Nothing Special   »   [go: up one dir, main page]

WO2021059491A1 - Information processing system, information processing method, and program - Google Patents

Information processing system, information processing method, and program Download PDF

Info

Publication number
WO2021059491A1
WO2021059491A1 PCT/JP2019/038174 JP2019038174W WO2021059491A1 WO 2021059491 A1 WO2021059491 A1 WO 2021059491A1 JP 2019038174 W JP2019038174 W JP 2019038174W WO 2021059491 A1 WO2021059491 A1 WO 2021059491A1
Authority
WO
WIPO (PCT)
Prior art keywords
information processing
distributed file
unit
processing device
authentication
Prior art date
Application number
PCT/JP2019/038174
Other languages
French (fr)
Japanese (ja)
Inventor
雄介 道場
清 友村
昌敏 竹谷
Original Assignee
エアトラスト株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by エアトラスト株式会社 filed Critical エアトラスト株式会社
Priority to JP2020505519A priority Critical patent/JP6829341B1/en
Priority to PCT/JP2019/038174 priority patent/WO2021059491A1/en
Publication of WO2021059491A1 publication Critical patent/WO2021059491A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
    • G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
    • G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present invention relates to an information processing system, an information processing method, and a program.
  • a user logs in in order to make an information processing device or an application available to the user.
  • login authentication is performed to authenticate that the user is a legitimate user.
  • an individual ID assigned to the mobile terminal is registered in the server and transmitted from the mobile terminal in the server.
  • a login authentication system that performs login authentication by matching the individual ID with the individual ID registered in the server.
  • the present invention has been made to solve the above problems, and an object of the present invention is to provide an information processing system capable of more secure login authentication.
  • the present invention is an information processing system, in which a distribution unit that distributes authentication information into a first distributed file and a second distributed file by a secret sharing method, and the first distributed file are the first.
  • the first storage unit that stores in the information processing device, the second storage unit that stores the second distributed file in the second information processing device, and the user of the second information processing device are legitimate users.
  • the first information processing device and the second information processing device only when the user authentication unit that authenticates the user and the user authentication unit authenticates that the user of the second information processing device is a legitimate user.
  • a communication unit that connects the device by short-range wireless communication, a transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and the communication unit.
  • the authentication information is used by a receiving unit that receives the second distributed file from the second information processing device, the first distributed file stored in the first storage unit, and the second distributed file received by the receiving unit. It is characterized by having a restoration unit for restoring the information processing unit and a login authentication unit for performing login authentication of the first information processing apparatus using the authentication information restored by the restoration unit.
  • FIG. 1 is a block diagram showing a configuration of an information processing system according to an embodiment of the present invention.
  • the information processing system 1 of FIG. 1 includes a server 2, a PC 4, and a smartphone 5.
  • PC is an abbreviation for Personal Computer.
  • the server 2, the PC 4, and the smartphone 5 are connected to the network 3 and can communicate with each other.
  • the PC 4 and the smartphone 5 can communicate with each other by short-range wireless communication 6 (in this embodiment, Bluetooth (registered trademark) is used.
  • Bluetooth may be referred to as Bluetooth).
  • the short-range wireless communication 6 is a communication limited to a short distance with a wireless reach of about several meters.
  • Each of the server 2, the PC 4, and the smartphone 5 may be any other information processing device.
  • the smartphone 5 is a device that can be carried by the user.
  • the network 3 may be any network such as the Internet, wired, and wireless.
  • the PC 4 and the smartphone 5 communicate with each other by Bluetooth short-range wireless communication 6, but the present invention is not limited to this, and the PC 4 and the smartphone 5 are any other short-range wireless communication technology. May be those that communicate with each other.
  • the information processing system 1 a plurality of each of the server 2, the PC 4, and the smartphone 5 may be provided.
  • the information processing system 1 may have a configuration in which a plurality of PCs 4 are provided for one server 2, or a configuration in which a plurality of smartphones 5 are provided for one PC4.
  • FIG. 2 is a block diagram showing a configuration of an information processing device according to an embodiment of the present invention.
  • the information processing device 10 of FIG. 2 is an example of the configuration of the server 2, the PC 4, and the smartphone 5 shown in FIG.
  • Each of the server 2, the PC 4, and the smartphone 5 may have all the configurations of the information processing device 10 of FIG. 2, a partial configuration, and other than those shown in FIG. It may have a configuration.
  • the information processing device 10 has a CPU 11, a RAM 12, and a ROM 13.
  • the CPU 11 executes a program stored in the ROM 13 or a program such as an OS (operating system) or an application loaded in the RAM 12 from the external memory when the external device 17 is an external memory.
  • CPU is an abbreviation for Central Processing Unit.
