Information processing device, information processing method, and information processing system

Abstract

The present invention satisfactorily prevents manipulation of ranging related information to be transmitted from an information terminal to an external device.　In the present invention, an information creation unit obtains the ranging related information on the basis of a UWB signal obtained by UWB communication with the external device, ensuring the integrity of the ranging related information. A transmission unit transmits the ranging related information with the ensured integrity to the external device. The information creation unit has a security level equal to or higher than that of a UWB communication unit that performs UWB communication. For example, the ranging related information includes time information for performing a positioning operation, a positioning result obtained by the positioning operation, and an action determination result determined on the basis of the positioning result.

Description

Information Processing Apparatus, Information Processing Method, and Information Processing System

[0001] The present technology relates to an information processing apparatus, an information processing method, and an information processing system, and more particularly to an information processing apparatus and the like that can preferably prevent forgery of ranging-related information transmitted from an information terminal to an external device.

[0002] Conventionally, an information processing system for positioning an information terminal by the DL-TDoA (Downlink Time Difference Of Arrival) method has been proposed (see Patent Document 1). The information terminal performs a positioning calculation using the signal arrival time differences from a plurality of anchors, transmits the positioning result to a server or the like of the system, and the server or the like controls actions such as unlocking a vehicle, unlocking a door, passing through a ticket gate, and settlement based on the positioning result.In this method of positioning an information terminal by the DL-TDoA method, it is characterized in that positioning of many information terminals can be performed at once.

[0003] When performing a positioning calculation at an information terminal and transmitting the positioning result to a server or the like in this way, it is easier for a malicious third party to forge the positioning result than when performing the positioning calculation at a server or the like with a high security level. In this case, there is a risk that the positioning result will be forged when performing the positioning calculation at the information terminal or when transmitting the positioning result from the information terminal to a server or the like.

[0004] International Publication No. 2022 / 264509

[0005] An object of the present technology is to preferably prevent forgery of ranging-related information transmitted from an information terminal to an external device.

[0006] The concept of the present technology is an information creation unit that obtains ranging-related information based on a UWB signal obtained by UWB communication with an external device and ensures the integrity of the ranging-related information, and a transmission unit that transmits the ranging-related information with the integrity ensured to the external device, and the information creation unit is an information processing apparatus having a security level higher than that of a UWB communication unit that performs the UWB communication.

[0007] In this technology, the information creation unit obtains distance measurement-related information based on UWB (Ultra-Wide Band) signals obtained through UWB communication with an external device, and the completeness of this distance measurement-related information is guaranteed. The transmission unit then transmits the distance measurement-related information, whose completeness has been guaranteed, to the external device.

[0008] For example, the external device may include an action control device that controls a predetermined action based on distance measurement-related information. Also, for example, the UWB signal may include a UWB signal for a DL-TDoA (Downlink Time Difference of Arrival) ranging method. Furthermore, for example, the distance measurement-related information may include time information for performing positioning calculations, positioning results obtained from positioning calculations, action determination results determined based on the positioning results, etc.

[0009] For example, the information creation unit may ensure the integrity of the distance measurement-related information by adding a signature to the created distance measurement-related information. Alternatively, for example, the information creation unit may ensure the integrity of the distance measurement-related information by establishing a secure channel for transmitting the created distance measurement-related information to an external device.

[0010] The information creation unit shall have a security level equal to or higher than that of the UWB communication unit that performs UWB communication. For example, the information creation unit may include a UWB communication unit, a secure element unit that transmits a key for secure ranging to the UWB communication unit, a TEE (Trusted Execution Environment) unit included in the control unit, etc.

[0011] For example, the information creation unit may be a secure element unit, which transmits a first key to the UWB communication unit for creating an STS (Scrambled Timestamp Sequence), and performs decryption processing on the encrypted time information (UWB signal information) sent from the UWB communication unit using a second key. In this case, the second key is not transmitted externally from the secure element unit, and the decryption processing of the time information can be performed more securely and appropriately.

[0012] Alternatively, for example, the information creation unit may be a secure element unit, which transmits a first key to the UWB communication unit for creating the STS, and performs MAC verification processing on the time information with MAC (Message Authentication Code) sent from the UWB communication unit using a second key. In this case, the second key is not transmitted externally from the secure element unit, and MAC verification processing on the UWB signal information can be performed more securely and appropriately.

[0013] Thus, in this technology, the information creation unit, which has a security level higher than that of the UWB communication unit that performs UWB communication, obtains distance measurement-related information based on UWB signals obtained through UWB communication with external devices, and further ensures the integrity of that distance measurement-related information, thereby effectively preventing tampering with distance measurement-related information transmitted from the information terminal to external devices.

[0014] Furthermore, in this technology, for example, when the distance between the external device and the UWB communication unit falls within a predetermined range, the information creation unit may create distance measurement-related information, ensure the integrity of this distance measurement-related information, and the transmission unit may transmit the distance measurement-related information with guaranteed integrity to the external device. This makes it possible to avoid the information creation unit always having to create distance measurement-related information with guaranteed integrity, thereby reducing the load on the information creation unit.

[0015] In this case, for example, when the distance between the external device and the UWB communication unit falls within a predetermined range, the system may repeatedly transmit distance measurement-related information, whose integrity is guaranteed, to the external device. This allows the external device to verify the safety of the distance measurement-related information being transmitted by observing the stability of the content of the distance measurement-related information transmitted multiple times.

[0016] Another concept of this technology is an information processing method in which an information creation unit obtains distance measurement-related information based on UWB signals obtained through UWB communication with an external device and ensures the integrity of said distance measurement-related information, and a transmission unit transmits the distance measurement-related information whose integrity has been ensured to the external device, and the information creation unit has a security level higher than that of the UWB communication unit that performs the UWB communication.

[0017] Another concept of this technology includes an information terminal and an action control device, wherein the information terminal includes an information creation unit that obtains distance measurement-related information based on UWB signals obtained through UWB communication with the action control device and ensures the integrity of said distance measurement-related information, and a transmission unit that transmits the distance measurement-related information whose integrity has been ensured to the action control device, and the information creation unit is located in an information processing system having a security level higher than that of the UWB communication unit that performs the UWB communication.

[0018] For example, the action control device may be configured to confirm that the information terminal is located within a predetermined range based on distance measurement-related information sent from the information terminal, ensuring its integrity, and then control the system to perform a predetermined action.

[0019] Figure 1 is a diagram illustrating the information processing system of this technology. Figure 2 is a sequence diagram illustrating an example of the operation procedure of the information processing system shown in Figure 1. Figure 3 is a specific example of the information processing system 1. <ese>Figure 4 is a diagram to explain the positioning results and signature. Figure 4 is a sequence diagram to explain an example of the operation procedure of the information processing system shown in Figure 3. Figure 5 is a specific example 2 of the information processing system. <ese>Figure 6 is a diagram illustrating time information, signature. Figure 6 is a sequence diagram illustrating an example of the operation procedure of the information processing system shown in Figure 5. Figure 7 is a specific example 3 of the information processing system. <tee>Figure 8 is a diagram to explain (time information, signature). Figure 8 is a sequence diagram to explain an example of the operation procedure of the information processing system shown in Figure 7. Figure 9 is a specific example 4 of the information processing system. <ese>Figure 10 is a diagram illustrating the action determination result and signature. Figure 10 is a sequence diagram illustrating an example of the operation procedure of the information processing system shown in Figure 9. Figure 11 is a specific example 5 of the information processing system. <uwbs>Figure 12 is a diagram illustrating time information, secure channels, etc. Figure 13 is a sequence diagram illustrating an example of the operation procedure of the information processing system shown in Figure 11. <ese>Figure 14 is a diagram illustrating decryption, time information, and signature. Figure 14 is a sequence diagram illustrating an example of the operation procedure of the information processing system shown in Figure 13. Figure 15 is a specific example 7 of the information processing system. <ese>Figure 16 is a diagram illustrating MAC verification, time information, and signature. Figure 17 is a diagram illustrating an example of the operation procedure of the information processing system shown in Figure 15. Figure 18 is a diagram illustrating an example of the configuration of a security (flapper) gate system as an application example of this technology. Figure 19 is a diagram illustrating an example of the configuration of an information terminal. Figure 20 is a diagram illustrating an example of the configuration of a door device.

[0020] The following describes embodiments for carrying out the invention (hereinafter referred to as "embodiments"). The description will be in the following order: 1. Embodiments 1-1. Example of the configuration of an information processing system 1-2. Specific example of an information processing system 1-2-1. Specific example 1 ( <ese>, positioning results, signature) 1-2-2. Specific example 2 ( <ese>(time information, signature) 1-2-3. Specific example 3 ( <tee>(time information, signature) 1-2-4. Specific example 4 ( <ese>, action judgment result, signature) 1-2-5. Specific example 5 ( <uwbs>(Time information, secure channel) 1-2-6. Specific example 6 ( <ese>, decryption, time information, signature) 1-2-7. Specific example 7 ( <ese>(MAC verification, time information, signature) 1-3. Application examples (security gate system) 2. Modification

[0021] <1. Embodiments> [1-1. Example of Information Processing System Configuration] Figure 1(a) shows an example of the configuration of an information processing system 10 as an embodiment. This information processing system 10 has an information terminal 100 and an action control device 200. The action control device 200 is an example of an external device.

[0022] The information terminal 100 is a mobile terminal that can be carried by the user 300. For example, the information terminal 100 may consist of electronic devices such as a smartphone, smartwatch, tablet terminal, or wearable device. Alternatively, the information terminal 100 may be a dedicated terminal for various systems to which this technology is applied, such as a dedicated terminal for contactless payment, a terminal for contactless ticket gates, a terminal for access control systems, or a terminal for smart keys. The information terminal 100 receives a UWB (Ultra-Wide Band) signal for the DL-TDoA ranging method from the action control device 200 and obtains distance measurement-related information.

