Electronic key system and electronic key management method

Abstract

The present invention comprises: a communication unit (901) which intermittently performs communication for confirming whether it is possible to communicate with a plurality of electronic devices to which individual electronic keys have been assigned; a storage unit (902) which stores an electronic key list for each set of lock identification information identifying a lock device, said electronic key list including electronic keys to be managed, a different priority level for each electronic key, and status information indicating whether or not each electronic key is valid; a status information management unit (903) which, on the basis of the results of the communication by the communication unit, records one electronic key among the electronic keys allocated to the electronic devices on the basis of the priority levels; and a lock device management unit (904) which assigns, to a lock device to be managed, keyhole data with which a locking and / or unlocking operation can be performed using the valid electronic key.

Description

Electronic key system and electronic key management method

[0001] The present invention relates to an electronic key system and an electronic key management method.

[0002] There are electronic key solutions (also called smart keys) that use smartphones as room door keys, but sometimes the smartphone can become inoperable if its battery dies or it is dropped. In such cases, a method of adding a spare key to the door itself, such as installing a 10-key input pad on the door in addition to the smart key, is sometimes used. Systems for managing multiple electronic keys exist (see, for example, Patent Documents 1 and 2).

[0003] JP 2019-220805 A JP 2015-078536 A

[0004] However, adding a spare key increases the number of electronic keys, so even if one electronic device malfunctions or the battery runs out, the lock can be unlocked or locked using the electronic key of another electronic device. However, as the number of electronic keys increases, the possibility of them being stolen also increases. Therefore, it is desirable to manage multiple electronic keys with increased security.

[0005] One aspect of the present invention is an electronic key system having a communication unit that has multiple electronic devices assigned individual electronic keys and that repeatedly communicates at intervals to confirm whether communication is possible with the multiple electronic devices; a memory unit that stores an electronic key list stored for each lock identification information that identifies a lock device, the electronic key list including electronic keys to be managed, a priority that differs for each electronic key, and status information indicating whether the electronic key is valid; a status information management unit that writes one electronic key assigned to the electronic device based on the priority as valid based on the results of communication by the communication unit; and a lock device management unit that assigns keyhole data to the managed lock device that can perform at least one of locking or unlocking operations using the validated electronic key.

[0006] Another aspect of the present invention is an electronic key management method in which there are multiple electronic devices to which individual electronic keys are assigned, and communication is repeated at intervals to confirm whether communication is possible with the multiple electronic devices, and an electronic key list is stored in a memory unit for each lock identification information that identifies the lock device, and the electronic key list includes the electronic keys to be managed, a priority that differs for each electronic key, and status information indicating whether the electronic key is valid or not, and based on the results of the communication, one electronic key based on the priority of the electronic keys assigned to the electronic device is valid and written to the memory unit, and keyhole data that can perform at least one of locking or unlocking operations using the validated electronic key is assigned to the lock device to be managed.

[0007] According to the present invention, it is possible to manage a plurality of electronic keys with increased security.

[0008] FIG. 1 is a schematic system configuration diagram showing the configuration of an electronic key system S. FIG. 2 is a schematic functional block diagram explaining the functions of an electronic device 10. FIG. 3 is a schematic functional block diagram explaining the functions of a key management server 30. FIG. 4 is a diagram showing an example of an electronic key list stored in a storage unit 301. FIG. 5 is a flowchart explaining the operation of the key management server 30. FIG. 6 is a sequence diagram showing the processing flow of the electronic key system S. FIG. 7 is a schematic functional block diagram showing the configuration of a key management server 30A. FIG. 8 is a flowchart explaining the operation of the key management server 30A. FIG. 9 is a schematic functional block diagram showing the configuration of an electronic key system SB in a third embodiment.

[0009] Next, an electronic key system S according to one embodiment of the present invention will be described. FIG. 1 is a schematic system configuration diagram showing the configuration of the electronic key system S. The electronic key system S includes an electronic device 10a, an electronic device 10b, a wireless access point 20, a key management server 30, and a lock device 40. Hereinafter, when there is no need to distinguish between the electronic devices 10a and 10b, they may be simply referred to as the electronic device 10. The electronic device 10 may be, for example, a smartphone, a smartwatch, a tablet, or a dongle device. The electronic device 10 is portable. The electronic device 10 is wirelessly connected to the key management server 30 via the wireless access point 20 so as to be able to communicate wirelessly.

[0010] The wireless access point 20 is wirelessly connected to the electronic device 10, the key management server 30, and the lock device 40 so that they can communicate with each other. The wireless access point 20 receives data transmitted from the electronic device 10 and transmits it to the key management server 30, and receives data transmitted from the key management server 30 and transmits it to the electronic device 10. The wireless access point 20 also transmits data transmitted from the electronic device 10 to the lock device 40, and transmits data transmitted from the lock device 40 to the electronic device 10. The wireless access point 20 also transmits data transmitted from the key management server 30 to the lock device 40.