  • ROM is an abbreviation for Read Only Memory.
  • RAM is an abbreviation for Random Access Memory.
  • the CPU 11 functions as each processing unit that executes each process described later by executing a program stored in a readable storage medium such as a ROM 13 or a RAM 12.
  • the RAM 12 is the main memory of the CPU 11 and functions as a work area or the like.
  • the information processing device 10 has an internal bus 20. Each of the CPU 11, the RAM 12, and the ROM 13 is connected to the internal bus 20. Each configuration connected to the internal bus 20 can communicate with each other via the internal bus 20.
  • the information processing device 10 has an input / output controller 14 and an input / output device 15.
  • the input / output controller 14 controls the input / output device 15.
  • the input controller 14 is connected to the internal bus 20.
  • the input / output device 15 is, for example, a keyboard, a pointing device (mouse, touch pad, touch panel, trackball, etc.), a display, or the like.
  • the information processing device 10 has a device controller 16 and an external device 17.
  • the device controller 16 controls the external device 17.
  • the device controller 16 is connected to the internal bus 20.
  • the external device 17 is various devices such as an external memory, an external microphone, an external speaker, and an external camera.
  • the information processing device 10 has a network interface 18.
  • the network interface 18 is connected to the network 3 and executes a communication control process with another device connected to the network 3.
  • the network interface 18 is connected to the internal bus 20.
  • the information processing device 10 has a Bluetooth interface 19.
  • the Bluetooth interface 19 executes a communication control process with another device by the short-range wireless communication 6.
  • the Bluetooth interface 18 is connected to the internal bus 20.
  • FIG. 3 is a block diagram showing a functional configuration of an information processing system according to an embodiment of the present invention.
  • each functional block represents a mass of programs processed by the CPU 111 mounted as hardware.
  • the smartphone 5 has a validity confirmation unit 501.
  • the effectiveness confirmation unit 501 confirms the effectiveness of the smartphone 5 and the effectiveness of the user. Specifically, the validity confirmation unit 501 executes the following pre-processing and validity confirmation processing.
  • Pre-processing The user registers the smartphone information (device information such as IMEI), which is the information of the smartphone 5, together with the user information in the server 2 at the time of activation at the time of initial registration of the service related to the information processing system 1.
  • IMEI is an abbreviation for International Mobile Equipment Identity.
  • the validity confirmation unit 501 transmits user information and smartphone information (information input by the user from the input / output device 15 and information stored in the ROM 13) to the server 2 via the network 3.
  • the server 2 that has received this information registers the received information in the management DB 202.
  • DB is an abbreviation for database.
  • the user operates the input / output device 15 of the smartphone 5 that has been preprocessed to start the application related to the information processing system 1 on the smartphone 5.
  • the authentication unit 504 executes the personal authentication of the user who operates the smartphone 5.
  • the personal authentication for example, biometric authentication of the smartphone 5 main body
  • the validity confirmation unit 501 sends the smartphone information and the user information to the server 2.
  • the server 2 collates the information transmitted from the smartphone 5 with the information registered in the management DB 202 at the time of initial registration of the preprocessing.
  • the server 2 returns OK to the smartphone 5 if the information transmitted from the smartphone 5 and the information registered in the management DB 202 match, and if they do not match, the smartphone 5 returns OK. NG will be returned to.
  • the validity confirmation unit 501 assumes that the validity is confirmed when OK is received, and that the validity is not confirmed when NG is received.
  • the smartphone 5 has a distributed file 502.
  • the distributed file 502 is a distributed file on the smartphone 5 side.
  • the smartphone 5 has an authentication unit 504.
  • the authentication unit 504 executes biometric authentication such as fingerprint, iris, face authentication, and vein.
  • the authentication unit 504 may have, for example, a GPS receiver to acquire the position information of the current position of the smartphone 5 and execute a process of authenticating when the current position of the smartphone 5 is a predetermined position. Good.
  • the authentication unit 504 may have a means for accepting permission from, for example, an administrator (for example, a boss), and may execute a process of authenticating when the administrator permits.
  • the authentication unit 504 may execute a process of authenticating when the one-time password issued each time is correctly input.
  • the authentication unit 504 may execute a process for authentication by any combination of a plurality of the above authentication processes.
  • the smartphone 5 has a switch control unit 505.
  • the switch control unit 505 turns on / off the Bluetooth connection with the PC 4 from the smartphone 5.
  • the input / output device 15 of the smartphone 5 displays a screen for accepting an input for switching on / off of the Bluetooth connection.
  • the switch control unit 505 switches the Bluetooth connection on / off according to the user's input on this screen. That is, according to the switch control unit 505, the user can manually switch the Bluetooth connection on / off regardless of the distance between the smartphone 5 and the PC 4.