[0023] The action control device 200 includes multiple anchors that send UWB (Ultra-Wide Band) signals for the DL-TDoA ranging method to the information terminal 100, and controls actions such as unlocking the car, unlocking doors, passing through ticket gates, and making payments based on the integrity-guaranteed distance measurement-related information sent from the information terminal 100. The transmission of integrity-guaranteed distance measurement-related information from the information terminal 100 to the action control device 200 is performed using UWB communication or other communication methods, such as BLE (Bluetooth Low Energy) communication, Wi-Fi communication, LTE (Long Term Evolution) communication, etc.

[0024] Figure 1(b) shows an example configuration of the information terminal 100. The information terminal 100 includes a UWB communication unit 101, a secure element unit 102, a TEE (Trusted Execution Environment) unit 103, and an application unit 104.

[0025] The UWB communication unit 101 is composed of, for example, a UWB chip called UWBS (UWB Subsystem) and performs UWB communication with a plurality of anchors (anchor devices) included in the action control device 200. The secure element unit 102 is composed of, for example, a mobile SE (Secure Element) chip called eSE (embedded Secure Element) and handles keys and the like for secure ranging via UWB communication.

[0026] The application unit 104 consists of a device processor (control unit) included in the main chip and executes various applications. The TEE unit 103, for example, is included in the device processor (control unit) and provides a reliable execution environment.

[0027] Here, the security levels of the UWB communication unit 101, the secure element unit 102, the TEE unit 103, and the application unit 104 are as follows: the application unit 104 has the lowest security level, followed by the UWB communication unit 101, the TEE unit 103, and the secure element unit 102, in that order. For example, the security level of the application unit 104 is "1", the security level of the UWB communication unit 101 is "3", the security level of the secure element unit 102 is "5", and the security level of the TEE unit 103 is "4".

[0028] In this technology, the information terminal 100 creates distance measurement-related information based on UWB signals obtained through UWB communication with the action control device 200 in an information creation unit having a security level of UWB communication unit 101 or higher, and ensures the integrity of the distance measurement-related information. The information terminal then transmits the distance measurement-related information, whose integrity has been ensured, to the action control device 200 in a transmission unit.

[0029] Here, the information creation unit may be, for example, the UWB communication unit 101, the secure element unit 102, or the TEE unit 103. Furthermore, if the information terminal 100 has a location with a security level equal to or higher than the UWB communication unit 101, the secure element unit 102, and the TEE unit 103, that location may be designated as the information creation unit. The transmission unit is comprised of the application unit 104.

[0030] Furthermore, the distance measurement-related information is not limited to the positioning results obtained from the positioning calculation, but may also include time information for performing the positioning calculation, action determination results determined based on the positioning results, etc. In addition, the integrity of the distance measurement-related information may be ensured, for example, by signing the distance measurement-related information, by establishing a security channel for transmitting the distance measurement-related information to the action control device 200, or by other methods.

[0031] Figure 2 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100 receives UWB signals for the DL-TDoA ranging method from a plurality of anchors constituting the action control device 200. (2) Next, the UWB communication unit 101, secure element unit 102, or TEE unit 103 of the information terminal 100 create distance measurement-related information based on the UWB signals and further ensure the integrity of the distance measurement-related information.

[0032] (3) Next, the UWB communication unit 101, secure element unit 102, or TEE unit 103 of the information terminal 100 outputs distance measurement-related information whose integrity has been ensured to the application unit 104. Next, (4) the application unit 104 of the information terminal 100 transmits the distance measurement-related information whose integrity has been ensured to the action control device 200. (5) Next, the action control device 200 performs action control based on the distance measurement-related information sent from the information terminal 100.

[0033] In the information processing system 10 shown in Figure 1(a), the information terminal 100 creates distance measurement-related information in an information creation unit having a security level of UWB communication unit 101 or higher, and ensures the integrity of that distance measurement-related information. It then transmits the distance measurement-related information, whose integrity has been ensured, to the action control device 200 through an application unit 104 with a lower security level. Therefore, when the distance measurement-related information is created in the information terminal 100 and when that distance measurement-related information is transmitted from the information terminal 100 to the action control device 200, it is possible to suppress tampering with the distance measurement-related information, and to effectively prevent tampering with the distance measurement-related information transmitted from the information terminal 100 to the action control device 200.

[0034] [1-2. Specific Examples of Information Processing Systems] "1-2-1. Specific Example 1 ( <ese>, positioning results, signature) Figure 3(a) shows an example configuration of information processing system 10A as a specific example 1. This information processing system 10A has an information terminal 100A and an action control device 200A.

[0035] The information terminal 100A receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200A. The information terminal 100A then transmits the signed positioning result to the action control device 200A. The action control device 200A verifies the signature of the signed positioning result sent from the information terminal 100A and then controls an action based on that positioning result.

[0036] Figure 3(b) shows an example configuration of the information terminal 100A. In Figure 3(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100A comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0037] The information terminal 100A first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 3(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0038] Although not shown in the diagram, prior to the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests a UWB session key for secure ranging from the secure element unit 102, and in response, the secure element unit 102 sets the UWB session key for the UWB communication unit 101. This UWB session key includes Key A (first key) for creating the STS (Scrambled Timestamp Sequence) and Key B (second key) for decoding the time information.

[0039] The non-secure positioning operation of Loop 1 in the information terminal 100A will be described. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200A, receives UWB signals for the DL-TDoA ranging method from the multiple anchors and obtains encrypted time information (UWB signal information) for positioning calculation, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculation. Then, the UWB communication unit 101 sends this time information to the application unit 104.

[0040] Next, the application unit 104 performs positioning calculations based on the time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100A (UWB communication unit 101) and the action control device 200A has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0041] If the action determination is not "OK", the information terminal 100A repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination). The reason for repeating this multiple times is that with a single positioning operation, there is a risk that the positioning result transmitted from the information terminal 100A to the action control device 200A may be tampered with, for example, by a ghost peak attack. By repeating this multiple times, the action control device 200A can check the stability of the content of the positioning result sent from the information terminal 100A and confirm its security.

[0042] The secure positioning operation of Loop 2 in the information terminal 100A will be described. First, the application unit 104 requests time information from the UWB communication unit 101. Next, the UWB communication unit 101 performs UWB communication using KeyA with a plurality of anchors constituting the action control device 200A, receives UWB signals for the DL-TDoA ranging method from the plurality of anchors, and acquires encrypted time information for performing positioning calculation. Further, the UWB communication unit 101 performs decryption processing on the encrypted time information using KeyB to acquire time information for positioning calculation. Then, the UWB communication unit 101 sends the time information to the secure element unit 102.

[0043] Next, the secure element unit 102 performs positioning calculation based on the time information, further signs the positioning result to ensure integrity, and sends the signed positioning result to the application unit 104. Next, the application unit 104 sends the signed positioning result to the action control device 200A. Here, the signed positioning result constitutes ranging-related information with guaranteed integrity.

[0044] The action control device 200A verifies the signature in the signed positioning result transmitted from the information terminal 100A in each operation of the secure positioning of Loop 2 multiple times. The action control device 200A checks the stability of the positioning results in multiple transmissions and confirms its safety. Then, the action control device 200A makes an action determination based on the positioning result. In this action determination, it is confirmed based on the positioning result whether the distance between the information terminal 100A (UWB communication unit 101) and the action control device 200A falls within a predetermined range. When it is confirmed that the distance falls within the predetermined range, the action control device 200A sets the action determination as "OK", while when it is confirmed that the distance does not fall within the predetermined range, the action control device 200A sets the action determination as "NG". The action control device 200A performs action control based on the action determination result.

[0045] Figure 4 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100A sends a request for a UWB session key to the secure element unit 102. (2) Next, the secure element unit 102 of the information terminal 100A generates a UWB session key (KeyA, KeyB) and sets the UWB session key in the UWB communication unit 101.

[0046] Next, the information terminal 100A starts an insecure positioning operation of Loop1. (3) The UWB communication unit 101 of the information terminal 100A receives a UWB signal for the DL-TDoA ranging method from a plurality of anchors constituting the action control device 200A. (4) Next, the UWB communication unit of the information terminal 100A acquires time information for positioning calculation based on the UWB signal and sends the time information (time information without signature) to the application unit 104.

[0047] (5) Next, the application unit 104 of the information terminal 100A performs a positioning calculation based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100A repeats the insecure positioning operation of Loop1. (6) If the action determination is "OK", the information terminal 100A exits the insecure positioning operation of Loop1 and (7) starts a secure positioning operation of Loop2.

[0048] (8) Next, the application unit 104 of the information terminal 100A sends a request for time information to the UWB communication unit 101. (9) Next, the UWB communication unit 101 of the information terminal 100A receives a UWB signal for the DL-TDoA ranging method from a plurality of anchors constituting the action control device 200A. (10) Next, the UWB communication unit 101 of the information terminal 100A acquires time information for positioning calculation based on the UWB signal and sends the time information to the secure element unit 102.

[0049] (11) Next, the secure element unit 102 of the information terminal 100A performs positioning calculations based on the time information sent from the UWB communication unit 101 to obtain a positioning result, (12) and signs the positioning result to ensure its integrity. (13) Next, the secure element unit 102 of the information terminal 100A sends the signed positioning result to the application unit 104. (14) Next, the application unit 104 of the information terminal 100A sends the signed positioning result to the action control device 200A. (15) The action control device 200A verifies the signature in the signed positioning result sent from the information terminal 100A.

[0050] (16) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. (17) The action control device 200A then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms the safety of the positioning results, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0051] In the sequence diagram shown in Figure 4, the information terminal 100A is configured such that the application unit 104 sends a request for time information to the UWB communication unit 101, and then performs the secure positioning operation of Loop 2 multiple times. However, the information terminal 100A may also be configured such that the application unit 104 sends a request for time information to the UWB communication unit 101 at the beginning of each execution of the secure positioning operation of Loop 2. This also applies to other specific examples described below.