[0011] Although only one wireless access point 20 is shown in this figure, multiple wireless access points 20 may be installed in different locations. Furthermore, at least one of the wireless access points 20 may be installed near the lock device 40 (within a communication range). In this case, the electronic device 10 that communicates with the lock device 40 can communicate with the lock device 40 via the wireless access point 20 to which the lock device 40 is connected after the user brings the electronic device 10 near the lock device 40 with which it communicates. In this case, even if the lock device 40 and the electronic device 10 do not have the function of direct communication such as short-range wireless communication, they can communicate via the wireless access point 20.

[0012] The key management server 30 is wirelessly connected to the electronic device 10 and the locking device 40 via the wireless access point 20 so that they can communicate with each other. The locking device 40 is wirelessly connected to the key management server 30 so that they can communicate with each other. The locking device 40 is attached to an object that can be opened and closed, such as a door, window, or lid, and can be switched between a locked state and an unlocked state.

[0013] FIG. 2 is a schematic functional block diagram illustrating the functions of the electronic device 10. The functions shown in FIG. 2 are provided in each of the electronic devices (electronic device 10a, electronic device 10b). The electronic device 10 includes a memory unit 101, a communication unit 102, a life and death information management unit 103, an output unit 104, an input unit 105, a biometric information input unit 106, a biometric authentication unit 107, and a control unit 108. The memory unit 101 stores various information. For example, the memory unit 101 stores electronic device identification information that individually identifies the electronic device 10 and an electronic key. The communication unit 102 wirelessly communicates with the key management server 30 via the wireless access point 20. The communication unit 102 also wirelessly communicates with the lock device 40 via the wireless access point 20. The life and death information management unit 103 causes the communication unit 102 to transmit life and death information to the key management server 30 at regular intervals.

[0014] The output unit 104 outputs various types of information. The output unit 104 may be, for example, at least one of a liquid crystal display panel, a speaker, a lamp, etc. The input unit 105 accepts operation input from a user. The input unit 105 may be, for example, at least one of a touch panel and operation buttons.

[0015] The biometric information input unit 106 accepts input of biometric information used for biometric authentication. The biometric authentication may be, for example, an authentication method using any one of a fingerprint, an iris, a voice (voiceprint), etc., based on whether or not the biometric information matches pre-registered biometric information of a user. The biometric information input unit 106 uses one of a fingerprint sensor, a camera that photographs the iris, a microphone that picks up voice, etc., depending on the authentication method.

[0016] The biometric authentication unit 107 determines that the person is the person in question if the degree of match between the biometric information input from the biometric information input unit 106 and pre-registered biometric information is equal to or greater than a reference value, and determines that the person is not the person in question if the degree of match is less than the reference value. The authentication method for biometric authentication is arbitrary, and may be any of fingerprint authentication using a fingerprint, iris authentication using an iris, voice authentication using a voice (voiceprint), etc. The control unit 108 controls each unit of the electronic device 10.

[0017] FIG. 3 is a schematic functional block diagram illustrating the functions of the key management server 30. The key management server 30 includes a storage unit 301, a communication unit 302, a status information management unit 303, a lock device management unit 304, a clock unit 305, a key registration unit 306, and a control unit 307. The storage unit 301 stores an electronic key list and keyhole data. FIG. 4 is a diagram illustrating an example of an electronic key list stored in the storage unit 301. The electronic key list is data stored for each lock identification information that identifies a lock device 40. In other words, if there are multiple lock devices 40, an electronic key list such as that shown in FIG. 4 is stored for each lock identification information of each different lock device 40. Here, the electronic key list includes an electronic key, electronic device identification information, a priority that differs for each electronic key identification information, status information indicating whether the electronic key is valid, and lock identification information. In this example, the lock identification information "0001" is associated with the electronic key, electronic device identification information, priority, last communication time, and status information.

[0018] The electronic keys included in the electronic key list may be the electronic keys themselves or their identification information. The electronic key identification information is information that identifies the electronic keys to be managed and is individually assigned information.

[0019] The electronic device identification information is identification information that individually identifies the electronic device 10. The priority is a different value assigned to each electronic key. The priority represents an order that determines which electronic key is to be used preferentially. The last communication time is the time when communication was last performed with the electronic device 10 to which the electronic key identification information is assigned. In other words, it is the most recent time when communication was performed.

[0020] The status information is a value that indicates whether the information is valid or invalid. Multiple different electronic keys are associated with one lock identification information, and the status information is set as valid for only one of the multiple different electronic keys, or as invalid for all of the electronic keys.

[0021] In this example, four electronic keys, "Key 5001," "Key 5002," "Key 5003," and "Key 5004," are associated with the lock identification information "0001." In this case, the electronic key list associates any of these electronic keys as an electronic key that can be used to unlock or lock the lock device 40 assigned the lock identification information "0001."

[0022] For example, the electronic key "Key 5001" is stored in the electronic device 10 to which the electronic device identification information "Smartphone A01" is assigned, and has a priority of "1," meaning that it is used with the highest priority, the last communication time is "August XX, 2023, 12:13," and the status information is "Valid." Hereinafter, the electronic key assigned the highest priority may be referred to as the main key, and the electronic keys assigned the second or lower priority may be referred to as backup keys.

