authentication unit (101), a coverage verification request information generation unit (102), and a data storage unit (103); and a base station (3) comprising a start time information generation unit (301), a verification unit (302), and a coverage verification generation unit (303). The base station (3) transmits a coverage verification start time to the user terminal (1). The user terminal (1) transmits, to the base station (3), an authentication time at which biometric authentication was performed. The base station (3) transmits coverage verification to the user terminal (1) if the start time, the authentication time, and a verification time by the verification unit (302) are aligned in chronological order, and if the difference between the start time and the verification time is within a prescribed range. The user terminal (1) stores received data in the data storage unit (103).

Description

[Technical field]

[0001] The present invention relates to a presence certification system, a presence certification method, and a program. [Background technology]

[0002] There is a known technology that uses GPS (Global Positioning System) services to pinpoint the location of a device in detail. However, it is difficult to objectively prove that a person is or was in a certain place at a certain time using only that service. When making such a proof, it is usually necessary to prove it based on indirect information, such as a third party's eyewitness account or the person's appearance being captured on a security camera image, as is done in crime investigations. To address such problems, Patent Document 1 discloses a technology that certifies the user's location by performing positioning following fingerprint authentication of the user and having a server issue an electronic signature for the location information and time of the positioning result. Moreover, Patent Document 2 discloses a location certification system that certifies the location of a user in cooperation with an external storage device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2003-284113 A [Patent Document 2] Patent No. 4776170 Summary of the Invention [Problem to be solved by the invention]

[0004] The technology disclosed in Patent Document 1 has a problem that if a time lag occurs between the implementation of biometric authentication and positioning, and if the user moves during this time, accurate location certification cannot be performed. The present invention has been made to solve such problems, and aims to provide a presence certification system, a presence certification method, and a program that can appropriately perform user location certification. [Means for solving the problem]

[0005] The presence certification system of the present invention comprises a user terminal comprising a biometric authentication unit which performs biometric authentication of a user, a presence certification request information generation unit which generates presence certification request information for requesting a presence certification which proves that the user terminal is within the communication range of a specific base station, and a data storage unit which stores data related to the presence certification, and a base station which comprises a start time information generation unit which generates start time information including a start time of the presence certification process, a verification unit which verifies the validity of the presence certification process, and a presence certification generation unit which generates a presence certification based on the presence certification process. The base station transmits start time information generated by the start time information generation unit, including the start time of the presence proof process, to the user terminal, and the user terminal transmits presence proof request information generated by the presence proof request information generation unit, including the authentication time at which the user performed biometric authentication in the biometric authentication unit, to the base station, and if the start time, the authentication time, and the verification time in the verification unit are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, the base station determines in the verification unit that the presence proof process is valid, generates the presence proof in the presence proof generation unit, and transmits the generated presence proof to the user terminal, and the user terminal stores the data regarding the presence proof received from the base station in the data storage unit.

[0006] The presence proof method of the present invention involves generating start time information including a start time of a presence proof process at a base station, transmitting the generated start time information to a user terminal, generating presence proof request information including an authentication time at which a user performed biometric authentication at the user terminal, transmitting the generated presence proof request information to the base station, and if the start time, the authentication time, and the verification time for verifying the validity of the presence proof process are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, determining that the presence proof process is valid and generating the presence proof, transmitting the generated presence proof to the user terminal, and storing data regarding the presence proof received from the base station in the user terminal.

[0007] The program of the present invention is intended to cause a computer to execute the following processes: at a base station, generating start time information including the start time of the presence proof process and transmitting the generated start time information to a user terminal; at the user terminal, generating presence proof request information including the authentication time at which the user performed biometric authentication and transmitting the generated presence proof request information to the base station; at the base station, if the start time, the authentication time, and the verification time for verifying the validity of the presence proof process are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, determining that the presence proof process is valid and generating the presence proof and transmitting the generated presence proof to the user terminal; and at the user terminal, storing data regarding the presence proof received from the base station. Effect of the Invention