[0052] In the information processing system 10A shown in Figure 3(a), the information terminal 100A performs a secure positioning operation in Loop 2, using time information acquired by the UWB communication unit 101 to perform a positioning calculation in the secure element unit 102 to obtain a positioning result as distance measurement-related information. Furthermore, it signs the positioning result to ensure its integrity, outputs the signed positioning result to the application unit 104 with a lower security level, and transmits this signed positioning result to the action control device 200A through the application unit 104. Therefore, it is possible to suppress tampering with the positioning result when the information terminal 100A obtains the positioning result and when the positioning result is transmitted from the information terminal 100A to the action control device 200A, and to effectively prevent tampering with the positioning result as distance measurement-related information transmitted from the information terminal 100A to the action control device 200A.

[0053] Furthermore, in the information processing system 10A shown in Figure 3(a), the information terminal 100A starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the secure element unit 102, which performs positioning calculations and signs the positioning results, can be reduced during the secure positioning operation of Loop 2.

[0054] Furthermore, in the information processing system 10A shown in Figure 3(a), the information terminal 100A repeats the secure positioning operation of Loop 2 multiple times. Therefore, it is possible to check whether the positioning results transmitted from the information terminal 100A to the action control device 200A have been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0055] "1-2-2. Specific Example 2 ( <ese>(time information, signature)) Figure 5(a) shows an example configuration of information processing system 10B as specific example 2. This information processing system 10B has an information terminal 100B and an action control device 200B.

[0056] The information terminal 100B receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200B. The information terminal 100B then transmits signed time information (time information for performing positioning calculations) to the action control device 200B. The action control device 200B verifies the signature of the signed time information sent from the information terminal 100B, then uses that time information to perform positioning calculations, makes an action determination based on the positioning result, and performs action control based on the action determination result.

[0057] Figure 5(b) shows an example configuration of the information terminal 100B. In Figure 5(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100B comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0058] The information terminal 100B first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 5(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0059] Although not shown in the diagram, prior to the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests a UWB session key for secure ranging from the secure element unit 102, and in response, the secure element unit 102 sets the UWB session key for the UWB communication unit 101. This UWB session key includes Key A (first key) for creating the STS and Key B (second key) for decoding the time information.

[0060] The non-secure positioning operation of Loop 1 in the information terminal 100B will be described. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200B, receives UWB signals for the DL-TDoA ranging method from the multiple anchors and obtains encrypted time information (UWB signal information) for positioning calculation, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculation. Then, the UWB communication unit 101 sends this time information to the application unit 104.

[0061] Next, the application unit 104 performs positioning calculations based on the time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100B (UWB communication unit 101) and the action control device 200B has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0062] If the action determination is not "OK", the information terminal 100B repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination). The reason for repeating this multiple times is that with a single positioning operation, there is a risk that the time information transmitted from the information terminal 100B to the action control device 200B may be tampered with, for example, by a ghost peak attack. By repeating this multiple times, the action control device 200B can check the stability of the content of the time information sent from the information terminal 100B and confirm its security.

[0063] The operation of secure positioning in Loop 2 of the information terminal 100B will now be described. First, the application unit 104 requests time information from the UWB communication unit 101. Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200B, receives UWB signals for the DL-TDoA ranging method from the multiple anchors to obtain encrypted time information for positioning calculations, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculations. Finally, the UWB communication unit 101 sends this time information to the secure element unit 102.

[0064] Next, the secure element unit 102 signs the time information to ensure its integrity and sends the signed time information to the application unit 104. Then, the application unit 104 transmits the signed time information to the action control device 200B. Here, the signed time information constitutes distance measurement-related information whose integrity is ensured.

[0065] The action control device 200B verifies the signature of the signed time information transmitted from the information terminal 100B during each of the multiple secure positioning operations of Loop 2, and performs positioning calculations using that time information. The action control device 200B checks the stability of the positioning results over multiple transmissions to confirm their security. Then, the action control device 200B makes an action determination based on the positioning results. In this action determination, the action control device 200B checks whether the distance between the information terminal 100B (UWB communication unit 101) and the action control device 200B has entered a predetermined range, based on the positioning results. If it is confirmed that the distance has entered the predetermined range, the action control device 200B sets the action determination to "OK," while if it is confirmed that the distance has not entered the predetermined range, the action determination to "NG." Based on the action determination result, the action control device 200B performs action control.

[0066] Figure 6 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100B sends a request for a UWB session key to the secure element unit 102. (2) Next, the secure element unit 102 of the information terminal 100B generates UWB session keys (Key A, Key B) and sets these UWB session keys in the UWB communication unit 101.

[0067] Next, the information terminal 100B starts the insecure positioning operation of Loop 1. (3) The UWB communication unit 101 of the information terminal 100B receives UWB signals for the DL-TDoA ranging method from multiple anchors that make up the action control device 200B. (4) Next, the UWB communication unit 101 of the information terminal 100B acquires time information for positioning calculation based on the UWB signals and sends that time information (unsigned time information) to the application unit 104.

[0068] (5) Next, the application unit 104 of the information terminal 100B performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100B repeats the non-secure positioning operation of Loop 1. (6) If the action determination is "OK", the information terminal 100B exits the non-secure positioning operation of Loop 1 and (7) starts the secure positioning operation of Loop 2.

[0069] (8) Next, the application unit 104 of the information terminal 100B sends a request for time information to the UWB communication unit 101. (9) Next, the UWB communication unit 101 of the information terminal 100B receives UWB signals for the DL-TDoA ranging method from a plurality of anchors constituting the action control device 200B. (10) Next, the UWB communication unit 101 of the information terminal 100B acquires time information for positioning calculation based on the UWB signals and sends that time information to the secure element unit 102.

[0070] (11) Next, the secure element unit 102 of the information terminal 100B signs the time information sent from the UWB communication unit 101 to ensure its integrity. (12) Next, the secure element unit 102 of the information terminal 100B sends the signed time information to the application unit 104. (13) Next, the application unit 104 of the information terminal 100B sends the signed time information to the action control device 200B. (14) After the action control device 200B verifies the signature in the signed time information sent from the information terminal 100B, (15) it performs positioning calculations using the time information.

[0071] (16) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. The action control device 200B then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms the safety of the positioning results, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0072] In the information processing system 10B shown in Figure 5(a), the information terminal 100B ensures the integrity of the time information acquired by the UWB communication unit 101 in the secure positioning operation of Loop 2 by signing it with the secure element unit 102, outputs the signed time information to the application unit 104 which has a lower security level, and transmits this signed time information to the action control device 200B through the application unit 104. Therefore, when the information terminal 100B obtains the time information and when it transmits that time information from the information terminal 100B to the action control device 200B, it is possible to suppress the alteration of the time information as distance measurement-related information transmitted from the information terminal 100B to the action control device 200B, and it is possible to effectively prevent alteration of the time information.

[0073] Furthermore, in the information processing system 10B shown in Figure 5(a), the information terminal 100B starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the secure element unit 102, which signs the time information, can be reduced during the secure positioning operation of Loop 2.

[0074] Furthermore, in the information processing system 10B shown in Figure 5(a), the information terminal 100B repeats the secure positioning operation of Loop 2 multiple times. Therefore, it becomes possible to check whether the time information transmitted from the information terminal 100B to the action control device 200B has been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0075] "1-2-3. Specific Example 3 ( <tee>", time information, signature" Figure 7(a) shows an example configuration of information processing system 10C as specific example 3. This information processing system 10C has an information terminal 100C and an action control device 200C.

[0076] The information terminal 100C receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200C. The information terminal 100C then transmits signed time information (time information for performing positioning calculations) to the action control device 200C. The action control device 200C verifies the signature of the signed time information sent from the information terminal 100C, then uses that time information to perform positioning calculations, makes an action determination based on the positioning result, and performs action control based on the action determination result.

[0077] Figure 7(b) shows an example configuration of the information terminal 100C. In Figure 7(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100C comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0078] The information terminal 100C first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 7(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0079] Although not shown in the diagram, prior to the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests a UWB session key for secure ranging from the secure element unit 102, and in response, the secure element unit 102 sets the UWB session key for the UWB communication unit 101. This UWB session key includes Key A (first key) for creating the STS and Key B (second key) for decoding the time information. Note that the UWB session key can also be generated by the TEE unit 103. In this specification, the generation of the UWB session key is described as being performed by the secure element unit 102.

[0080] The non-secure positioning operation of Loop 1 in the information terminal 100C will be described. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors constituting the action control device 200C, receives UWB signals for the DL-TDoA ranging method from the multiple anchors and obtains encrypted time information (UWB signal information) for positioning calculation, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculation. Then, the UWB communication unit 101 sends this time information to the application unit 104.

[0081] Next, the application unit 104 performs positioning calculations based on the time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100C (UWB communication unit 101) and the action control device 200C has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0082] If the action determination is not "OK", the information terminal 100C repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination). The reason for repeating this multiple times is that with a single positioning operation, there is a risk that the time information transmitted from the information terminal 100C to the action control device 200C may be tampered with, for example, by a ghost peak attack. By repeating this multiple times, the action control device 200C can check the stability of the content of the time information sent from the information terminal 100C and confirm its security.

[0083] The secure positioning operation of Loop 2 in the information terminal 100C will now be explained. First, the application unit 104 requests time information from the UWB communication unit 101. Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors constituting the action control device 200C, receives UWB signals for the DL-TDoA ranging method from the multiple anchors to obtain encrypted time information for positioning calculations, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculations. Finally, the UWB communication unit 101 sends this time information to the TEE unit 103.