[0023] Here, it is shown that of the four electronic keys, only electronic key "Key 5001" can lock or unlock the lock device 40. A user carries at least two of these four electronic keys. That is, the user carries two electronic devices 10, for example, an electronic device 10 (e.g., electronic device 10a) storing the main key and an electronic device 10 (e.g., electronic device 10b) storing the backup key. In this manner, the electronic device 10 storing the backup key is carried by the user. Therefore, it is not necessary to permanently install the electronic device 10 on an object such as a door. This prevents the backup key from being misused and used to unlock the lock device when the main key is blocked. Note that while FIG. 4 shows four electronic keys associated with one lock identification, it is sufficient for multiple electronic keys to be associated with one lock identification, and the number of electronic keys may be two, three, five, or more.

[0024] The keyhole data is data that, when associated with an electronic key, can transition the lock device 40 to a locked or unlocked state. Here, one electronic key is associated with one piece of keyhole data, and is generated by the key management server 30 or an electronic key generation device. When an electronic key and keyhole data corresponding to the electronic key are generated by the key management server 30, the generated keyhole data may be stored. Alternatively, an electronic key and keyhole data corresponding to the electronic key may be generated in another key generation device, and the generated keyhole data may be stored.

[0025] The communication unit 302 repeatedly performs communication at intervals to check whether communication is possible with the plurality of electronic devices among the plurality of electronic devices to which individual electronic keys are assigned.

[0026] The status information management unit 303 writes one electronic key assigned to the electronic device 10 as valid based on the priority of the electronic keys assigned to the electronic device 10, based on the results of communication performed by the communication unit 302. The status information management unit 303 may also write all electronic keys as invalid. The status information management unit 303 writes the highest-priority electronic key assigned to the electronic device 10 as valid based on the results of communication performed by the communication unit 302. The status information management unit 303 writes the highest-priority electronic key assigned to the electronic device 10, based on the results of communication performed by the communication unit 302, as valid. The status information management unit 303 writes the highest-priority electronic key assigned to the electronic device 10, based on the latest time at which communication was successfully performed by the communication unit 302, within an allowable time range based on the current time. Here, if the time interval between the latest time at which communication was successfully performed and the current time is shorter than a predetermined allowable time, it can be determined that the function of the electronic device 10 with which communication was successfully performed is functioning effectively. If the time interval is longer than the allowable time, it can be determined that the function of the electronic device 10 is not valid. In such a case, the status information management unit 303 validates the electronic key of the electronic device 10 with the highest priority among the electronic devices 10 for which it has been determined that the time interval between the latest time of successful communication and the current time is shorter than a predetermined allowable time, and the status information management unit 303 can then delegate the authority to lock or unlock to the electronic key of the validated electronic device 10. Therefore, the authority can be delegated by the key management server 30, not by the electronic device 10.

[0027] Furthermore, if the latest time at which a validated electronic key was able to communicate with its assigned electronic device exceeds the allowed time, the status information management unit 303 invalidates the validated electronic key and validates the remaining electronic key whose latest communication time is within the allowed time and has the highest priority. Furthermore, when communication is resumed with an electronic device that was invalidated because the allowed time was exceeded, the status information management unit 303 validates the electronic key with the higher priority between the electronic key assigned to the electronic device with which communication has resumed and the priority of the currently valid electronic key, and invalidates the remaining electronic keys.

[0028] Returning to FIG. 3, the lock device management unit 304 assigns keyhole data that allows at least one of locking and unlocking operations using a validated electronic key to a lock device under management.

[0029] The timekeeping unit 305 measures the current time. The key registration unit 306 accepts registration of electronic keys and priorities in response to instructions from the terminal device used by the user, and writes the registration information into the electronic key list in the storage unit 301. Here, electronic keys can be registered, deleted, and their priorities changed. When registering an electronic key, the key registration unit 306 can assign electronic key identification information to the electronic key and write the information into the electronic key list. The control unit 307 controls each unit of the key management server 30.

[0030] Next, the operation of the electronic key system S will be described. FIG. 5 is a flowchart illustrating the operation of the key management server 30, and FIG. 6 is a sequence diagram showing the processing flow of the electronic key system S. First, a user registers an electronic key and its priority by storing it as an electronic key list in the storage unit 301 of the key management server 30 (step S101 in FIG. 5 , step S151 in FIG. 6 ). For example, a user may operate one of terminal devices, such as a smartphone, tablet, or PC, and register the electronic key and its priority by accessing a website for registering an electronic key in the key management server 30 from the terminal device. Furthermore, such a terminal device may be one of the electronic devices 10.

[0031] Such a website may be a membership site or a key manufacturer's site. Here, the user registers each electronic device that the user intends to use as an electronic key with the lock device 40. For example, if the user intends to use four electronic devices 10 as electronic keys, the user can register all four electronic keys.

[0032] Based on a registration request from a terminal device, the key registration unit 306 of the key management server 30 registers the electronic keys and their priorities by writing them as an electronic key list in the storage unit 301 (step S301 in FIG. 6).