[0008] According to the present invention, it is possible to provide a presence certification system, a presence certification method, and a program capable of appropriately performing a user's location certification. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a configuration of a presence certification system according to a first embodiment. [Diagram 2] FIG. 11 is a schematic diagram showing the configuration of a presence certification system according to a second embodiment. [Diagram 3] FIG. 11 is a sequence diagram showing a presence verification process. [Figure 4] FIG. 11 is a sequence diagram showing a process of verifying a presence certificate. [Diagram 5] 1 is a table showing the contents of data transmitted and received between a user terminal and a base station. [Figure 6] 1 is a diagram showing an example of a transmission direction of a transmission wave beam transmitted by a base station. [Figure 7] 1 is a diagram showing an example of a transmission direction of a transmission wave beam transmitted by a base station. [Figure 8] 1 is a diagram showing an example of a transmission direction of a transmission wave beam transmitted by a base station. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] <Embodiment 1> Hereinafter, an embodiment of the present invention will be described with reference to the drawings. 1 is a block diagram showing the configuration of a presence certification system 50 according to this embodiment. The presence certification system 50 includes a user terminal 1 and a base station 3.

[0011] The user terminal 1 includes a biometric authentication unit 101 , a presence proof request information generating unit 102 , and a data storage unit 103 . The biometric authentication unit 101 performs biometric authentication of a user. For example, the biometric authentication unit 101 performs biometric authentication of a user using a biometrics technology that is an authentication technology that uses a fingerprint, iris, vein, voiceprint, face shape, or the like of the user. The presence certification request information generating unit 102 generates presence certification request information for requesting presence certification that proves that the user terminal 1 is within the communication range of a predetermined base station 3 . The data storage unit 103 stores data relating to the presence certificate.

[0012] The base station 3 comprises a start time information generating unit 301 , a verifying unit 302 , and a presence certificate generating unit 303 . The start time information generating section 301 generates start time information including the start time Ta of the presence certification process. The verification unit 302 verifies the validity of the presence proof process. The presence certificate generating unit 303 generates a presence certificate based on the presence certificate processing.

[0013] The base station 3 transmits to the user terminal 1 the start time information generated in the start time information generating section 301 and including the start time Ta of the presence certification process. The user terminal 1 transmits to the base station 3 the presence proof request information generated by the presence proof request information generating unit 102 and including the authentication time Tb at which the user performed biometric authentication in the biometric authentication unit 101 . If the start time Ta, authentication time Tb, and verification time Tc in the verification unit 302 are arranged in chronological order and the difference between the start time and the verification time is within a specified range, the base station 3 determines that the presence proof process in the verification unit 302 is valid. The base station 3 generates a presence certificate in the presence certificate generating section 303 , and transmits the generated presence certificate to the user terminal 1 . The user terminal 1 stores the data relating to the presence certificate received from the base station 3 in the data storage unit 103 .

[0014] In this manner, in the presence certification system 50 according to the present embodiment, the base station 3 generates start time information including the start time Ta of the presence certification process. In addition, the user terminal 1 generates presence certification request information including the authentication time Tb at which the user performed biometric authentication in the biometric authentication unit 101. The base station 3 determines that the presence certification process is valid if the start time Ta, the authentication time Tb, and the verification time Tc in the verification unit 302 are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range. That is, the presence certification system 50 according to the present embodiment determines whether the presence certification process is valid using the time series information of the start time Ta, the authentication time Tb, and the verification time Tc, so that it is possible to properly prove that the user was within the communication range of the base station 3 at a predetermined timing. Therefore, the present embodiment of the present invention can provide a presence certification system, a presence certification method, and a program capable of properly performing user location certification.

[0015] <Embodiment 2> Next, a second embodiment of the present invention will be described. In the second embodiment, the presence certification system 50 described in the first embodiment will be described in further detail.

[0016] The presence certification system 51 according to the present embodiment will be described below with reference to Fig. 2. Fig. 2 is a schematic diagram showing the configuration of the presence certification system 51 according to the present embodiment. The presence certification system 51 includes a user terminal 1, a FIDO (Fast IDentity Online) server (authentication server) 2, a base station 3, and a verification terminal 4.