[0084] Next, the TEE unit 103 signs the time information to ensure its integrity and sends the signed time information to the application unit 104. Then, the application unit 104 transmits the signed time information to the action control device 200C. Here, the signed time information constitutes distance measurement-related information whose integrity is ensured.

[0085] The action control device 200C verifies the signature of the signed time information transmitted from the information terminal 100C during each of the multiple secure positioning operations of Loop 2, and performs positioning calculations using that time information. The action control device 200C checks the stability of the positioning results over multiple transmissions to confirm their security. Then, the action control device 200C makes an action determination based on the positioning results. In this action determination, the action control device 200C checks whether the distance between the information terminal 100C (UWB communication unit 101) and the action control device 200C has entered a predetermined range, based on the positioning results. If it is confirmed that the distance has entered the predetermined range, the action control device 200C sets the action determination to "OK," while if it is confirmed that the distance has not entered the predetermined range, the action determination to "NG." The action control device 200C performs action control based on the action determination result.

[0086] Figure 8 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100C sends a request for a UWB session key to the secure element unit 102. (2) Next, the secure element unit 102 of the information terminal 100C generates UWB session keys (Key A, Key B) and sets these UWB session keys in the UWB communication unit 101.

[0087] Next, the information terminal 100C starts the insecure positioning operation of Loop 1. (3) The UWB communication unit 101 of the information terminal 100C receives UWB signals for the DL-TDoA ranging method from multiple anchors that make up the action control device 200C. (4) Next, the UWB communication unit 101 of the information terminal 100C acquires time information for positioning calculation based on the UWB signals and sends that time information (unsigned time information) to the application unit 104.

[0088] (5) Next, the application unit 104 of the information terminal 100C performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100C repeats the insecure positioning operation of Loop 1. (6) If the action determination is "OK", the information terminal 100C exits the insecure positioning operation of Loop 1 and (7) starts the secure positioning operation of Loop 2.

[0089] (8) Next, the application unit 104 of the information terminal 100C sends a request for time information to the UWB communication unit 101. (9) Next, the UWB communication unit 101 of the information terminal 100C receives UWB signals for the DL-TDoA ranging method from multiple anchors constituting the action control device 200C. (10) Next, the UWB communication unit 101 of the information terminal 100C acquires time information for positioning calculation based on the UWB signals and sends that time information to the TEE unit 103.

[0090] (11) Next, the TEE unit 103 of the information terminal 100C signs the time information sent from the UWB communication unit 101 to ensure its integrity. (12) Next, the TEE unit 103 of the information terminal 100C sends the signed time information to the application unit 104. (13) Next, the application unit 104 of the information terminal 100C sends the signed time information to the action control device 200C. (14) After the action control device 200C verifies the signature in the signed time information sent from the information terminal 100C, (15) it performs positioning calculations using the time information.

[0091] (16) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. The action control device 200C then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms the safety of the positioning results, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0092] In the information processing system 10C shown in Figure 7(a), the information terminal 100C ensures the integrity of the time information acquired by the UWB communication unit 101 in the secure positioning operation of Loop 2 by signing it with the TEE unit 103, outputs the signed time information to the application unit 104 which has a lower security level, and transmits this signed time information to the action control device 200C through the application unit 104. Therefore, when the information terminal 100C obtains the time information and when it transmits that time information from the information terminal 100C to the action control device 200C, it is possible to suppress the alteration of the time information as distance measurement-related information transmitted from the information terminal 100C to the action control device 200C, and it is possible to effectively prevent alteration of the time information.

[0093] Furthermore, in the information processing system 10C shown in Figure 7(a), the information terminal 100C starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the TEE unit 103, which signs the time information, can be reduced during the secure positioning operation of Loop 2.

[0094] Furthermore, in the information processing system 10C shown in Figure 7(a), the information terminal 100C repeats the secure positioning operation of Loop 2 multiple times. Therefore, it becomes possible to check whether the time information transmitted from the information terminal 100C to the action control device 200C has been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0095] "1-2-4. Specific Example 4 ( <ese>, action determination result, signature) Figure 9(a) shows an example configuration of information processing system 10D as specific example 4. This information processing system 10D has an information terminal 100D and an action control device 200D.

[0096] The information terminal 100D receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200D. The information terminal 100D then transmits the signed action determination result to the action control device 200D. The action control device 200D verifies the signature on the signed action determination result sent from the information terminal 100D and then controls an action based on that action determination result.

[0097] Figure 9(b) shows an example configuration of the information terminal 100D. In Figure 9(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100D comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0098] The information terminal 100D first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 9(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0099] Although not shown in the diagram, prior to the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests a UWB session key for secure ranging from the secure element unit 102, and in response, the secure element unit 102 sets the UWB session key for the UWB communication unit 101. This UWB session key includes Key A (first key) for creating the STS and Key B (second key) for decoding the time information.

[0100] The non-secure positioning operation of Loop 1 in the information terminal 100D will be described. First, the UWB communication unit 101 performs UWB communication using Key A with multiple anchors that constitute the action control device 200D, receives UWB signals for the DL-TDoA ranging method from the multiple anchors to obtain encrypted time information for positioning calculations, and then decrypts the encrypted time information using Key B to obtain time information for positioning calculations. Then, the UWB communication unit 101 sends this time information to the application unit 104.

[0101] Next, the application unit 104 performs positioning calculations based on the time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100D (UWB communication unit 101) and the action control device 200D has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0102] If the action determination is not "OK", the information terminal 100D repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination). By repeating this multiple times, the information terminal 100D can check the stability of the positioning result and confirm its security.

[0103] The operation of secure positioning in Loop 2 of the information terminal 100D will now be described. First, the application unit 104 requests time information from the UWB communication unit 101. Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors constituting the action control device 200D, receives UWB signals for the DL-TDoA ranging method from the multiple anchors to obtain encrypted time information for positioning calculation, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculation. Then, the UWB communication unit 101 performs positioning calculation using that time information and sends the positioning result to the secure element unit 102.

[0104] Next, the secure element unit 102 checks the stability of multiple positioning results to confirm their security. Then, the secure element unit 102 makes an action decision based on the positioning results. In this action decision, the secure element unit 102 checks whether the distance between the information terminal 100D (UWB communication unit 101) and the action control device 200D has entered a predetermined range, based on the positioning results. If it is confirmed that the distance has entered the predetermined range, the secure element unit 102 sets the action decision to "OK," while if it has not entered the predetermined range, the action decision to "NG."

[0105] Next, the secure element unit 102 signs the action determination result to ensure its integrity and sends the signed action determination result to the application unit 104. The application unit 104 then transmits the signed action determination result to the action control device 200D. Here, the signed action determination result constitutes distance measurement-related information with guaranteed integrity.

[0106] The action control device 200D verifies the signature of the signed action determination result transmitted from the information terminal 100D and performs action control based on that action determination result.

[0107] Figure 10 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100D sends a request for a UWB session key to the secure element unit 102. (2) Next, the secure element unit 102 of the information terminal 100D generates UWB session keys (Key A, Key B) and sets these UWB session keys in the UWB communication unit 101.

[0108] Next, the information terminal 100D starts the insecure positioning operation of Loop 1. (3) The UWB communication unit 101 of the information terminal 100D receives UWB signals for the DL-TDoA ranging method from multiple anchors that make up the action control device 200D. (4) Next, the UWB communication unit 101 of the information terminal 100D acquires time information for positioning calculation based on the UWB signals and sends that time information (unsigned time information) to the application unit 104.

[0109] (5) Next, the application unit 104 of the information terminal 100D performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100D repeats the insecure positioning operation of Loop 1. (6) If the action determination is "OK", the information terminal 100C exits the insecure positioning operation of Loop 1 and (7) starts the secure positioning operation of Loop 2.

[0110] (8) Next, the application unit 104 of the information terminal 100D sends a request for time information to the UWB communication unit 101. (9) Next, the UWB communication unit 101 of the information terminal 100D receives UWB signals for the DL-TDoA ranging method from multiple anchors that constitute the action control device 200D. (10) Next, the UWB communication unit 101 of the information terminal 100D acquires time information for positioning calculation based on the UWB signals and performs positioning calculation using this time information. (11) Then, the UWB communication unit 101 of the information terminal 100D sends the positioning result to the secure element unit 102.

[0111] (12) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. (13) Next, the secure element unit 102 of the information terminal 100D checks the stability of the positioning result obtained from the multiple secure positioning operations of Loop 2, confirms the security of the positioning result, and then makes an action decision based on the positioning result.

[0112] (14) Next, the secure element unit 102 of the information terminal 100D signs the action determination result to ensure its integrity. (15) Next, the secure element unit 102 of the information terminal 100D sends the signed action determination result to the application unit 104. (16) Next, the application unit 104 of the information terminal 100D sends the signed action determination result to the action control device 200D.

[0113] (17) The action control device 200D verifies the signature in the signed action determination result sent from the information terminal 100D, and then (18) performs action control based on the action determination result.

[0114] In the information processing system 10D shown in Figure 9(a), the information terminal 100D signs the action determination result obtained by the secure element unit 102 based on the secure positioning operation of Loop 2 to ensure its integrity, outputs the signed action determination result to the application unit 104 with a lower security level, and transmits this action determination result to the action control device 200D through the application unit 104. Therefore, when the information terminal 100D obtains the action determination result and when the action determination result is transmitted from the information terminal 100D to the action control device 200D, it is possible to suppress tampering with the action determination result, and effectively prevent tampering with the action determination result as distance measurement-related information transmitted from the information terminal 100D to the action control device 200D.

[0115] Furthermore, in the information processing system 10D shown in Figure 9(a), the information terminal 100D starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the UWB communication unit 101 that performs positioning calculations and the secure element unit 102 that performs action determination and signs the action determination result can be reduced during the secure positioning operation of Loop 2.