[0033] When each electronic device 10 is registered, the key management server 30 performs alive monitoring based on whether alive information has been received from the electronic device 10 (step S302 in FIG. 6 ). By performing alive monitoring, when communication is received from the electronic device 10, the key management server 30 can continuously detect that the electronic device 10 with which communication has been received is operating.

[0034] Furthermore, once each electronic device 10 is registered, it periodically communicates with the key management server 30 via the wireless access point 20 to transmit life and death information (steps S152 and S161 in FIG. 5). For example, each electronic device 10 periodically transmits life and death information to the key management server 30. The periodic period for transmitting life and death information may be, for example, every 10 minutes. The interval for transmitting life and death information may be constant or random, as long as it is shorter than the allowed time. The life and death information only needs to include information that can identify at least the source electronic device 10 or electronic key. For example, by using electronic device identification information included in the life and death information, it is possible to identify which electronic device 10 transmitted the life and death information.

[0035] In the alive / dead monitoring process, when the status information management unit 303 receives alive / dead information from the electronic device 10 (step S102 in Figure 5), it reads the time of reception from the timing unit 305, associates it with the key identification information contained in the alive / dead information, and writes it as the last communication time in the electronic key list (step S103 in Figure 5).

[0036] When the determination timing arrives, the status information management unit 303 determines whether the time interval between the last communication time and the current time is within the allowable time. If the time interval between the last communication time and the current time exceeds the allowable time, the status information management unit 303 determines that the electronic key corresponding to the last communication time that exceeded the allowable time is invalid, and rewrites the status information to invalid (step S104 in FIG. 5). On the other hand, if the time interval between the last communication time and the current time does not exceed the allowable time, the status information management unit 303 extracts it as a candidate for a valid key.

[0037] The status information management unit 303 selects the electronic key with the highest priority from the remaining electronic keys in the electronic key list, excluding the invalid electronic key, as the valid key (step S303 in FIG. 6).The status information management unit 303 then rewrites the status information of the electronic key selected as the valid key to "valid" and the other electronic keys to "invalid" (step S105 in FIG. 5).

[0038] For example, if the electronic key for electronic device 10a has a higher priority than the electronic key for electronic device 10b, and communication based on life and death information with electronic device 10a had been possible within the allowed time up until that point but communication with electronic device 10a was not possible within the allowed time in this determination (communication was interrupted), but communication based on life and death information with electronic device 10b was possible within the allowed time, the electronic key for electronic device 10a is determined to be unusable and the electronic key for electronic device 10b is selected as the valid key. As a result, the electronic key for electronic device 10a is changed from a usable state (valid key) to an unusable state (invalid key), and the electronic key for electronic device 10b is changed from an unusable state (invalid key) to a usable state (valid key).

[0039] Furthermore, for example, after the electronic key of the electronic device 10a is invalidated, the electronic device 10a and the key management server 30 transition to a state in which they can communicate with each other, and when the electronic device 10a transmits life / death information to the key management server 30, the status information management unit 303 receives the life / death information from the electronic device 10a. Based on the received life / death information, if the time interval between the last communication time and the current time is within the allowable time and the priority of the electronic key of the electronic device 10a is higher than the priority of the electronic key of the electronic device 10b, the status information management unit 303 selects the electronic key of the electronic device 10a as the valid key again and disables the electronic key of the electronic device 10b.

[0040] In this way, when the electronic device 10a with a high-priority electronic key transitions from a non-communicable state to a communicable state and is determined to be valid, the electronic key of the electronic device 10a is changed from an invalid key to a valid key. As a result, even if a user travels beyond the permitted time limit to an area where communication with the key management server 30 is not possible, such as when carrying the electronic device 10a and riding the subway, the electronic key can be restored to a valid key when the user returns to an area where communication is possible. This avoids a situation in which the electronic device 10a cannot be used even if the electronic device 10a remains invalid even after the user temporarily travels outside the communication range and then returns to the communication range, as the electronic device 10a and the key management server 30 can communicate.

[0041] In this way, the key management server 30 can switch to an available electronic key. For example, if a main key is valid but the time interval between the last communication time of the electronic device 10 of the main key and the current time exceeds the allowable time, the main key is deemed "invalid," and the remaining backup keys, the electronic keys of the electronic devices 10 that were able to communicate within the allowable time, are deemed "valid." This allows switching from the main key to the backup key.

[0042] In this way, the status information management unit 303 can switch electronic keys by selecting, as the valid key, one electronic key with the highest priority from among the electronic keys (usable keys) included in the pre-registered key list, excluding "invalid" (unusable) electronic keys. Note that if the status information management unit 303 cannot communicate with all electronic devices 10 in the electronic key list using alive / dead information, all electronic keys are disabled for security reasons.

[0043] When a valid key is selected, the lock device management unit 304 transmits keyhole data corresponding to the selected electronic key to the lock device 40 via the communication unit 302 (step S106 in FIG. 5 , step S304 in FIG. 6 ). When the lock device 40 receives the keyhole data from the lock device management unit 304, it sets the received keyhole data as a lock that can be locked and unlocked (step S401 in FIG. 6 ). This makes it possible to both lock and unlock the lock device 40 by using the electronic device 10 in which the electronic lock selected as the valid key is stored.