[0017] The user terminal 1 comprises a private key 6, a clock 10, and a database 8. For convenience of explanation, these elements are shown outside the user terminal 1 in Fig. 2, but all of these elements are assumed to be built into the user terminal 1. The user terminal 1 corresponds to the user terminal 1 described in Fig. 1 and in the first embodiment, and comprises a biometric authentication unit 101, a presence proof request information generation unit 102, and a data storage unit 103.

[0018] The user terminal 1 is a terminal used by a user who uses the presence certificate. The user terminal 1 is, for example, a mobile phone, a smartphone, a tablet, etc. The user terminal 1 is not limited to a portable terminal, and may be, for example, a stationary terminal such as a desktop personal computer.

[0019] A user terminal 1 uses a FIDO service provided by a FIDO server 2. The user terminal 1 registers a public key 5 linked to biometric information in the FIDO server 2, and holds a private key 6 that pairs with the public key 5. When biometric authentication of a user is successful, the user terminal 1 performs challenge-response authentication with a base station 3 using the private key 6 based on public key cryptography.

[0020] The private key 6 is information that the user terminal 1 uses when signing the location time information if biometric authentication is successful in the user terminal 1. The private key 6 is stored in the user terminal 1.

[0021] The clock 10 is a clock provided in the user terminal 1. The clock 10 provides an authentication time Tb as the time when the user terminal 1 performs biometric authentication.

[0022] The database 8 stores the presence proof data in the user terminal 1 .

[0023] The FIDO server 2 is a server device that provides a FIDO service. The FIDO server 2 registers and holds a public key 5 linked to a user's biometric information. The public key 5 is information that pairs with a private key 6 linked to an encrypted biometric authentication function.

[0024] The base station 3 comprises a public key 7 and a clock 11. For convenience of explanation, these elements are shown outside the base station 3 in Fig. 2, but they are all assumed to be built into the base station 3. The base station 3 corresponds to the base station 3 described in Fig. 1 and in the first embodiment, and comprises a start time information generating unit 301, a verifying unit 302, and a presence certificate generating unit 303.

[0025] The base station 3 transmits a transmission wave beam 9 to wirelessly communicate with the user terminal 1. The base station 3 certifies the time using a clock 11, certifies the location of the user terminal 1 based on the transmission direction of the transmission wave beam 9, signs each piece of information, etc. The base station 3 also generates presence proof data and transmits the generated presence proof data to the user terminal 1.

[0026] The public key 7 is information used when signing information provided to the user terminal 1 .

[0027] The clock 11 provides a start time Ta as the time when the presence proof starts, and a verification time Tc as the end time of the presence proof.

[0028] The verification terminal 4 is a terminal used by a person who verifies the presence certificate of the user terminal 1. The verification terminal 4 is, for example, a personal computer, a mobile phone, a smartphone, a tablet, or the like. When verifying the proof of presence, the verification terminal 4 receives proof of presence data from the user terminal 1. In addition, the verification terminal 4 obtains the public key 5 of the FIDO server 2 or the public key 7 of the base station 3, and verifies the received proof of presence data.

[0029] Next, the process performed by the presence certification system 51 will be described with reference to the sequence diagram shown in Fig. 3. Fig. 3 is a sequence diagram showing the presence certification process.

[0030] First, the user makes preparations in advance to use the biometric authentication service provided by the FIDO server 2 (steps S1 to S5). The user terminal 1 registers a public key 5 linked to biometric information in the FIDO server 2. As a result, the user terminal 1 holds the private key 6, and the FIDO server 2 holds the public key 5.

[0031] The above process will be specifically described. The user terminal 1 makes a registration request for the public key 5 linked to the biometric information of the user terminal 1 to the FIDO server 2 (step S1). The FIDO server 2 transmits challenge data to the user terminal 1 (step S2). The user terminal 1 transmits a registration response to the FIDO server 2 (step S3). The FIDO server 2 stores the public key 5 of the user terminal 1 (step S4) and transmits a registration result to the user terminal 1 (step S5). If the registration is successful, the user terminal 1 holds the private key 6, and the advance preparation is completed. This enables the user terminal 1 to use biometric authentication of the FIDO server 2. If the registration is not successful, the advance preparation fails and the process ends.