[0116] Furthermore, in the information processing system 10D shown in Figure 9(a), the information terminal 100D repeats the secure positioning operation of Loop 2 multiple times. Therefore, the secure element unit 102 can check the stability of the content of the multiple positioning results and confirm their security.

[0117] "1-2-5. Specific Example 5 ( <uwbs>"Time information, secure channel" Figure 11(a) shows an example configuration of information processing system 10E as specific example 5. This information processing system 10E has an information terminal 100E and an action control device 200E.

[0118] The information terminal 100E receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200E. The information terminal 100E then transmits time information (time information for performing positioning calculations) to the action control device 200E over the secure channel. The action control device 200E performs positioning calculations using the time information sent from the information terminal 100E, makes an action determination based on the positioning result, and performs action control based on the action determination result.

[0119] Figure 11(b) shows an example configuration of the information terminal 100E. In Figure 11(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100E comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0120] The information terminal 100E first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 11(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0121] Although not shown in the diagram, prior to the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests a UWB session key for secure ranging from the secure element unit 102, and in response, the secure element unit 102 sets the UWB session key for the UWB communication unit 101. This UWB session key includes Key A (first key) for creating the STS and Key B (second key) for decoding the time information.

[0122] The non-secure positioning operation of Loop 1 in the information terminal 100E will be described. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200E, receives UWB signals for the DL-TDoA ranging method from the multiple anchors and obtains encrypted time information (UWB signal information) for positioning calculation, and then decrypts the encrypted time information using KeyB to obtain time information for positioning calculation. Then, the UWB communication unit 101 sends this time information to the application unit 104.

[0123] Next, the application unit 104 performs positioning calculations based on the time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100E (UWB communication unit 101) and the action control device 200E has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0124] If the action determination is not "OK", the information terminal 100E repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination). The reason for repeating this multiple times is that with a single positioning operation, there is a risk that the time information transmitted from the information terminal 100E to the action control device 200E may be tampered with, for example, by a ghost peak attack. By repeating this multiple times, the action control device 200E can check the stability of the content of the time information sent from the information terminal 100E and confirm its security.

[0125] The secure positioning operation of Loop 2 in the information terminal 100E will now be described. First, the application unit 104 requests time information from the UWB communication unit 101. Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200E, receives UWB signals for the DL-TDoA ranging method from the multiple anchors to obtain encrypted time information for positioning calculations, and then performs decryption processing on the encrypted time information using KeyB to obtain time information for positioning calculations.

[0126] Furthermore, the UWB communication unit 101 establishes a security channel with the action control device 200E and transmits time information for positioning calculation to the action control device 200E over that secure channel. In this case, the transmitted time information may be accompanied by a MAC (Message Authentication Code). Here, the time information transmitted over the secure channel constitutes distance measurement-related information whose integrity is guaranteed.

[0127] The action control device 200E performs positioning calculations using time information sent from the information terminal 100E over the secure channel during each of the multiple Loop 2 secure positioning operations. The action control device 200E checks the stability of the positioning results over multiple transmissions to confirm their security. Then, the action control device 200E makes an action decision based on the positioning results.

[0128] In this action determination, the system checks, based on the positioning results, whether the distance between the information terminal 100E (UWB communication unit 101) and the action control device 200E has entered a predetermined range. If the action control device 200E confirms that the distance has entered the predetermined range, it sets the action determination to "OK". On the other hand, if it confirms that the distance has not entered the predetermined range, it sets the action determination to "NG". Based on the action determination result, the action control device 200E performs action control.

[0129] Figure 12 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100E sends a request for a UWB session key to the secure element unit 102. (2) Next, the secure element unit 102 of the information terminal 100E generates UWB session keys (Key A, Key B) and sets these UWB session keys in the UWB communication unit 101.

[0130] Next, the information terminal 100E starts the insecure positioning operation of Loop 1. (3) The UWB communication unit 101 of the information terminal 100E receives UWB signals for the DL-TDoA ranging method from multiple anchors that make up the action control device 200E. (4) Next, the UWB communication unit 101 of the information terminal 100E acquires time information for positioning calculation based on the UWB signals and sends that time information (unsigned time information) to the application unit 104.

[0131] (5) Next, the application unit 104 of the information terminal 100E performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100E repeats the insecure positioning operation of Loop 1. (6) If the action determination is "OK", the information terminal 100E exits the insecure positioning operation of Loop 1 and (7) starts the secure positioning operation of Loop 2.

[0132] (8) Next, the application unit 104 of the information terminal 100E sends a request for time information to the UWB communication unit 101. (9) Next, the UWB communication unit 101 of the information terminal 100E receives UWB signals for the DL-TDoA ranging method from multiple anchors constituting the action control device 200E. (10) Next, the UWB communication unit 101 of the information terminal 100E establishes a secure channel with the action control device 200E.

[0133] (11) The UWB communication unit 101 of the information terminal 100E acquires time information for positioning calculation based on the UWB signal and transmits that time information to the action control device 200E over the secure channel. In this case, the application unit 104 transmits the packet as is to the action control device 200E and acts as a simple conduit. (12) The action control device 200E performs positioning calculation using the time information sent from the information terminal 100E over the secure channel.

[0134] (13) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. (14) The action control device 200E then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms the safety of the positioning results, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0135] In the information processing system 10E shown in Figure 11(a), the information terminal 100E establishes a secure channel between the UWB communication unit 10 and the action control device 200E through the secure positioning operation of Loop 2, and transmits the time information acquired by the UWB communication unit 10 to the action control device 200E over the secure channel, that is, while ensuring integrity. Therefore, when the information terminal 100E obtains the time information and when it transmits that time information from the information terminal 100E to the action control device 200E, it is possible to suppress the alteration of the time information as distance measurement-related information transmitted from the information terminal 100E to the action control device 200E, and it is possible to effectively prevent alteration of the time information.

[0136] Furthermore, in the information processing system 10E shown in Figure 11(a), the information terminal 100E starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the UWB communication unit 101, which establishes a secure channel during the secure positioning operation of Loop 2, can be reduced.

[0137] Furthermore, in the information processing system 10E shown in Figure 11(a), the information terminal 100E repeats the secure positioning operation of Loop 2 multiple times. Therefore, it becomes possible to check whether the time information transmitted from the information terminal 100E to the action control device 200E has been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0138] Furthermore, the information processing system 10E shown in Figure 11(a) corresponds to the information processing system 10B shown in Figure 5(a) described above. Instead of signing the time information acquired by the UWB communication unit 10 and transmitting it to the action control device, it transmits it to the action control device over a secure channel, thereby ensuring the integrity of the time information as distance measurement-related information transmitted from the information terminal to the action control device. Although a detailed explanation is omitted, it goes without saying that the information processing system 10A shown in Figure 3(a), the information processing system 10C shown in Figure 7(a), and the information processing system 10D shown in Figure 9(a) described above can also be configured in a similar manner.

[0139] "1-2-6. Specific Example 6 ( <ese>", decryption, time information, signature" Figure 13(a) shows an example configuration of information processing system 10F as specific example 6. This information processing system 10F has an information terminal 100F and an action control device 200F.

[0140] The information terminal 100F receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200F. The information terminal 100F then transmits signed time information (time information for performing positioning calculations) to the action control device 200F. The action control device 200F verifies the signature of the signed time information sent from the information terminal 100F, then uses that time information to perform positioning calculations, makes an action determination based on the positioning result, and performs action control based on the action determination result.

[0141] Figure 13(b) shows an example configuration of the information terminal 100F. In Figure 13(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100F comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0142] The information terminal 100F first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 13(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0143] Although not shown in the diagram, before the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests Key A (the first key) for creating the STS (Sequence Time System) among the UWB Session Keys for secure ranging from the secure element unit 102. In response, the secure element unit 102 generates Key A (the first key) and Key B (the second key) for decoding the time information as the UWB session key. Then, the secure element unit 102 sets Key A to the UWB communication unit 101.

[0144] The non-secure positioning operation of Loop 1 in the information terminal 100F will be described. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200F, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains encrypted time information (UWB signal information) for performing positioning calculations. Then, the UWB communication unit 101 sends the encrypted time information to the secure element unit 102.

[0145] Next, the secure element unit 102 decrypts the encrypted time information sent from the UWB communication unit 101 using KeyB (the second key) to obtain time information for positioning calculations. Then, the secure element unit 102 sends the decrypted time information to the application unit 104 via the UWB communication unit 101.

[0146] The application unit 104 performs positioning calculations based on time information (unsigned time information) sent via the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100F (UWB communication unit 101) and the action control device 200F has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0147] If the action determination is not "OK", the information terminal 100F repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination).

[0148] The reason for repeating this process multiple times is that a single positioning attempt could result in the time information transmitted from the information terminal 100F to the action control device 200F being tampered with, for example, by a ghost peak attack. By repeating the process multiple times, the action control device 200F can observe the stability of the time information sent from the information terminal 100F and confirm its security.

[0149] The secure positioning operation of Loop 2 in the information terminal 100F will now be explained. First, the application unit 104 requests time information from the UWB communication unit 101.

[0150] Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200F, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains encrypted time information for positioning calculations. Then, the UWB communication unit 101 sends the encrypted time information to the secure element unit 102.

[0151] Next, the secure element unit 102 decrypts the encrypted time information sent from the UWB communication unit 101 using KeyB (the second key) to obtain time information for positioning calculations. The secure element unit 102 then signs the time information to ensure its integrity and sends the signed time information to the application unit 104. The application unit 104 then transmits the signed time information to the action control device 200F. Here, the signed time information constitutes distance measurement-related information with guaranteed integrity.