[0044] The control unit 307 of the key management server 30 transmits information indicating that the electronic key has been set as a valid key as key status notification information via the communication unit 302 to the electronic devices 10 corresponding to the electronic key that has been set as a valid key (step S107 in FIG. 5 , step S305 in FIG. 6 ). Here, the control unit 307 may notify electronic devices 10 other than those corresponding to the electronic key that has been set as a valid key that the electronic key is invalid. Here, electronic devices 10 that are in a communicable state can receive the information indicating that the electronic key is invalid.

[0045] When the electronic device 10 receives the notification indicating that the electronic key is valid, it outputs information indicating that the electronic key of the electronic device 10 is valid (step S162 in FIG. 6 ). For example, a lamp on the output unit 104 of the electronic device 10 may be turned on, or a key mark may be displayed on the display screen of the output unit 104. This allows the user to know which electronic key of the electronic device 10 is available for use, even if the available electronic key is switched to an electronic key of another electronic device. The indication of whether the electronic device 10 is a valid key may be displayed constantly while the electronic device 10 is valid, may be displayed when the user inquires about whether the key is valid, or may be displayed when the locking device 40 is locked or unlocked.

[0046] When a user arrives at a door and wants to unlock it, the user inputs an unlock command to the electronic device 10 in which a valid key is stored. Based on this unlock command, the electronic device 10 transmits an unlock command to the locking device 40. Here, the electronic device 10 communicates with a wireless access point 20 with which it can communicate, thereby transmitting the unlock command to the locking device 40 that can communicate with the wireless access point 20. Here, the electronic device 10 transmits an electronic key and an unlock request to the locking device 40 connected via the wireless access point 20 (step S163 in FIG. 6). Here, a case is described in which the electronic device 10 and the locking device 40 communicate via the wireless access point 20; however, the electronic device 10 and the locking device 40 may communicate via short-range wireless communication, thereby transmitting the unlock command or the lock command from the electronic device 10 to the locking device 40.

[0047] In the above-described embodiment, if the wireless access point 20 is installed in an area where wireless communication with the lock device 40 is possible, i.e., in the vicinity of the lock device 40, it is possible to avoid a situation in which the electronic device 10 and the key management server 30 cannot communicate (cannot transmit vital information) because the wireless access point 20 is not nearby until the user approaches the lock device 40 while carrying the electronic device 10 to lock or unlock it. This avoids the time interval between the last communication time and the current time exceeding the allowable time while the user carries the electronic device 10 and approaches the lock device 40, causing the electronic key of the electronic device 10 carried by the user to become invalid.

[0048] When the lock device 40 receives the electronic key from the electronic device 10, it performs an authentication process for the electronic key by determining whether the keyhole data currently set in the lock device 40 corresponds to the received electronic key (step S402 in FIG. 6). If the lock device 40 determines that the keyhole data and the electronic key correspond to each other, the lock device 40 unlocks the electronic key in response to an unlocking request (step S403 in FIG. 6).

[0049] Furthermore, in the above-described embodiment, the case where the user carries both the electronic device 10a and the electronic device 10b is described, but the electronic device 10b having a spare key stored therein may be provided in the lock device 40. In this way, when the user performs biometric authentication on the electronic device 10b provided in the lock device 40, the spare key for the electronic device 10b can be activated based on the results of the biometric authentication, and the lock device 40 can be locked or unlocked. Furthermore, even when the electronic device 10 is provided in the lock device 40, the spare key can be activated if the user is determined to be a legitimate user by biometric authentication, so security can be ensured to prevent the spare key from being used even if the user does not carry the electronic device 10b.

[0050] In the above-described embodiment, the key management server 30 transmits keyhole data to the lock device 40, and one keyhole data set is stored in the lock device 40. However, the key management server 30 may transmit keyhole data corresponding to each electronic key of each electronic device 10 to the lock device 40, and the lock device 40 may store each keyhole data set. The key management server 30 may then transmit data indicating which keyhole data set to enable. As a result, the lock device 40 may use the valid keyhole data instructed by the key management server 30 when performing unlocking or locking processing. This eliminates the need to transmit keyhole data each time the valid electronic key is switched, and suffices to transmit data indicating which keyhole data set to enable.

[0051] In the above-described embodiment, for example, if the electronic device 10a storing the electronic key is lost, the user may operate the electronic device 10b, their own smartphone, or their own personal computer (PC) to send an instruction to the key management server 30 to invalidate the electronic key for the lost electronic device 10a. Upon receiving this instruction, the key management server 30 writes "invalid" in the status information for the electronic key for the electronic device 10a. This prevents a third party from using the electronic device 10a to unlock or lock the lock device 40.

[0052] Although the process of invalidating the electronic key of the lost electronic device 10 has been described as being performed manually, it may also be performed automatically.

[0053] Next, an electronic key system according to a second embodiment will be described. In the second embodiment, the process of invalidating the electronic key of the electronic device 10 can be performed automatically, rather than manually.