[0032] Next, the presence certification process (steps S6 to S12) will be described with reference to Fig. 3 and Fig. 5. Fig. 3 is a sequence diagram showing the presence certification process as described above, and Fig. 5 is a table showing the contents of data transmitted and received between the user terminal 1 and the base station 3 in the presence certification process. Column (b) of Fig. 5 shows the numbers of each step shown in the sequence diagram of Fig. 3. Column (a) of Fig. 5 shows data numbers for identifying data transmitted and received in the process in column (b). Columns (c) to (i) of Fig. 5 show examples of data transmitted and received in each step. Below, the process will be described by associating the sequence diagram shown in Fig. 3 with an example of data shown in Fig. 5.

[0033] First, the user uses the user terminal 1 to request the base station 3 to start presence certification (step S6).

[0034] The base station 3 (start time information generating unit 301 shown in FIG. 1) generates start time information (d) and transmits it to the user terminal 1 (step S7, data 1). The start time information (d) is obtained by adding a digital signature to the fixed identifier indicating the start of the presence certificate and the start time Ta. The fixed identifier is, for example, a combination of numbers and symbols that uniquely identifies data. The fixed identifier for the start of the presence certification is included so as not to prevent the base station 3 from signing the time information in a process other than that of the present invention. The start time Ta is the time when the presence certification starts. The start time Ta is provided by the clock 11 of the base station 3. The start time Ta is information corresponding to the "year / month / day hour:minute:second" when the presence certification starts, as represented by "yyyy / mm / dd hh:mm:ss" in column (d) of Fig. 5, for example. The authentication time Tb and verification time Tc described later are also obtained in units of seconds in the same way.

[0035] Next, the user performs biometric authentication on the user terminal 1 (biometric authentication unit 101 shown in FIG. 1) (step S8).

[0036] If the biometric authentication is successful, the user terminal 1 makes a presence-in-range proof request to the base station 3 (step S9). Specifically, the user terminal 1 (the presence-in-range proof request information generating unit 102 shown in FIG. 1) generates presence-in-range proof request information (data 3) for requesting presence-in-range proof, and transmits the generated information to the base station 3. The presence-in-range proof request information is data including the following: Response data (c) calculated using the start time information (d) with the signature of the base station 3 received in step S7 as a random number of the challenge data Start time information (d) with the signature of the base station 3 received in step S7 Location time information (e) including the authentication time Tb with the signature of user terminal 1 In the above, the authentication time Tb included in the location time information (e) is the time when the user terminal 1 performed biometric authentication. The authentication time Tb is provided by the clock 10 of the user terminal 1. In addition, the signature is generated using the private key 6 stored in the user terminal 1. In addition, when generating the response data (c), if the start time information (d) with the signature of the base station 3 received in step S7 is too long to be used as challenge data, a hash value may be calculated using a hash function and the hash value may be used as the challenge data.

[0037] The base station 3 (the verification unit 302 shown in FIG. 1) verifies the validity of the request received from the user terminal 1 (step S10). Specifically, the base station 3 verifies that the start time information (d) sent from the user terminal 1 is data signed by the base station 3 itself and contains a fixed identifier indicating the start of the presence certificate. The base station 3 also compares the following three pieces of time information and verifies that the times contained therein are in the following order and that the difference between them is within a certain range: Start time information (d) transmitted from user terminal 1 Start time Ta · Location time information (e) sent from user terminal 1 · Authentication time Tb ·Time information held by base station 3 itself ·Verification time Tc Here, the verification time Tc is the time when the base station 3 performs the above-mentioned verification of the validity. The verification time Tc is provided by the clock 11 of the base station 3. As described above, the start time information (d) and the presence time information (e) transmitted from the user terminal 1 include the start time Ta and the authentication time Tb, respectively. Therefore, the base station 3 confirms that the start time Ta, the authentication time Tb, and the verification time Tc are acquired in this order, and that the difference between them is within a certain range. For example, the base station 3 sets a threshold value in advance for the difference between the start time Ta and the verification time Tc, and confirms that the start time Ta, the authentication time Tb, and the verification time Tc are acquired in this order, and that the difference between the start time Ta and the verification time Tc does not exceed the threshold value. By setting the threshold value to a sufficiently small value, presence proof can be performed appropriately even if the user terminal 1 moves.