  • the smartphone 5 has a Bluetooth control unit 506.
  • the Bluetooth control unit 506 communicates with the PC 4 by short-range wireless communication 6 when the Bluetooth connection is turned on by the switch control unit 505.
  • the smartphone 5 has an input / output control unit 503.
  • the input / output control unit 503 saves the distributed file on the smartphone 5 side received from the PC 4 in advance as the distributed file 502, and at the time of login authentication, which will be described in detail later, transfers the distributed file 502 to the PC 4 via the short-range wireless communication 6.
  • the distributed file may be received from the PC 4 in advance via the network 3 or the short-range wireless communication 6.
  • the PC4 has a distance measuring unit 401.
  • the distance measuring unit 401 measures the distance between the PC 4 and the smartphone 5.
  • the user can log in to the PC 4 when the distance between the PC 4 and the smartphone 5 is a predetermined distance (for example, 1 m) or less. That is, in the present embodiment, the determination of connection / disconnection between the PC 4 and the smartphone 5 is that the distance between the PC 4 and the smartphone 5 is a predetermined distance (for example, 1 m).
  • the distance between the PC 4 and the smartphone 5 is less than or equal to a predetermined distance (for example, 1 m), the PC 4 and the smartphone 5 are connected, and if the distance exceeds the predetermined distance (for example, 1 m), the PC 4 and the smartphone 5 are connected. Disconnect.
  • the distance between the PC 4 and the smartphone 5 is measured on the PC 4 side, but the present invention is not limited to this, and the distance between the PC 4 and the smartphone 5 can be measured on the smartphone 5 side. Good.
  • the distance measuring unit 401 measures the distance between the PC 4 and the smartphone 5 by, for example, the radio wave intensity (dBm) of the short-range wireless communication 6.
  • the radio wave intensity (dBm) of the short-range wireless communication 6 is measured, and using this as a reference value, for example, for example. ⁇ If the value exceeds -50 dBm from the standard value, the connection between the PC 4 and the smartphone 5 is disconnected. -If the value is less than -50 dBm from the standard value, the connection between the PC 4 and the smartphone 5 is maintained.
  • the distance measuring unit 401 may poll the radio wave strength when the smartphone 5 is close to the PC 4 (for example, the distance between the antennas is within about 5 cm) and use the radio wave strength as a reference value.
  • the PC4 has a pairing state grasping unit 402.
  • the pairing state grasping unit 402 grasps the pairing state (whether or not the connection is currently being made) of the short-range wireless communication 6.
  • PC4 has a lock control unit 403. If the pairing state is connected and the distance to the smartphone 5 is less than a predetermined distance (for example, 1 m), the lock control unit 403 unlocks the PC 4 to make it available, and the pairing state is not connected. In the case of, or when the distance to the smartphone 5 exceeds a predetermined distance (for example, 1 m), the PC 4 is locked to make it unusable.
  • a predetermined distance for example, 1 m
  • the PC4 has authentication information 408.
  • the authentication information 408 is authentication information for a user carrying the smartphone 5 to log in to the PC 4.
  • the PC4 has a distributed processing unit 407.
  • the distribution processing unit 407 performs concealment processing in the secret sharing technology.
  • the concealment process is a process of distributing target data.
  • any method of known secret sharing technology may be used.
  • the original data is dispersed into n dispersion pieces by threshold dispersion, and the original k (n> k) dispersion pieces of the n pieces are used.
  • the data may be recoverable.
  • the original data is dispersed into n dispersion pieces by AONT (All or Nothing Transfer), and the original data can be restored by using all n dispersion pieces. It may be a thing.
  • the PC 4 has the setting information 409.
  • the setting information 409 includes, for example, the following information.
  • Information on the save destination for saving the distributed file which is a distributed piece, after the secret sharing process by the distributed processing unit 407 (storage location (directory / folder) on the PC4 side, and storage location (directory / folder) on the smartphone 5 side).
  • (2) Connection information of server 2 URL (Uniform Resource Locator), port number, etc.)
  • Connection information with smartphone 5 by short-range wireless communication 6 (device information of smartphone 5, link key, etc.)
  • the PC4 has a distributed file 404.
  • the distributed file 404 is a distributed file on the PC4 side.
  • the distributed processing unit 407 distributes the authentication information 408 and acquires the distributed file on the smartphone 5 side and the distributed file on the PC 4 side.
  • the distributed file on the smartphone 5 side and the distributed file on the PC 4 side are different files.
  • the distributed file on the smartphone 5 side is saved as the distributed file 502, and the distributed file on the PC4 side is saved as the distributed file 404.
  • the PC4 has a Bluetooth control unit 406.