[0152] The action control device 200F verifies the signature of the signed time information transmitted from the information terminal 100F during each of the multiple secure positioning operations of Loop 2, and performs positioning calculations using that time information. The action control device 200F checks the stability of the positioning results over multiple transmissions to confirm their security. Then, the action control device 200F makes an action determination based on the positioning results. In this action determination, the action control device 200F checks whether the distance between the information terminal 100F (UWB communication unit 101) and the action control device 200F has entered a predetermined range, based on the positioning results. If it is confirmed that the distance has entered the predetermined range, the action control device 200F sets the action determination to "OK," while if it is confirmed that the distance has not entered the predetermined range, the action determination to "NG." The action control device 200F performs action control based on the action determination result.

[0153] Figure 14 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100F sends a request for KeyA (first key) to the secure element unit 102 for creating the STS among the UWB session keys. (2) Next, the secure element unit 102 of the information terminal 100F generates KeyA (first key) and KeyB (second key) for decoding time information as the UWB session key. (3) Then, the secure element unit 102 sets KeyA to the UWB communication unit 101.

[0154] Next, the information terminal 100F starts the insecure positioning operation of Loop 1. (4) The UWB communication unit 101 of the information terminal 100F performs UWB communication using KeyA with the multiple anchors that constitute the action control device 200F, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains encrypted time information for positioning calculation. (5) Next, the UWB communication unit 101 of the information terminal 100F sends the encrypted time information to the secure element unit 102.

[0155] (6) Next, the secure element unit 102 of the information terminal 100F performs a decryption process on the encrypted time information using KeyB (second key) to obtain time information for positioning calculation. (7) Next, the secure element unit 102 of the information terminal 100F sends the time information (unsigned time information) to the application unit 104 via the UWB communication unit 101.

[0156] (8) Next, the application unit 104 of the information terminal 100F performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100F repeats the non-secure positioning operation of Loop 1. (9) If the action determination is "OK", the information terminal 100F exits the non-secure positioning operation of Loop 1 and (10) starts the secure positioning operation of Loop 2.

[0157] (11) Next, the application unit 104 of the information terminal 100F sends a request for time information to the UWB communication unit 101.

[0158] (12) Next, the UWB communication unit 101 of the information terminal 100F performs UWB communication using KeyA with the multiple anchors that constitute the action control device 200F, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains encrypted time information for positioning calculation. (13) Next, the UWB communication unit 101 of the information terminal 100F sends the encrypted time information to the secure element unit 102.

[0159] (14) Next, the secure element unit 102 of the information terminal 100F decrypts the encrypted time information using KeyB (second key) to obtain time information for positioning calculation. (15) Next, the secure element unit 102 of the information terminal 100F signs the information to ensure its integrity. (16) Next, the secure element unit 102 of the information terminal 100F sends the signed time information to the application unit 104. (17) Next, the application unit 104 of the information terminal 100F sends the signed time information to the action control device 200F. (18) After the action control device 200F verifies the signature in the signed time information sent from the information terminal 100F, (19) it performs positioning calculation using the time information.

[0160] (20) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. (21) The action control device 200F then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms their safety, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0161] In the sequence diagram shown in Figure 14, even in the secure positioning operation of Loop 2, the UWB communication unit 101 requests Key A from the secure element unit 102, the secure element unit 102 generates Key A and B, and sets Key A to the UWB communication unit 101. However, it is also possible to use Key A and B as they were before starting the unsecured positioning operation of Loop 1. The same applies to other specific examples described below.

[0162] In the information processing system 10F shown in Figure 13(a), the information terminal 100F, in the secure positioning operation of Loop 2, decrypts the encrypted time information acquired by the UWB communication unit 101 using the secure element unit 102 to obtain the time information, and then signs the time information with the secure element unit 102 to ensure its integrity. After that, the signed time information is transmitted to the action control device 200F via the application unit 104, which has a lower security level. Therefore, when the information terminal 100F obtains the time information and when it transmits that time information from the information terminal 100F to the action control device 200F, it is possible to suppress the alteration of the time information as distance measurement-related information transmitted from the information terminal 100F to the action control device 200F, and it is possible to effectively prevent alteration of the time information.

[0163] In the information processing system 10B shown in Figure 5(a) above, KeyB (a second key) for decrypting the time information generated by the secure element unit 102 is set in the UWB communication unit 101. The UWB communication unit 101 decrypts the encrypted time information and sends the decrypted time information to the secure element unit 102 for signing. In the information processing system 10F shown in Figure 13(a), the encrypted time information obtained by the UWB communication unit 101 is sent to the secure element unit 102, which has a higher security level than the UWB communication unit 101. The secure element unit 102 decrypts the encrypted time information and signs the decrypted time information, making it possible to more strongly prevent tampering with the time information.

[0164] Furthermore, in the information processing system 10F shown in Figure 13(a), the information terminal 100F starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the secure element unit 102, which decrypts encrypted time information and then signs the decrypted time information, can be reduced during the secure positioning operation of Loop 2.

[0165] Furthermore, in the information processing system 10F shown in Figure 13(a), the information terminal 100F repeats the secure positioning operation of Loop 2 multiple times. Therefore, it becomes possible to check whether the time information transmitted from the information terminal 100F to the action control device 200F has been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0166] "1-2-7. Specific Example 7 ( <ese>, MAC verification, time information, signature) Figure 15(a) shows an example configuration of information processing system 10G as specific example 7. This information processing system 10G has an information terminal 100G and an action control device 200G.

[0167] The information terminal 100G receives UWB signals for the DL-TDoA ranging method from multiple anchors of the action control device 200G. The information terminal 100G then transmits signed time information (time information for performing positioning calculations) to the action control device 200G. The action control device 200G verifies the signature of the signed time information sent from the information terminal 100G, then uses that time information to perform positioning calculations, makes an action determination based on the positioning result, and performs action control based on the action determination result.

[0168] Figure 15(b) shows an example configuration of the information terminal 100G. In Figure 15(b), the same reference numerals are used for parts corresponding to those in Figure 1(b), and detailed explanations are omitted where appropriate. The information terminal 100G comprises a UWB communication unit 101, a secure element unit 102, a TEE unit 103, and an application unit 104.

[0169] The information terminal 100G first repeatedly performs the non-secure positioning operation of Loop 1. In Figure 15(b), the operation procedures indicated by circle numbers represent the secure positioning operation procedures that are performed after the non-secure positioning operation.

[0170] Although not shown in the diagram, before the non-secure positioning operation of Loop 1, the UWB communication unit 101 requests Key A (the first key) for creating the STS (Sequence Time System) among the UWB Session Keys for secure ranging from the secure element unit 102. In response, the secure element unit 102 generates Key A (the first key) and Key B (the second key) for decoding the time information as the UWB session key. Then, the secure element unit 102 sets Key A to the UWB communication unit 101.

[0171] This section describes the non-secure positioning operation of Loop 1 in the information terminal 100G. First, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors constituting the action control device 200G, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains time information (UWB signal information) with MAC (Message Authentication Code) for positioning calculations. This time information is not encrypted, so it can be interpreted by the UWB communication unit 101. The UWB communication unit 101 sends this time information to the application unit 104.

[0172] The application unit 104 performs positioning calculations based on time information (unsigned time information) sent from the UWB communication unit 101 to obtain a positioning result, and then makes an action determination based on that positioning result. In this action determination, it checks whether the distance between the information terminal 100G (UWB communication unit 101) and the action control device 200G has entered a predetermined range based on the positioning result, and if it is confirmed that it has entered the predetermined range, the action determination is set to "OK".

[0173] If the action determination is not "OK", the information terminal 100G repeats the non-secure positioning operation of Loop 1 described above. On the other hand, if the action determination is "OK", it exits the non-secure positioning operation of Loop 1 described above and repeats the secure positioning operation of Loop 2 multiple times (the number of times required for the action determination).

[0174] The reason for repeating this process multiple times is that a single positioning attempt carries the risk of the time information transmitted from the information terminal 100G to the action control device 200G being tampered with, for example, by a ghost peak attack. By repeating the process multiple times, the action control device 200G can observe the stability of the time information sent from the information terminal 100G and confirm its security.

[0175] This section describes the secure positioning operation of Loop 2 in the information terminal 100G. First, the application unit 104 requests time information from the UWB communication unit 101.

[0176] Next, the UWB communication unit 101 performs UWB communication using KeyA with multiple anchors that constitute the action control device 200G, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and acquires MAC-equipped time information for positioning calculations. Then, the UWB communication unit 101 sends the MAC-equipped time information to the secure element unit 102.

[0177] Next, the secure element unit 102 performs MAC verification using KeyB (the second key) on the MAC-attached time information sent from the UWB communication unit 101, then signs the time information to ensure its integrity, and sends the signed time information to the application unit 104. Next, the application unit 104 transmits the signed time information to the action control device 200G. Here, the signed time information constitutes distance measurement-related information whose integrity has been ensured.

[0178] The action control device 200G verifies the signature of the signed time information transmitted from the information terminal 100G during each of the multiple secure positioning operations of Loop 2, and performs positioning calculations using that time information. The action control device 200G checks the stability of the positioning results over multiple transmissions to confirm their security. Then, the action control device 200G makes an action determination based on the positioning results. In this action determination, the action control device 200G checks whether the distance between the information terminal 100G (UWB communication unit 101) and the action control device 200G has entered a predetermined range, based on the positioning results. If it is confirmed that the distance has entered the predetermined range, the action control device 200G sets the action determination to "OK," while if it is confirmed that the distance has not entered the predetermined range, the action determination to "NG." The action control device 200G performs action control based on the action determination result.

[0179] Figure 16 shows a sequence diagram. (1) The UWB communication unit 101 of the information terminal 100G sends a request for KeyA (first key) to the secure element unit 102 for creating the STS among the UWB session keys. (2) Next, the secure element unit 102 of the information terminal 100G generates KeyA (first key) and KeyB (second key) for decoding time information as the UWB session key. (3) Then, the secure element unit 102 sets KeyA to the UWB communication unit 101.