[0054] Figure 7 is a schematic functional block diagram showing the configuration of a key management server 30A used in an electronic key system in the second embodiment. In the key management server 30A, functions that are the same as those of the key management server 30 shown in Figure 3 are assigned the same reference numerals, and their description will be omitted. The detection unit 308 detects the positions of each electronic device for multiple electronic keys associated with the same lock identification information. The position determination unit 309 determines whether the distance between each detected position is within a predetermined distance from each other. The authentication result acquisition unit 310 acquires the authentication result from the electronic device where biometric authentication was performed in the electronic device.

[0055] The status information management unit 303a invalidates all of the electronic keys of each electronic device when the detected position is not within a predetermined distance based on the determination result of the position determination unit 309. Among the electronic keys that have been invalidated because the detected position is not within a predetermined distance based on the determination result of the position determination unit 309, the status information management unit 303a validates the electronic key of the electronic device that has been authenticated as the person in the authentication result, and invalidates the other electronic keys.

[0056] Next, the operation of the key management server 30A in the second embodiment will be described. FIG. 8 is a flowchart illustrating the operation of the key management server 30A. When the status information management unit 303 receives alive / dead status information from the electronic device 10 (step S501 in FIG. 8), it reads the time of reception from the timer unit 305, associates it with the key identification information included in the alive / dead status information, and writes it as the last communication time in the electronic key list (step S502 in FIG. 8). Here, when periodically transmitting alive / dead status information to the key management server 30, each electronic device 10 is communicably connected via an access point. Therefore, the location of the user carrying the electronic device 10 can be estimated based on which wireless access point 20 the electronic device 10 is connected to. Therefore, the locations of the electronic device 10 in which the main key is stored and the electronic device 10 in which the backup key is stored can be estimated based on which wireless access point 20 the electronic device 10 is connected to.

[0057] Here, for example, a case will be described in which a user carries multiple electronic devices 10 registered in association with a single locking device. The status information management unit 303 identifies, based on the vital status information, which wireless access point 20 each registered electronic device 10 used to transmit its vital status information. Here, the status information management unit 303 can also acquire information indicating which wireless access point 20 the vital status information was transmitted through when it was received. The detection unit 308 then estimates (detects) the location of each electronic device 10 based on which wireless access point 20 the received vital status information was transmitted through (step S503 in FIG. 8 ).

[0058] The position determination unit 309 determines whether the distance between these positions is greater than a predetermined distance (step S504 in FIG. 8). If the position determination unit 309 determines that the distance between the detected positions is greater than a predetermined distance (step S504 in FIG. 8—YES), the status information management unit 303 switches the status information of each electronic device 10 to “invalid” (step S510).

[0059] For example, if the vital information for at least one of the electronic devices 10 is received via a wireless access point 20 different from that for the other electronic devices 10, the user may have left or lost the electronic device 10 that was received via the different wireless access point 20 and moved it to another location. It is also possible that the user has not moved, but a third party has taken one of the electronic devices 10. In such a case, all of the electronic devices 10 are "invalidated." When it is detected that the electronic devices 10 have moved away from each other, it is impossible to determine which electronic device 10 is in the possession of the intended user. Therefore, by "invalidating" all of the electronic devices 10, it is possible to prevent a third party from using the electronic key.

[0060] Here, when each electronic device 10 is disabled, the status information management unit 303 may notify each electronic device 10 that the electronic key has been "disabled" via the communication unit 302. This allows the user to know that the electronic key of each electronic device 10 has been disabled.

[0061] Furthermore, once a user has realized that all of the electronic devices 10 have been "invalidated," the user can input biometric information from the biometric information input unit 106 of any of the electronic devices 10 that the user carries. For example, the user inputs one of a fingerprint, iris, voice (voiceprint), etc. into the electronic device 10. The electronic device 10 performs biometric authentication based on the input biometric information. Then, the biometric authentication unit 107 of the electronic device 10 determines that the user is the person in question if the degree of match between the input biometric information and pre-registered biometric information is equal to or greater than a reference value. If the electronic device 10 determines that the user is the person in question, it transmits an authentication result to the key management server 30 indicating that the user's identity has been confirmed.

[0062] The authentication result acquisition unit 310 of the key management server 30A determines whether or not the authentication result of the biometric authentication has been received from the electronic device 10 (step S511 in FIG. 8). If the authentication result acquisition unit 310 has received the authentication result of the biometric authentication from the electronic device 10 (step S511 in FIG. 8—YES), the status information management unit 303a rewrites the status information corresponding to the electronic device 10 (e.g., the electronic device 10a) that has transmitted the authentication result and whose identity has been confirmed to be the same as the user's identity to “valid” (step S512 in FIG. 8).