  • the Bluetooth control unit 406 communicates with the smartphone 5 by short-range wireless communication 6.
  • PC4 has an input / output control unit 405.
  • the input / output control unit 405 saves the distributed file on the PC4 side acquired by the distributed processing unit 407 in advance as the distributed file 404, and passes the distributed file 404 to the restoration processing unit 410 at the time of login authentication, which will be described in detail later.
  • the PC4 has a restoration processing unit 410.
  • the restoration processing unit 410 executes the restoration processing of the files distributed by the distribution processing unit 407. That is, the distributed processing unit 407 restores the authentication information using the distributed file 502 received from the smartphone 5 and the distributed file 404 obtained from the input / output control unit 405.
  • the PC4 has a login authentication unit 411.
  • the login authentication unit 411 executes login by, for example, a Credentialal Provider using the authentication information restored by the restoration processing unit 410.
  • the PC4 has a log acquisition unit 412.
  • the log acquisition unit 412 records the matters generated in each process as a log. This is recorded, for example, as an event log.
  • the log acquisition unit 412 transmits the recorded log to the server 2 via the network 3.
  • the Server 2 has a log file 203.
  • the log file 203 stores the log received from the PC 4.
  • the server 2 has a management DB 202.
  • the management DB 202 includes the following information. (1) User information (2) Usage status information (3) Log management information (4) Tenant management information (5) Contract information
  • the server 2 has a control unit 201.
  • the control unit 201 executes the following processing. (1) Processing for user information of management DB 202 (registration, update, deletion, reference, etc.) (2) Processing for usage status information of management DB 202 (search, reference, etc.) (3) Processing (search, reference, etc.) for log management information in the management DB 202 (4) Processing for tenant management information of management DB 202 (registration, update, deletion, reference, etc.) (5) Processing for contract information of management DB 202 (registration, update, deletion, reference, etc.)
  • FIG. 4 is a flowchart showing an example of the distributed file storage process of the information processing system according to the embodiment of the present invention.
  • the information processing system 1 performs user registration. Specifically, the user inputs user information through the input / output device 15 of the smartphone 5 and the input / output device 15 of the PC 4.
  • the PC 4 that has received the input of the user information creates the authentication information associated with the input user information and saves it as the authentication information 408. Further, the PC 4 that has received the input of the user information saves the input user information in the setting information 409. Further, the PC 4 that has received the input of the user information transmits the input user information to the server 2.
  • the server 2 that has received the user information from the PC 4 stores the received user information in the management DB 202.
  • step S4002 the information processing system 1 distributes the authentication information stored in the authentication information 408 in step S4001 by the distributed processing unit 407, and acquires the distributed file on the smartphone 5 side and the distributed file on the PC4 side.
  • the PC4 saves the distributed file on the PC4 side as the distributed file 404.
  • step S4003 the information processing system 1 executes pairing of the short-range wireless communication 6 of the smartphone 5 and the PC 4.
  • a link key is generated by this pairing, and the smartphone 5 and the PC 4 perform encrypted communication using this link key.
  • step S4004 the information processing system 1 transmits the distributed file on the smartphone 5 side from the PC 4 to the smartphone 5 via the short-range wireless communication 6 paired in step S4001.
  • the smartphone 5 that has received the distributed file on the smartphone 5 side saves the distributed file on the smartphone 5 side as the distributed file 502.
  • FIG. 5 is a schematic diagram illustrating the operation of the information processing system 1 according to the first embodiment of the present invention.
  • FIG. 6 is a flowchart showing the process of the first embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
  • step S6001 of FIG. 6 the information processing system 1 executes the personal authentication process. Specifically, the authentication unit 504 of the smartphone 5 authenticates whether or not a legitimate user is operating the smartphone 5 by using fingerprint information, iris information, face information, etc. registered in advance. If the authentication unit 504 succeeds in authentication, the switch control unit 505 allows the use of the short-range wireless communication 6, and the process proceeds to step S6002. If the authentication unit 504 fails to authenticate, the switch control unit 505 rejects the use of the short-range wireless communication 6, and ends the process of FIG.
  • the authentication unit 504 of the smartphone 5 authenticates whether or not a legitimate user is operating the smartphone 5 by using fingerprint information, iris information, face information, etc. registered in advance. If the authentication unit 504 succeeds in authentication, the switch control unit 505 allows the use of the short-range wireless communication 6, and the process proceeds to step S6002. If the authentication unit 504 fails to authenticate, the switch control unit 505 rejects the use of the short-range wireless communication 6, and ends the process of FIG.