[0038] If any of the above conditions are not met, the base station 3 determines that the presence certification request from the user terminal 1 is invalid. In this case, the base station 3 transmits an error message to the user terminal 1, and the presence certification process ends.

[0039] If the base station 3 determines that the presence proof request from the user terminal 1 is valid, the base station 3 (the presence proof generating unit 303 shown in FIG. 1) generates presence proof data (data 4). Specifically, the base station 3 generates the following five pieces of data and data that compiles and digitally signs these pieces of data: -Fixed identifier indicating the end of the presence certificate Response data (c) sent in step S9 -Digital signed time information sent from user terminal 1 (e) As the end time information, the verification time Tc(f) of step S10 Location information of the base station 3 and the transmission direction of the transmission wave beam 9 (g) The base station 3 transmits the generated presence certification data to the user terminal 1 (step S11). The user terminal 1 receives the presence certification data from the base station 3.

[0040] The user terminal 1 (data storage unit 103 shown in FIG. 1) collectively stores the following data (data 5) in the database 8 (step S12). The signed start time information received in step S7 (d) The following data received in step S11 and its digital signature: Response data (c) -Digital signed time information sent from user terminal 1 (e) As the end time information, the verification time Tc(f) of step S10 Location information of the base station 3 and the transmission direction of the transmission wave beam 9 (g) Access information for FIDO server 2 (URL, etc.) (h) Access information (URL, etc.) to the public key 7 of the base station 3 (i) On the other hand, if the user terminal 1 does not receive the above-mentioned presence proof data, the presence proof fails and the process ends.

[0041] Next, the process of verifying the presence certificate (steps S13 to S18) will be described with reference to Fig. 4. Fig. 4 is a sequence diagram showing the process of verifying the presence certificate.

[0042] The user terminal 1 transmits the presence proof data (data 5) stored in step S12 to the verification terminal 4, and requests verification of the presence proof (step S13).

[0043] The verification terminal 4 requests the public key 7 from the base station 3 as necessary (step S14) and acquires the public key 7 (step S15). In Fig. 4, a method in which the verification terminal 4 acquires the public key 7 by accessing the base station 3 is shown as an example, but the public key may be acquired by accessing a database installed separately from the base station 3.

[0044] Furthermore, the verification terminal 4 requests the public key 5 from the FIDO server 2 as necessary (step S16) and acquires the public key 5 (step S17). If the verification terminal 4 cannot acquire the public key 5 or 7, the verification of the presence proof fails and the process ends.

[0045] The verification terminal 4 uses the public keys 5 and 7 to verify that the presence proof data (data 5 ) sent from the user terminal 1 is one that has been signed by the user terminal 1 or the base station 3 . The verification terminal 4 also confirms that the response data (c) is a value generated based on the start time information (d) and that the value of the response data (c) was calculated after the start time Ta and before the verification time Tc because it was signed by the base station 3 together with the end time information (f). Furthermore, the verification terminal 4 confirms the position of the user terminal 1 at that time from the position information of the base station 3 and the transmission direction (g) of the transmission wave beam 9.

[0046] The verification terminal 4 transmits the verification result to the user terminal 1 (step S18), and the verification process of the presence proof is completed. On the other hand, if the user terminal 1 does not receive the verification result, the verification of the presence proof fails, and the process ends.

[0047] In the present invention, the base station 3 needs to guarantee the following two points. First, in the process of step S7, the base station 3 attaches an electronic signature to data combining a fixed identifier indicating the start of the presence certification and the start time Ta (data 1), but at this time, only the current time is used as the start time Ta. Next, in the process of step S11, the base station 3 transmits presence proof data (data 4) including the verification time Tc to the user terminal 1, but at this time, only the current time is used as the verification time Tc.

[0048] If these conditions are met, the data 1 transmitted in step S7 cannot exist before the start time Ta. Furthermore, since the user terminal 1 generates response data (c) for the data 1 using the private key 6, it can be proven that the time when the user terminal 1 performed the biometric authentication is after the start time Ta. Then, in step S11, the base station 3 includes the above response data (c) and end time information (f) in the data (data 4) transmitted to the user terminal 1. Since the end time information (f) includes the verification time Tc as the end time of the presence proof, it can be proven that the biometric authentication performed by the user terminal 1 was completed before the verification time Tc.