[0063] By performing biometric authentication, it is possible to estimate which electronic device 10 is carried by the authorized user, and to activate that electronic device 10. As a result, an electronic device 10 that is located a certain distance away due to loss or other reasons can always be disabled, even if it has been able to transmit vital information or has a higher priority than the electronic device 10 carried by the authorized user. Furthermore, when biometric authentication is performed and the electronic key of an electronic device 10 that has been authenticated as being a legitimate user is activated, the electronic device 10 transitions to a state in which it can accept operation input from the user to unlock or lock the locking device 40. This allows the user to input an operation to unlock or lock the locking device 40, thereby unlocking or locking the locking device 40.

[0064] In this way, by invalidating the status information of the electronic device 10 based on distance, even if multiple electronic devices 10 are registered and the number of spare keys increases, the burden on the user of managing multiple spare keys can be reduced. This reduces the burden on the user of managing multiple spare keys even if more replacement keys (more spare keys) are added in anticipation of a malfunction of the electronic device 10, thereby improving the flexibility to increase alternative means in the event of an electronic key malfunction.

[0065] On the other hand, if it is determined in step S504 that the biometric authentication result has not been received (step S511 in FIG. 8—NO), the control unit 307 determines whether a predetermined timeout period has elapsed based on the time at which each electronic device was disabled in step S510 (step S513 in FIG. 8). If the timeout period has not elapsed (step S513 in FIG. 8—NO), the control unit 307 proceeds to step S511, and if the timeout period has elapsed (step S513 in FIG. 8—YES), the control unit 307 terminates the process.

[0066] On the other hand, if the vital information transmitted from the multiple electronic devices 10 is transmitted via the same wireless access point 20 in step S504, it can be assumed that the multiple electronic devices 10 are located close to each other. For example, it can be assumed that the user carries all of the electronic devices 10. If, based on the determination result of the position determination unit 309, the distance between the detected locations is not greater than a predetermined distance, i.e., is within the predetermined distance range (step S504—NO in FIG. 8 ), the status information management unit 303a determines whether the time interval between the last communication time and the current time is within the allowable time (step S505 in FIG. 8 ). If the time interval between the last communication time and the current time exceeds the allowable time, the status information management unit 303a determines that the electronic key corresponding to the last communication time that exceeded the allowable time is invalid and rewrites the status information to invalid (step S506 in FIG. 8 ).

[0067] Meanwhile, the status information management unit 303a determines the electronic key with the highest priority as the valid key among the electronic keys other than the invalid electronic key (electronic keys whose time interval between the last communication time and the current time does not exceed the allowable time) (step S507 in FIG. 8). Then, when the valid key is selected, the lock device management unit 304 transmits keyhole data corresponding to the valid electronic key to the lock device 40 via the communication unit 302. Then, the control unit 307 ends the process.

[0068] According to the embodiment described above, if a malfunction occurs in the electronic device 10 storing the main key, the lock device 40 can be unlocked or locked using an electronic device other than the malfunctioning electronic device 10, such as an electronic device 10 storing the backup key or an authentication device attached to the lock device 40. In this case, the key management server 30 can receive alive status information from among the available electronic devices 10, and one electronic device storing the highest-priority electronic key can be activated. As a result, instead of multiple electronic devices being made available, only one electronic key is activated. Therefore, even if multiple backup keys are prepared in anticipation of a malfunction, the usage status of the backup keys can be managed to prevent unauthorized use by third parties.

[0069] Furthermore, according to the above-described embodiment, each electronic device 10 transmits life and death information to the key management server 30 at regular intervals and updates the last communication time. If the life and death information cannot be updated after an allowable time has elapsed, the electronic key of the electronic device 10 whose life and death information could not be updated is determined to be unusable. As a result, the electronic device 10 whose life and death information cannot be updated is deemed to be inoperable because it is not possible to confirm whether it can be used normally, and is invalidated. Another electronic device 10 whose life and death information can be updated and has the highest priority can be activated.

[0070] Furthermore, according to the above-described embodiment, a user can carry an electronic device 10 in which a backup key is stored. As a result, even if the electronic device 10 in which the main key is stored becomes unable to communicate with the key management server 30, the user can still carry the electronic device 10 in which the backup key is stored. This prevents a third party from using the electronic device 10 in which the backup key is stored. This reduces the chance of a third party using the backup key to unlock or lock the lock device 40. Furthermore, if multiple electronic devices 10 are located at a distance greater than a certain distance from each other, all of the electronic devices 10 can be invalidated. As a result, even if one of the electronic devices 10 is lost or stolen, the user can prevent the use of the electronic key stored in that electronic device without performing any special operations. Furthermore, for a disabled electronic device 10, if biometric authentication is performed to confirm the user's identity, the electronic key of the biometrically authenticated electronic device 10 can be activated to lock or unlock the lock device 40.

[0071] Next, an electronic key system SB according to a third embodiment will be described. FIG. 9 is a schematic functional block diagram showing the configuration of the electronic key system SB according to the third embodiment. The electronic key system SB includes a communication unit 901, a storage unit 902, a status information management unit 903, and a lock device management unit 904. The communication unit 901 has multiple electronic devices to which individual electronic keys are assigned, and repeatedly communicates at intervals to confirm whether communication with the multiple electronic devices is possible. The storage unit 902 stores an electronic key list for each lock identification information identifying a lock device, including managed electronic keys, a priority level for each electronic key, and status information indicating whether the electronic key is valid. Based on the results of communication performed by the communication unit 901, the status information management unit 903 writes one of the electronic keys assigned to the electronic device as valid based on its priority. The lock device management unit 904 assigns keyhole data to the managed lock device, which allows at least one of locking and unlocking operations using the validated electronic key. The lock device management unit 904 assigns keyhole data that allows at least one of locking and unlocking operations using a validated electronic key to the lock devices that it manages.