  • step S6002 of FIG. 6 the information processing system 1 executes the device authentication process. Specifically, the Bluetooth connection unit 506 of the smartphone 5 attempts to connect to the Bluetooth connection unit 406 of the PC 4 by short-range wireless communication 6. If the information processing system 1 succeeds in this connection, it is assumed that the device authentication is successful, and if this connection fails, it is assumed that the device authentication fails. If the device authentication is successful, the process proceeds to step S6003. If the device authentication fails, the process shown in FIG. 6 ends.
  • step S6003 of FIG. 6 the information processing system 1 executes a login authentication process.
  • the login authentication unit 411 executes authentication based on the authentication information obtained by restoring the distributed file.
  • the distributed file on the smartphone 5 side is read from the distributed file 502 and transmitted to the PC 4 via the short-range wireless communication 6.
  • the restoration processing unit 410 executes a restoration process using the distributed file on the smartphone 5 side received from the smartphone 5 and the distributed file on the PC4 side read from the distributed file 404 to obtain authentication information.
  • the login authentication unit 411 executes authentication based on the authentication information obtained by the restoration processing unit 410. If the login authentication unit 411 succeeds in authentication, the user is logged in to the PC4. If the login authentication unit 411 fails to authenticate, the user refuses to log in to the PC4.
  • the information processing system 1 has the lock control unit 403. This may lock the PC4 so that it cannot be used.
  • FIG. 7 is a schematic diagram illustrating the operation of the information processing system 1 according to the second embodiment of the present invention.
  • FIG. 8 is a flowchart showing the process of the second embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
  • the same user carries the smartphone 5 and logs in to the PC 4, and the same user carries the smartphone 7, which is a smartphone different from the smartphone 5, and logs in to the PC 4. It is an example which executes a different process with respect to.
  • step S8001 of FIG. 8 the information processing system 1 executes the authentication process. Specifically, the authentication unit of the smartphone 7 (corresponding to the authentication unit 504 of the smartphone 5) authenticates whether a legitimate user is operating the smartphone 7 by using fingerprint information, iris information, face information, etc. registered in advance. To do. At this time, the authentication unit of the smartphone 7 determines whether the user can use the user without limitation or can use the smartphone with restrictions. If the user is a user who can use the information processing system 1 without limitation, the information processing system 1 subsequently executes the same processing as in steps S6002 and S6003 of FIG. 6 to end the processing.
  • the information processing system 1 imposes predetermined restrictions on the user unless the user can use the user without restrictions.
  • the information processing system 1 detects the current position by the GPS receiver provided in the smartphone 7, and if it is a predetermined location (for example, a company or home), the process proceeds to step S8002 as authentication is successful.
  • the information processing system 1 provides a means for inputting the approval of the boss of the user operating the smartphone 7, and when the boss approval is input, the process proceeds to step S8002 as authentication success.
  • the information processing system 1 issues a one-time password to the user operating the smartphone 7, and when the one-time password is input to the smartphone 7, the process proceeds to step S8002 as authentication is successful. If the authentication fails, the process shown in FIG. 8 ends.
  • step S8002 is a process corresponding to step S6002 in FIG. 6 and step S8003 is a process corresponding to step S6003 in FIG. 6, description thereof will be omitted.
  • the same file as the distributed file saved in the distributed file 502 of the smartphone 5 is also saved in the distributed file 702 of the smartphone 7, and the distributed file read from the distributed file 702 by the smartphone 7. Is sent to the PC4 to execute login authentication.
  • FIG. 9 is a schematic diagram illustrating the operation of the information processing system 1 according to the third embodiment of the present invention.
  • FIG. 10 is a flowchart showing the process of the third embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
  • the same user carries the smartphone 5 and logs in to the PC 4, and the same user carries the smartphone 8 which is a smartphone different from the smartphone 5 and logs in to the PC 4. It is an example which executes a different process with respect to.
  • step S10001 of FIG. 10 the information processing system 1 executes the authentication process. Specifically, the authentication unit of the smartphone 8 (corresponding to the authentication unit 504 of the smartphone 5) authenticates whether a legitimate user is operating the smartphone 8 by using fingerprint information, iris information, face information, etc. registered in advance. To do. At this time, the authentication unit of the smartphone 8 determines whether the user can be used without limitation or can be used with limitation. If the user is a user who can use the information processing system 1 without limitation, the information processing system 1 subsequently executes the same processing as in steps S6002 and S6003 of FIG. 6 to end the processing.
  • the authentication unit of the smartphone 8 corresponding to the authentication unit 504 of the smartphone 5
  • the authentication unit of the smartphone 8 determines whether the user can be used without limitation or can be used with limitation. If the user is a user who can use the information processing system 1 without limitation, the information processing system 1 subsequently executes the same processing as in steps S6002 and S6003 of FIG. 6 to end the processing.