[0180] Next, the information terminal 100G starts the insecure positioning operation of Loop 1. (4) The UWB communication unit 101 of the information terminal 100G performs UWB communication using KeyA with multiple anchors that constitute the action control device 200G, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains MAC-attached time information. (5) Next, the UWB communication unit 101 of the information terminal 100G interprets the MAC-attached time information and sends the time information (unsigned time information) to the application unit 104.

[0181] (6) Next, the application unit 104 of the information terminal 100G performs positioning calculations based on the time information sent from the UWB communication unit 101 and makes an action determination based on the positioning result. If the action determination is not "OK", the information terminal 100G repeats the non-secure positioning operation of Loop 1. (7) If the action determination is "OK", the information terminal 100G exits the non-secure positioning operation of Loop 1 and (8) starts the secure positioning operation of Loop 2.

[0182] (9) Next, the application unit 104 of the information terminal 100G sends a request for time information to the UWB communication unit 101.

[0183] (10) Next, the UWB communication unit 101 of the information terminal 100G performs UWB communication using KeyA with multiple anchors constituting the action control device 200G, receives UWB signals for the DL-TDoA ranging method from the multiple anchors, and obtains MAC-equipped time information. (11) Next, the UWB communication unit 101 of the information terminal 100G sends the MAC-equipped time information to the secure element unit 102.

[0184] (12) Next, the secure element unit 102 of the information terminal 100G performs MAC verification on the MAC-attached time information using KeyB (second key), and then (13) signs the MAC-verified time information. (14) Next, the secure element unit 102 of the information terminal 100G sends the signed time information to the application unit 104. (15) Next, the application unit 104 transmits the signed time information to the action control device 200G. Here, the signed time information constitutes distance measurement-related information whose integrity is guaranteed.

[0185] (16) The action control device 200G verifies the signature in the signed time information sent from the information terminal 100G, and then (17) performs positioning calculations using the time information.

[0186] (18) If the secure positioning operation of Loop 2 described above is performed multiple times, the secure positioning operation of Loop 2 is exited. (19) The action control device 200G then checks the stability of the positioning results obtained from the multiple secure positioning operations of Loop 2, confirms their safety, makes an action decision based on the positioning results, and performs action control based on the action decision result.

[0187] In the information processing system 10G shown in Figure 15(a), the information terminal 100G performs MAC verification on the MAC-attached time information acquired by the UWB communication unit 101 in the secure positioning operation of Loop 2 using the secure element unit 102. Furthermore, after signing the MAC-verified time information with the secure element unit 102, it transmits the signed time information to the action control device 200G via the application unit 104, which has a lower security level. Therefore, when the information terminal 100G obtains time information and when it transmits that time information from the information terminal 100G to the action control device 200G, it is possible to suppress the tampering of the time information as distance measurement-related information transmitted from the information terminal 100G to the action control device 200G, and it is possible to effectively prevent tampering of the time information.

[0188] In the information processing system 10B shown in Figure 5(a) above, KeyB (second key) for decrypting the time information generated by the secure element unit 102 is set in the UWB communication unit 101. The UWB communication unit 101 decrypts the encrypted time information and sends the decrypted time information to the secure element unit 102 for signing. In the information processing system 10G shown in Figure 15(a), the MAC-attached time information obtained by the UWB communication unit 101 is sent to the secure element unit 102, which has a higher security level than the UWB communication unit 101. The secure element unit 102 performs MAC verification and signs the MAC-verified time information, making it possible to more strongly prevent tampering with the time information.

[0189] Furthermore, in the information processing system 10G shown in Figure 15(a), the information terminal 100G starts the secure positioning operation of Loop 2 when the action determination in the non-secure positioning operation of Loop 1 is "OK". Therefore, the processing load on the secure element unit 102, which performs MAC verification of MAC-attached time information and further signs the MAC-verified time information, can be reduced during the secure positioning operation of Loop 2.

[0190] Furthermore, in the information processing system 10G shown in Figure 15(a), the information terminal 100G repeats the secure positioning operation of Loop 2 multiple times. Therefore, it becomes possible to check whether the time information transmitted from the information terminal 100G to the action control device 200G has been tampered with, for example, by a ghost peak attack, by observing the stability of the content of multiple positioning results.

[0191] The information processing system 10F shown in Figure 13(a) and the information processing system 10G shown in Figure 15(a) correspond to the information processing system 10B shown in Figure 5(a) described above. However, the information processing systems 10A shown in Figure 3(a), 10C shown in Figure 7(a), 10D shown in Figure 9(a), and 10E shown in Figure 11(a) described above can be configured similarly.

[0192] Although a detailed explanation is omitted, in this case, encrypted time information or time information with MAC address is sent from the UWB communication unit 101 to the secure element unit 102 or TEE unit 103, etc., which have a higher security level than the UWB communication unit 101. There, decryption or MAC verification is performed, and the obtained time information, as well as positioning results and action determination results based on that time information, are sent to the action control device with a signature or via a secure channel.

[0193] Furthermore, the above-mentioned specific examples show just one example of a combination of a method for ensuring the integrity of distance measurement-related information, a location for ensuring the integrity of distance measurement-related information, a type of distance measurement-related information, a location for performing positioning calculations, and a location for performing action determinations. The combinations are not limited to these, and other combinations can easily be considered. In that case, for example, a method for ensuring the integrity of distance measurement-related information can be selected from a method of signing and a method of establishing a secure channel; a location for ensuring the integrity of distance measurement-related information can be selected from the UWB communication unit 101, the secure element unit 102, and the TEE unit 103; a type of distance measurement-related information can be selected from time information, positioning results, and action determination results; a location for performing positioning calculations can be selected from the UWB communication unit 101, the secure element unit 102, the TEE unit 103, and the action control device; and a location for performing action determinations can be selected from the UWB communication unit 101, the secure element unit 102, the TEE unit 103, and the action control device. However, there may be further options for each of these.

[0194] "1-3. Application Example (Security Gate System)" Figure 17 shows an example configuration of a security (flapper) gate system 20 as an application example of this technology. This security gate system 20 has an information terminal (mobile) 500 and a door device 600. UWB communication is possible between the information terminal 500 and the door device 600, and other communications other than UWB communication are possible as needed, such as BLE (Bluetooth Low Energy) communication, Wi-Fi communication, LTE (Long Term Evolution) communication, etc.

[0195] The door device 600 includes multiple anchors that send UWB (Ultra-Wide Band) signals for the DL-TDoA ranging method to the information terminal 500, and controls the door unlocking action based on the integrity-guaranteed distance measurement-related information sent from the information terminal 500. The transmission of integrity-guaranteed distance measurement-related information from the information terminal 500 to the door device 600 is performed by UWB communication or other communication methods.

[0196] Information terminal 500 corresponds to the information terminals 100, 100A to 100G described above. Figure 18 shows an example configuration of information terminal 500. Information terminal 500 includes a control unit 501, a storage unit 502, a memory unit 503, an input unit 504, an output unit 505, a secure element unit 506, an NFC (Near Field Communication) communication unit 507, an UWB (Ultra-Wide Band) communication unit 508, and a network communication unit 509. The control unit 501 includes a TEE (Trusted Execution Environment) unit 510. Furthermore, the control unit 501 executes various applications, and in this sense, the control unit 501 also constitutes the application unit.

[0197] Here, the UWB communication unit 508 corresponds to the UWB communication unit 101 in the above-mentioned information terminals 100, 100A to 100G, the secure element unit 506 corresponds to the secure element unit 102 in the above-mentioned information terminals 100, 100A to 100G, the TEE unit 510 included in the control unit 501 corresponds to the TEE unit 103 in the above-mentioned information terminals 100, 100A to 100G, and the application unit configured in the control unit 501 corresponds to the application unit 104 in the above-mentioned information terminals 100, 100A to 100G.

[0198] The door device 600 corresponds to the action control devices 200, 200A to 200G described above. Figure 19 shows an example of the configuration of the door device 600. The door device 600 includes a plurality of anchor devices (anchors) 601-1 to 601-N that transmit UWB signals for the DL-TDoA ranging method to the information terminal 500, a control device 602 that controls the entire door device 600, and a door 603 whose opening and closing is controlled by the control device 602.

[0199] Each of the anchor devices (anchors) 601-1 to 601-N includes a UWB communication unit. The control device 602 also includes a communication unit and receives distance measurement-related information (time information for positioning calculation, positioning result, action determination result based on the positioning result, etc.) transmitted from the information terminal 500 with integrity guaranteed, and controls the action based on this distance measurement-related information, i.e., controls the opening and closing of the door 603. Here, when the distance measurement-related information is time information, the control device 602 uses that time information to perform positioning calculations and makes an action determination based on the positioning result. Also, when the distance measurement-related information is a positioning result, the control device 602 makes an action determination based on that positioning result.

[0200] Figure 20 shows an example of the screen display of the information terminal 500 at various locations of a user 300 carrying the information terminal 500, and the opening and closing timing of the door 603. For example, at a first location P1 sufficiently far from the door device 600 (door 603), the user 300 performs a start operation on the information terminal 500 to open the door. This causes the information terminal 500 to start the operation to open the door. At this time, the information terminal 500 displays, for example, "start". Note that this operation to open the door may be started automatically when the information terminal 500 enters a predetermined range from the door device 600 and the information terminal 500 receives a predetermined signal from the door device 600 or other devices.

[0201] When the information terminal 500 starts the operation to open the door, it first enters a state in which it repeatedly performs the non-secure positioning operation of Loop 1 described above. While the non-secure operation of Loop 1 is being repeatedly performed, the information terminal 500 displays an indication of this state, as shown by the second position P2.