[0072] 1 may be recorded on a computer-readable recording medium, and the program may be read into a computer system and executed to perform construction management. Note that the term "computer system" here includes hardware such as the OS and peripheral devices.

[0073] Furthermore, if a WWW system is used, the term "computer system" also includes the homepage provision environment (or display environment). Furthermore, "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, as well as storage devices such as hard disks built into computer systems. Furthermore, "computer-readable recording medium" also includes devices that retain programs for a certain period of time, such as volatile memory within a computer system that serves as a server or client. The program may be one that realizes part of the aforementioned functions, or it may be one that realizes the aforementioned functions in combination with a program already stored in the computer system. The program may also be stored on a designated server, and distributed (e.g., downloaded) via a communication line in response to requests from other devices.

[0074] Although an embodiment of the present invention has been described above in detail with reference to the drawings, the specific configuration is not limited to this embodiment, and includes designs within the scope of the gist of the present invention.

[0075] 10, 10a, 10b Electronic device 20 Wireless access point 30, 30A Key management server 40 Lock device 101, 301, 902 Storage unit 102, 302, 901 Communication unit 103 Alive and dead information management unit 104 Output unit 105 Input unit 106 Biometric information input unit 107 Biometric authentication unit 108, 307 Control unit 303, 303a, 903 Status information management unit 304, 904 Lock device management unit 305 Timer unit 306 Key registration unit 308 Detection unit 309 Position determination unit 310 Authentication result acquisition unit S, SB Electronic key system

Claims

1. An electronic key system having a communication unit which has a plurality of electronic devices each assigned with an individual electronic key, and which repeatedly communicates at intervals to check whether communication is possible with the plurality of electronic devices; a memory unit which stores an electronic key list which is stored for each lock identification information which identifies a lock device, the electronic key list including electronic keys to be managed, a priority which differs for each electronic key, and status information which indicates whether the electronic key is valid or not; a status information management unit which writes one electronic key based on the priority of the electronic keys assigned to the electronic device as valid based on the results of communication by the communication unit; and a lock device management unit which assigns keyhole data enabling at least one of locking or unlocking operations using the validated electronic key to the managed lock device.

2. The electronic key system according to claim 1, wherein the status information management unit writes, as valid, the electronic key having the highest priority among the electronic keys assigned to the electronic device based on the results of communication performed by the communication unit.

3. The electronic key system of claim 1, wherein the status information management unit writes as valid the electronic key with the highest priority among the electronic keys whose latest time of communication by the communication unit is within the allowable time range based on the current time.

4. The electronic key system of claim 3, wherein the status information management unit invalidates the validated electronic key if the latest time at which the validated electronic key was able to communicate with its assigned electronic device exceeds the allowed time, and validates the electronic key with the highest priority among the remaining electronic devices whose latest time at which it was able to communicate is within the allowed time range.

5. The electronic key system of claim 4, wherein when communication is resumed with an electronic device that has been disabled due to exceeding the allowable time, the status information management unit validates the electronic key with the higher priority between the priority of the electronic key assigned to the electronic device with which communication has been resumed and the priority of the currently validated electronic key, and invalidates the remaining electronic keys.

6. An electronic key system as described in any one of claims 1 to 5, comprising: a detection unit that detects the position of each electronic device of multiple electronic keys associated with the same lock identification information; and a position determination unit that determines whether the distance between each of the detected positions is within a predetermined distance from each other, wherein the status information management unit invalidates all of the electronic keys of each electronic device if the detected positions are not within the predetermined distance based on the determination result of the position determination unit.

7. An electronic key system as described in claim 6, further comprising an authentication result acquisition unit which acquires from the electronic device the authentication result of biometric authentication performed in the electronic device, wherein the status information management unit validates the electronic key of an electronic device which has been authenticated as the principal in the authentication result, among the electronic keys which have been invalidated because the detected position is not within a predetermined distance, based on the judgment result of the position judgment unit, and invalidates other electronic keys.

8. An electronic key management method comprising the steps of: having a plurality of electronic devices each assigned with an individual electronic key; repeatedly communicating at intervals to check whether communication is possible with the plurality of electronic devices; storing in a memory unit an electronic key list stored for each lock identification information that identifies a lock device, the electronic key list including electronic keys to be managed, a priority that differs for each electronic key, and status information indicating whether the electronic key is valid; based on the results of the communication, writing into the memory unit one electronic key based on the priority from among the electronic keys assigned to the electronic devices as valid; and assigning keyhole data enabling at least one of locking or unlocking operations using the validated electronic key to the lock device to be managed.

Images