  • the information processing system 1 proceeds to step S10002 if the user is not a user who can use it without limitation.
  • the distributed file 802 of the smartphone 8 does not store the same file as the distributed file stored in the distributed file 502 of the smartphone 5.
  • the same file as the distributed file saved in the distributed file 502 of the smartphone 5 is saved in the distributed file 802a of the cloud 8a.
  • the smartphone 8 downloads the distributed file stored in the distributed file 802a of the cloud 8a (the same file as the distributed file stored in the distributed file 502 of the smartphone 5) to the distributed file 802 under predetermined restrictions. , Used for subsequent authentication.
  • step S10002 the information processing system 1 detects the current position by the GPS receiver provided in the smartphone 8, and if it is a predetermined location (for example, a company or home), it is saved in the distributed file 802a as authentication success.
  • the distributed file (the same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802.
  • the information processing system 1 provides a means for inputting the approval of the boss of the user operating the smartphone 7, and when the boss approval is input, the authentication is successful and the distributed file stored in the distributed file 802a (The same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802.
  • the information processing system 1 may be limited to one download per approval by the boss.
  • the information processing system 1 issues a one-time password to the user operating the smartphone 7, and when the one-time password is entered in the smartphone 7, the authentication is successful and the file is saved in the distributed file 802a.
  • a certain distributed file (the same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802.
  • the information processing system 1 may consider that the distributed file downloaded to the distributed file 802 is valid only on the same day.
  • step S10002 is a process corresponding to step S6002 in FIG. 6 and step S1003 is a process corresponding to step S6003 in FIG. 6, description thereof will be omitted.
  • step S1003 is a process corresponding to step S6003 in FIG. 6, description thereof will be omitted.
  • the same file as the distributed file saved in the distributed file 502 of the smartphone 5 is downloaded to the distributed file 802 of the smartphone 8, and the distributed file read from the distributed file 802 by the smartphone 8 is transferred to the PC 4.
  • Login authentication is executed by sending.
  • FIG. 11 is a schematic diagram illustrating the operation of the information processing system 1 according to the fourth embodiment of the present invention.
  • FIG. 12 is a flowchart showing the process of the fourth embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
  • a certain user (referred to as user A) can update the specific file, and another user (referred to as user B) of the specific file.
  • user A a certain user
  • user B another user
  • the specific file may be authentication information or any other information file.
  • the distributed processing unit 407 divides the specific file into two by AONT and saves it in the distributed file 404. Specifically, the distributed processing unit 407 divides the specific file into a file 404a and a file 404b. Further, the dispersion processing unit 407 divides the file 404b into three by threshold dispersion.
  • the information processing system 1 stores one of the files divided into three by the distributed processing unit 407 in the distributed file 404 of the PC 4, and distributes another one of the files divided into three by the distributed processing unit 407 of the smartphone 5.
  • the file is saved in the file 502, and another one of the files divided into three by the distributed processing unit 407 is saved in the distributed file 902 of the smartphone 9.
  • the original file when the file is divided into three by the threshold variance, the original file can be restored if there are two of the three.
  • the user A can update the restored specific file by setting the attribute of the file saved in the distributed file 502 of the smartphone 5 of the user A as an updatable attribute.
  • the user B by setting the attribute of the file saved in the distributed file 902 of the smartphone 9 of the user B as a referenceable attribute, the user B can refer to the restored specific file. According to this embodiment, it is possible to set access restrictions for specific files for each user.
  • step S12001 of FIG. 10 the information processing system 1 executes the device authentication process.
  • this device authentication process if it is authenticated that the smartphone 5 or the smartphone 9 is a device that is permitted to connect to the PC 4 via Bluetooth, the process proceeds to step S12002.
  • step S12002 the PC 4 receives either the file of the distributed file 502 of the smartphone 5 or the file of the distributed file 902 of the smartphone 9.
  • the restoration processing unit 410 restores the file 404b by using the received file and a file that is one of the three divided files and is stored in the distributed file 404 of the PC4. Further, the restoration processing unit 410 restores the specific file by using the restored file 404b and the file 404a stored in the distributed file 404 of the PC4.
  • step S12003 the information processing system 1 gives the user of the smartphone 5 or the smartphone 9 access authority to the specific file restored in step S12002. At this time, access is restricted according to the attributes of the file of the distributed file 502 of the smartphone 5 or the file of the distributed file 902 of the smartphone 9.
  • FIG. 13 is a schematic diagram illustrating the operation of the information processing system 1 according to the fifth embodiment of the present invention.
  • FIG. 14 is a flowchart showing the process of the fifth embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
  • the PC4 is logged in by obtaining authentication information by restoring the distributed file and performing login authentication
  • a case where the user logs in by another method for example, a method of entering an ID and password
  • Different functions are provided to the user.