[0049] From the above, by making the time difference between the start time Ta and the verification time Tc sufficiently short, it is possible to prove that a person matching the biometric information is present at the time and location indicated by base station 3 (strictly speaking, any moment in a short period of time).

[0050] Next, a supplementary explanation will be given on the transmission direction of the transmission wave beam 9 with reference to Fig. 6 to Fig. 8. Fig. 6 to Fig. 8 are diagrams showing examples of the transmission direction of the transmission wave beam 9 transmitted by the base station 3.

[0051] Usually, the transmission wave beam 9 is transmitted in a concentric manner with the base station 3 as the center, but as shown in FIG. 6, the transmission wave beam 9 may be transmitted in a sector limited to a certain direction within the concentric circle. Also, as shown in FIG. 7 and FIG. 8, the user terminal 1 may simultaneously perform presence verification for a plurality of base stations 3a, 3b. For example, in the example shown in FIG. 7, the transmission wave beams 9a and 9b of the base stations 3a and 3b are transmitted in a concentric manner with the respective base stations 3a and 3b as the center, and the user terminal 1 is present in the area where these beams overlap. This allows the position of the user terminal 1 to be specified more accurately, and highly accurate presence verification can be performed. Also, in this case, as shown in FIG. 8, the base stations 3a and 3b may transmit the sector-shaped transmission wave beams 9a and 9b.

[0052] As described above, according to the presence certification system of the present embodiment, the FIDO biometric authentication is provided with the signatures issued at the start and end of the presence certification and the time information of these times, so that the time and location of the user's presence can be more accurately certified. This allows the user's presence to be properly certified.

[0053] In addition, Patent Document 2 discloses a location certification system that certifies the user's location in cooperation with an external storage device, but in this location certification system, the information to be certified is stored in the external storage device. Therefore, there is a problem that the amount of data required for the presence certification is limited by the external device. In addition, since the certification data exists in a specific device, a bottleneck exists in data access. In contrast, in the presence certification system according to this embodiment, the presence certification data is stored on the user terminal 1 (data storage unit 103 shown in FIG. 1), so that it is possible to avoid restrictions on the amount of resources of external devices. Therefore, even if there are many user terminals, the presence certification data is distributed and stored on each terminal, so that it is possible to eliminate bottlenecks in data access.

[0054] In addition, according to the presence certification method of this embodiment, a base station generates start time information including the start time Ta of the presence certification process and transmits the generated start time information to a user terminal, the user terminal generates presence certification request information including the authentication time Tb at which the user performed biometric authentication and transmits the generated presence certification request information to the base station, and if the start time Ta, the authentication time Tb, and the verification time Tc for verifying the validity of the presence certification process are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, the base station determines that the presence certification process is valid and generates the presence certification and transmits the generated presence certification to the user terminal, and the user terminal stores the data regarding the presence certification received from the base station, so that user location certification can be performed appropriately.

[0055] The presence proof process according to this embodiment may be implemented by executing a program in each of the user terminal 1, the base station 3, and the verification terminal 4. These programs are stored in memories provided in each of the user terminal 1, the base station 3, and the verification terminal 4. The user terminal 1, the base station 3, and the verification terminal 4 can also read out the programs from their respective memories and execute the respective programs in their respective processors to execute the above-mentioned presence proof process.

[0056] Furthermore, the software of an existing base station may be modified to cause the base station 3 to execute the above-mentioned processes. When modifying the software of an existing base station in this way, each process for proof of presence can be executed in a stateless manner, so that the impact on the existing operation of the base station can be minimized.

[0057] The processor may be, for example, a microprocessor, a micro processing unit (MPU), or a central processing unit (CPU). The processor may include multiple processors.

[0058] The memory may be a combination of volatile and non-volatile memory. The memory may include storage located remotely from the processor. In this case, the processor may access the memory via an I / O interface (not shown).