[0202] As Loop 1 is repeatedly executed, the user 300 approaches the door device 600 (door 603). At the third position P3, where the user is within the door opening distance, the information terminal 500 exits the insecure operation of Loop 1 and repeatedly executes the secure positioning operation of Loop 2 described above. The information terminal 500 then displays an indication of this state.

[0203] Then, after the secure positioning operation of Loop 2 is performed multiple times, the user 300 moves even closer to the door device 600 (door 603), as shown in the fourth position P4. The door device 600 makes a decision on whether to open the door based on the distance measurement-related information, which is guaranteed to be complete and sent from the information terminal 500 during the multiple executions of the secure positioning operation of Loop 2. When it determines that the user 300 (information terminal 500) is indeed within door opening distance, it performs action control to open the door 603. At this time, the information terminal 500 displays, for example, an indication that the door is unlocked.

[0204] <2. Modified Examples> In the above-described embodiment, an example was shown in which distance measurement-related information with guaranteed integrity is transmitted from the information terminal to the action control device using the DL-TDoA ranging method. However, this technology can be similarly applied when transmitting distance measurement-related information from the information terminal to the action control device using other ranging methods, such as the TWR (Two Way Ranging) ranging method.

[0205] Furthermore, while preferred embodiments of this disclosure have been described in detail with reference to the accompanying drawings, the technical scope of this disclosure is not limited to such examples. It is clear to any person with ordinary skill in the art of this disclosure that various modifications or alterations may be conceived within the scope of the technical idea set forth in the claims, and these too will naturally fall within the technical scope of this disclosure.

[0206] Furthermore, the effects described herein are merely descriptive or illustrative and not limiting. In other words, the technology relating to this disclosure may produce other effects that are obvious to those skilled in the art from the description herein, in addition to or instead of the effects described herein.

[0207] Furthermore, this technology can also take the following configurations: (1) An information processing device comprising: an information creation unit that obtains distance measurement-related information based on a UWB signal obtained through UWB communication with an external device and ensures the integrity of the distance measurement-related information; and a transmission unit that transmits the distance measurement-related information whose integrity has been ensured to the external device, wherein the information creation unit has a security level equal to or higher than that of the UWB communication unit that performs the UWB communication. (2) The information processing device according to (1), wherein the information creation unit ensures the integrity of the distance measurement-related information by adding a signature to the created distance measurement-related information. (3) The information processing device according to claim 1, wherein the information creation unit ensures the integrity of the distance measurement-related information by establishing a secure channel for transmitting the created distance measurement-related information to the external device. (4) The information processing device according to any one of (1) to (3), wherein the distance measurement-related information includes time information for performing positioning calculations. (5) The information processing device according to any one of (1) to (3), wherein the distance measurement-related information includes positioning results obtained from positioning calculations. (6) The distance measurement-related information is an information processing device according to any one of (1) to (3) above, including an action determination result determined based on the positioning result. (7) The information creation unit is an information processing device according to any one of (1) to (6) above, including the UWB communication unit. (8) The information creation unit is an information processing device according to any one of (1) to (6) above, including a secure element unit that transmits a key for secure ranging to the UWB communication unit. (9) The information creation unit is an information processing device according to any one of (1) to (6) above, including a TEE unit included in the control unit. (10) The information creation unit is a secure element unit, the secure element unit transmits a first key for creating an STS to the UWB communication unit, and performs decryption processing on encrypted time information sent from the UWB communication unit using a second key.(11) The information processing device according to any one of (1) to (6), wherein the information creation unit is a secure element unit, the secure element unit transmits a first key to the UWB communication unit for creating an STS, and performs MAC verification processing on MAC-attached time information sent from the UWB communication unit using a second key. (12) The information processing device according to any one of (1) to (11), wherein the UWB signal includes a UWB signal for a DL-TDoA ranging method. (13) The information processing device according to any one of (1) to (12), wherein the external device includes an action control device that controls a predetermined action based on the distance measurement-related information. (14) The information processing device according to any one of (1) to (13), wherein when the distance between the external device and the UWB communication unit is within a predetermined range, the information creation unit creates the distance measurement-related information, ensures the integrity of the distance measurement-related information, and the transmission unit transmits the distance measurement-related information whose integrity has been ensured to the external device. (15) The information processing apparatus according to (14), wherein when the distance between the external device and the UWB communication unit falls within a predetermined range, the process of transmitting the distance measurement-related information whose integrity has been guaranteed to the external device is repeated multiple times. (16) An information processing method comprising: an information creation unit obtaining distance measurement-related information based on a UWB signal obtained through UWB communication with an external device and ensuring the integrity of the distance measurement-related information; and a transmission unit transmitting the distance measurement-related information whose integrity has been guaranteed to the external device, wherein the information creation unit has a security level equal to or higher than that of the UWB communication unit that performs the UWB communication. (17) An information processing system comprising an information terminal and an action control device, wherein the information terminal comprises an information creation unit that obtains distance measurement-related information based on a UWB signal obtained through UWB communication with the action control device and ensures the integrity of the distance measurement-related information; and a transmission unit that transmits the distance measurement-related information whose integrity has been guaranteed to the action control device, wherein the information creation unit has a security level equal to or higher than that of the UWB communication unit that performs the UWB communication.(18) The information processing system according to (17), wherein the action control device confirms that the information terminal is located within a predetermined range based on the distance measurement-related information sent from the information terminal whose integrity is guaranteed, and controls the system so that a predetermined action is performed.

[0208] 10, 10A-10G... Information processing system 20... Security gate system 100, 100A-100G... Information terminal 101... UWB communication unit 102... Secure element unit 103... TEE unit 104... Application unit 200, 200A-200G... Action control unit 300... User 500... Information terminal 501... Control unit 502... Storage unit 503... Memory unit 504... Input unit 505... Output unit 506... Secure element unit 507... NFC communication unit 508... UWB communication unit 509... Network communication unit 510... TEE unit 600... Door device 601-1-601-N... Anchor device (anchor) 602... Control unit 603... Door< / ese> < / ese> < / uwbs> < / ese> < / tee> < / ese> < / ese> < / ese> < / ese> < / uwbs> < / ese> < / tee> < / ese> < / ese> < / ese> < / ese> < / uwbs> < / ese> < / tee> < / ese> < / ese>

Claims

1. An information processing device comprising: an information creation unit that obtains distance measurement-related information based on UWB signals obtained through UWB communication with an external device and ensures the integrity of said distance measurement-related information; and a transmission unit that transmits the distance measurement-related information whose integrity has been ensured to the external device, wherein the information creation unit has a security level equal to or higher than that of the UWB communication unit that performs the UWB communication.

2. The information processing device according to claim 1, wherein the information creation unit ensures the integrity of the distance measurement-related information by adding a signature to the distance measurement-related information created.

3. The information processing apparatus according to claim 1, wherein the information creation unit ensures the integrity of the distance measurement-related information by establishing a secure channel for transmitting the created distance measurement-related information to the external device.

4. The information processing device according to claim 1, wherein the distance measurement-related information includes time information for performing positioning calculations.

5. The information processing device according to claim 1, wherein the distance measurement-related information includes the positioning result obtained by the positioning calculation.

6. The information processing device according to claim 1, wherein the distance measurement-related information includes an action determination result determined based on the positioning result.

7. The information processing apparatus according to claim 1, wherein the information creation unit includes the UWB communication unit.

8. The information processing apparatus according to claim 1, wherein the information creation unit includes a secure element unit that transmits a key for secure ranging to the UWB communication unit.

9. The information processing apparatus according to claim 1, wherein the information creation unit includes a TEE unit included in the control unit.

10. The information processing apparatus according to claim 1, wherein the information creation unit is a secure element unit, the secure element unit transmits a first key for creating an STS to the UWB communication unit, and performs decryption processing on encrypted time information sent from the UWB communication unit using a second key.

11. The information processing apparatus according to claim 1, wherein the information creation unit is a secure element unit, the secure element unit transmits a first key for creating an STS to the UWB communication unit, and performs MAC verification processing on MAC-equipped time information sent from the UWB communication unit using a second key.

12. The information processing apparatus according to claim 1, wherein the UWB signal includes a UWB signal for a DL-TDoA ranging method.

13. The information processing apparatus according to claim 1, wherein the external device includes an action control device that controls a predetermined action based on the distance measurement-related information.

14. The information processing apparatus according to claim 1, wherein when the distance between the external device and the UWB communication unit falls within a predetermined range, the information creation unit creates the distance measurement-related information, ensures the integrity of the distance measurement-related information, and the transmission unit transmits the distance measurement-related information whose integrity has been ensured to the external device.

15. The information processing apparatus according to claim 14, which repeatedly transmits the distance measurement-related information, whose integrity is guaranteed, to the external device multiple times when the distance between the external device and the UWB communication unit falls within a predetermined range.

16. An information processing method comprising: an information creation unit obtaining distance measurement-related information based on UWB signals obtained through UWB communication with an external device, and a procedure for ensuring the integrity of said distance measurement-related information; and a transmission unit transmitting the distance measurement-related information whose integrity has been ensured to the external device, wherein the information creation unit has a security level equal to or higher than that of a UWB communication unit performing said UWB communication.

17. An information processing system comprising an information terminal and an action control device, wherein the information terminal comprises an information creation unit that obtains distance measurement-related information based on UWB signals obtained through UWB communication with the action control device and ensures the integrity of said distance measurement-related information, and a transmission unit that transmits the distance measurement-related information whose integrity has been ensured to the action control device, and the information creation unit has a security level equal to or higher than that of the UWB communication unit that performs the UWB communication.

18. The information processing system according to claim 17, wherein the action control device confirms that the information terminal is located within a predetermined range based on the distance measurement-related information sent from the information terminal whose integrity is guaranteed, and controls the system to perform a predetermined action.

Images