  • the network can be used on the PC 4 and the cloud 4a connected to the network 3 can be used.
  • the network is disabled on the PC 4 and the cloud 4a connected to the network 3 is disabled.
  • the files that the user can access can be restricted.
  • the files that the user logs in to the PC 4 and used are distributed by the secret sharing technology, and a part of the distributed files is moved to the cloud 4a in advance to limit the files that the user can access. You may.
  • step S14001 of FIG. 14 the information processing system 1 executes the login authentication process.
  • this login authentication process it is possible to log in by either a method of logging in by restoring the distributed file or another method.
  • step S14002 the PC4 limits the functions according to the login authentication method.
  • This function restriction may determine whether or not network connection is possible as described above, or may be a restriction on any other function provided by the PC 4.
  • An object of the present invention is to supply a storage medium containing a program code (computer program) that realizes the functions of the above-described embodiment to a system or device, and a program in which the computer of the supplied system or device is stored in the storage medium. It is also achieved by reading and executing the code.
  • the program code itself read from the storage medium realizes the function of the above-described embodiment, and the storage medium storing the program code constitutes the present invention.
  • the computer functions as each processing unit by executing the program, but even if a part or all of the processing is configured by a dedicated electronic circuit (hardware). I do not care.
  • the present invention is not limited to the specific examples described, and various modifications and modifications can be made within the scope of the gist of the present invention described in the claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The purpose of the present invention is to provide an information processing system capable of more secure login authentication. This information processing system comprises: a distribution unit which distributes authentication information to a first distributed file and a second distributed file by a secret distribution method; a first storage unit which stores the first distributed file in a first information processing device; a second storage unit which stores the second distributed file in a second information processing device; a user authentication unit which performs authentication to determine whether the user of the second information processing device is an authorized user; a communication unit which connects the first information processing device and the second information processing device via short-range wireless communication only if the user authentication unit authenticates that the user of the second information processing device is an authorized user; a restoration unit which restores the authentication information using the first distributed file stored by the first storage unit and the second distributed file stored by the second storage unit; and a login authentication unit which performs login authentication of the first information processing device using the authentication information restored by the restoration unit.

Description

情報処理システム、情報処理方法、及びプログラムInformation processing system, information processing method, and program
　本発明は、情報処理システム、情報処理方法、及びプログラムに関する。 The present invention relates to an information processing system, an information processing method, and a program.
　従来、情報処理装置やアプリケーションをユーザが利用可能な状態にするために、ユーザがログインすることが知られている。このログインにおいては、正当なユーザであることを認証するログイン認証が行われる。例えば特開２００５－１６５４１８号公報では、ユーザが携帯端末からサーバにログインする際のログイン認証において、携帯端末に割り当てられた個体ＩＤをサーバに登録しておき、サーバにおいて、携帯端末から送信されてきた個体ＩＤとサーバに登録してある個体ＩＤとを突合することでログイン認証を行うログイン認証システムを開示している。 Conventionally, it is known that a user logs in in order to make an information processing device or an application available to the user. In this login, login authentication is performed to authenticate that the user is a legitimate user. For example, in Japanese Patent Application Laid-Open No. 2005-165418, in login authentication when a user logs in to a server from a mobile terminal, an individual ID assigned to the mobile terminal is registered in the server and transmitted from the mobile terminal in the server. We disclose a login authentication system that performs login authentication by matching the individual ID with the individual ID registered in the server.
特開２００５－１６５４１８号公報Japanese Unexamined Patent Publication No. 2005-165418
　ところが、特開２００５－１６５４１８号公報に記載のシステムでは、その携帯端末を入手すれば、正当なユーザでなくてもログインできてしまうという問題があった。 However, in the system described in Japanese Patent Application Laid-Open No. 2005-165418, there is a problem that if the mobile terminal is obtained, even an unauthorized user can log in.
　本発明は以上のような課題を解決するためになされたものであり、よりセキュアなログイン認証が可能な情報処理システムを提供することを目的とする。 The present invention has been made to solve the above problems, and an object of the present invention is to provide an information processing system capable of more secure login authentication.