[0059] Each of the processors executes one or more programs including instructions for making the computer execute the algorithm described with reference to the drawings. The programs can be stored and provided to the computer using various types of non-transitory computer readable media. The non-transitory computer readable media includes various types of tangible storage media. Examples of the non-transitory computer readable media include magnetic storage media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical storage media (e.g., magneto-optical disks), Compact Disc Read Only Memory (CD-ROM), CD-R, CD-R / W, and semiconductor memory (e.g., mask ROM, programmable ROM (PROM), erasable PROM (EPROM), flash ROM, random access memory (RAM)). The programs may also be provided to the computer by various types of transitory computer readable media. Examples of the transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire or an optical fiber, or via a wireless communication path.

[0060] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit and scope of the present invention. For example, in the above example, the base station 3 having the user terminal 1 within the range of the transmission wave beam 9 has been used for explanation, but the present invention is not limited to this and may be applied to a Wi-Fi (registered trademark) router operated by a business operator. By using a Wi-Fi router, it is possible to identify that the user is within a smaller radius.

[0061] In the above example, the base station 3 has been described using the position information of the base station 3 and the transmission direction information of the transmission wave beam 9 used in communication with the user terminal 1 as information regarding the position of the user terminal 1, but this is not limited to the above. For example, it is also possible to add more detailed position information of the user terminal 1, such as estimated position information based on the functions of the base station 3 or triangulation results obtained by cooperation between adjacent base stations, and send back data including these with a digital signature to the user terminal 1.

[0062] Examples of applications of the present invention include the following. In the future, when the location information of an emergency vehicle is distributed via a network, the information can be distributed only to vehicles that have been proven to be in the vicinity of the emergency vehicle. This can prevent a user from faking the location information of his / her own vehicle and illegally tracking the information of the emergency vehicle. By using the present invention, the user can prove that he / she is in a location at any time and frequency.

[0063] By applying the present invention to stamp rally-type services that utilize users' mobile devices, it is possible to prevent fraudulent acts by falsifying location information. For example, in a game app for mobile devices, if there is an item that can only be acquired by users in a specific area, it is possible to fraudulently acquire the item without moving to that area if location information is falsified. This invention does not rely solely on location information from the mobile device, but uses location information from a base station and the transmission direction of a transmission wave beam, so it is possible to prevent such fraud. Furthermore, this invention allows the base station to confirm the time information on the mobile device, so it is also possible to prevent fraudulent acts by falsifying time information.

[0064] In a user-participation local information service, it is possible to prove that a user certainly has information about a location. For example, in a restaurant review posting, it is possible to prove that the user has visited the restaurant in the past, making the review content credible. Similarly, in a service that compiles weather information and train congestion status for a user's current location through posting, it is possible to prevent the current location from being faked and improve the accuracy of the information.

[0065] In entertainment applications intended for end-user use, it can also be used as follows: Proof of participation in an offline event (e.g., being at the Olympic opening ceremony venue) Proof of visiting ruins or famous places (issuance of special benefits, red seals, etc.) - Commemorating the annular eclipse tour (as it can only be seen at certain times and places)

[0066] The present invention can be applied as a method for increasing the reliability of existing electronic signature services. For example, information on where the electronic signature was physically made can be included as part of the electronic signature data. This makes it possible to determine that an electronic signature is fraudulent if a person with no record of leaving the country has a record of making an electronic signature in a foreign country. Also, an electronic signature made in an irrational location can be determined to be fraudulent.

[0067] The present invention can be applied as a means for detecting fraudulent use of credit cards. For example, an optional function is added that requires the submission of proof of presence data as part of the authentication procedure of a credit card. The card user can select the proof of presence option. If the proof of presence option is selected, when using the credit card, in addition to the PIN, the proof of presence data must be presented as one piece of authentication data. The credit card company compares the information of the credit card dealer with the location information indicated by the proof of presence data, and fails authentication if the location is not valid.

[0068] The present invention can be applied as a method for increasing the reliability of legitimate access when a user accesses a computer. By making presence proof mandatory to obtain specific privileges when accessing, security can be improved.

[0069] The above is just one example, and the present invention can be applied to various types of proof, such as proof of an alibi in a crime investigation or proof of a business trip in a company.

[0070] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0071] This application claims priority based on Japanese Patent Application No. 2020-089428, filed on May 22, 2020, the disclosure of which is incorporated herein in its entirety. [Explanation of symbols]

[0072] 1 User terminal 2 FIDO Server 3 base station 4. Verification terminal 5, 7 Public Key 6 private key 8 Database 9 Transmission Wave Beam 10, 11 Clock 50, 51 Location Verification System 101 Biometric authentication department 102 Location proof request information generation unit 103 Data storage unit 301 Start time information generation section 302 Verification Department 303 Proof of presence generation unit

Claims

1. a biometric authentication means for performing biometric authentication of a user; a presence certification request information generating means for generating presence certification request information for requesting presence certification which proves that a user terminal is within the communication range of a predetermined base station; A user terminal including a data storage means for storing data related to the presence certificate; a start time information generating means for generating start time information including a start time of a location verification process; A verification means for verifying the validity of the presence verification process; a presence certification generating unit that generates a presence certification based on the presence certification process; the base station transmits to the user terminal start time information generated by the start time information generating means, the start time information including a start time of the presence certification process; the user terminal transmits to the base station presence proof request information generated by the presence proof request information generating means, the presence proof request information including an authentication time when the user performed biometric authentication using the biometric authentication means; if the start time, the authentication time, and the verification time in the verification means are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, the base station determines in the verification means that the presence certificate process is valid, generates the presence certificate in the presence certificate generation means, and transmits the generated presence certificate to the user terminal; The user terminal stores the data relating to the presence certificate received from the base station in the data storage means. Proof of presence system.

2. The method further includes an authentication server in which a public key associated with the biometric information of the user is registered, the user terminal digitally signs the presence certification request information using a private key corresponding to the public key, and transmits the digitally signed presence certification request information to the base station; The presence verification system according to claim 1.

3. A verification terminal that receives the presence certificate from the user terminal and verifies the location information of the user terminal, the verification terminal acquires the public key from the authentication server, and verifies the location information of the user terminal using the acquired public key and the presence certificate received from the user terminal; The presence certification system according to claim 2.

4. The start time information further includes a fixed identifier indicating the start of the presence verification process, The base station transmits the digitally signed start time information to the user terminal; the user terminal transmits to the base station, as the presence proof request information, the authentication time signed with the private key, the start time information with the electronic signature received from the base station, and the fixed identifier; The presence certification system according to claim 2 or 3.

5. the user terminal includes the digitally signed start time information received from the base station in the presence proof request information and transmits the same to the base station; a verification means of the base station that determines that the presence proof process is valid when the digitally signed start time information is data signed by the base station itself; The presence certification system according to claim 4.

6. The presence certification system according to claim 4 or 5, wherein the user terminal generates response data using the electronically signed start time information received from the base station as challenge data, and transmits the generated response data to the base station.

7. 7. The presence certification system according to claim 1, wherein the presence certification generated by the presence certification generating means includes at least location information of the base station and information related to the authentication time.

8. 8. The presence certification system according to claim 7, wherein the presence certification generated by said presence certification generating means further includes information regarding a beam direction of a transmission wave transmitted from said base station.

9. generating start time information including a start time of a presence verification process in the base station and transmitting the generated start time information to the user terminal; generating presence certification request information including an authentication time when the user performed biometric authentication in the user terminal, and transmitting the generated presence certification request information to the base station; in the base station, if the start time, the authentication time, and a verification time for verifying the validity of the presence certification process are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, the base station determines that the presence certification process is valid, generates the presence certification, and transmits the generated presence certification to the user terminal; storing data relating to the presence certificate received from the base station in the user terminal; How to prove your presence.

10. A process of generating start time information including a start time of a presence verification process in the base station and transmitting the generated start time information to the user terminal; a process of generating presence proof request information including an authentication time when the user performed biometric authentication in the user terminal and transmitting the generated presence proof request information to the base station; a process in which, in the base station, if the start time, the authentication time, and a verification time for verifying the validity of the presence certification process are arranged in chronological order and the difference between the start time and the verification time is within a predetermined range, the base station determines that the presence certification process is valid, generates the presence certification, and transmits the generated presence certification to the user terminal; and storing, in the user terminal, data relating to the presence certificate received from the base station.

Images