　上記課題を解決するために、本発明は、情報処理システムであって、認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散部と、前記第１分散ファイルを第１情報処理装置に記憶する第１記憶部と、前記第２分散ファイルを第２情報処理装置に記憶する第２記憶部と、前記第２情報処理装置の使用者が正当な使用者であることを認証する使用者認証部と、前記使用者認証部により前記第２情報処理装置の使用者が正当な使用者であると認証された場合にのみ前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続する通信部と、前記第２記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する送信部と、前記通信部によって前記第２情報処理装置から前記第２分散ファイルを受信する受信部と、前記第１記憶部で記憶した前記第１分散ファイルと前記受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する復元部と、前記復元部で復元した前記認証情報を用いて前記第１情報処理装置のログイン認証を行うログイン認証部と、を有することを特徴とする。 In order to solve the above problems, the present invention is an information processing system, in which a distribution unit that distributes authentication information into a first distributed file and a second distributed file by a secret sharing method, and the first distributed file are the first. 1 The first storage unit that stores in the information processing device, the second storage unit that stores the second distributed file in the second information processing device, and the user of the second information processing device are legitimate users. The first information processing device and the second information processing device only when the user authentication unit that authenticates the user and the user authentication unit authenticates that the user of the second information processing device is a legitimate user. A communication unit that connects the device by short-range wireless communication, a transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and the communication unit. The authentication information is used by a receiving unit that receives the second distributed file from the second information processing device, the first distributed file stored in the first storage unit, and the second distributed file received by the receiving unit. It is characterized by having a restoration unit for restoring the information processing unit and a login authentication unit for performing login authentication of the first information processing apparatus using the authentication information restored by the restoration unit.
　本発明によれば、よりセキュアなログイン認証が可能な情報処理システムを提供することができる。 According to the present invention, it is possible to provide an information processing system capable of more secure login authentication.
本発明の一実施形態に係る情報処理システムの構成を示すブロック図である。It is a block diagram which shows the structure of the information processing system which concerns on one Embodiment of this invention. 本発明の一実施形態に係る情報処理装置の構成を示すブロック図である。It is a block diagram which shows the structure of the information processing apparatus which concerns on one Embodiment of this invention. 本発明の一実施形態に係る情報処理システムの機能構成を示すブロック図である。It is a block diagram which shows the functional structure of the information processing system which concerns on one Embodiment of this invention. 本発明の一実施形態に係る情報処理システムの分散ファイル保存処理の一例を示すフローチャートである。It is a flowchart which shows an example of the distributed file storage process of the information processing system which concerns on one Embodiment of this invention. 本発明の実施例１に係る情報処理システム１の動作を説明する概略図である。It is the schematic explaining the operation of the information processing system 1 which concerns on Example 1 of this invention. 本発明の実施例１の処理を示すフローチャートである。It is a flowchart which shows the process of Example 1 of this invention. 本発明の実施例２に係る情報処理システム１の動作を説明する概略図である。It is the schematic explaining the operation of the information processing system 1 which concerns on Example 2 of this invention. 本発明の実施例２の処理を示すフローチャートである。It is a flowchart which shows the process of Example 2 of this invention. 本発明の実施例３に係る情報処理システム１の動作を説明する概略図である。It is the schematic explaining the operation of the information processing system 1 which concerns on Example 3 of this invention. 本発明の実施例３の処理を示すフローチャートである。It is a flowchart which shows the process of Example 3 of this invention. 本発明の実施例４に係る情報処理システム１の動作を説明する概略図である。It is the schematic explaining the operation of the information processing system 1 which concerns on Example 4 of this invention. 本発明の実施例４の処理を示すフローチャートである。It is a flowchart which shows the process of Example 4 of this invention. 本発明の実施例５に係る情報処理システム１の動作を説明する概略図である。It is the schematic explaining the operation of the information processing system 1 which concerns on Example 5 of this invention. 本発明の実施例５の処理を示すフローチャートである。It is a flowchart which shows the process of Example 5 of this invention.
　以下、本発明に係る情報処理システムについて、図面を参照しながら詳細に説明する。なお、以下に示す実施形態は本発明に係るシステムの好適な具体例であり、一般的なハードウェア、ソフトウェア構成に即した種々の限定を付している場合もあるが、本発明の技術範囲は、特に本発明を限定する記載がない限り、これらの態様に限定されるものではない。また、以下に示す実施形態における構成要素は、適宜、既存の構成要素等との置き換えが可能であり、かつ、他の既存の構成要素との組み合わせを含む様々なバリエーションが可能である。したがって、以下に示す実施形態の記載をもって、特許請求の範囲に記載された発明の内容を限定するものではない。 Hereinafter, the information processing system according to the present invention will be described in detail with reference to the drawings. The embodiments shown below are suitable specific examples of the system according to the present invention, and may be subject to various limitations according to general hardware and software configurations, but the technical scope of the present invention. Is not limited to these aspects unless otherwise specified to limit the present invention. In addition, the components in the embodiments shown below can be appropriately replaced with existing components and the like, and various variations including combinations with other existing components are possible. Therefore, the description of the embodiment shown below does not limit the content of the invention described in the claims.
　図１は、本発明の一実施形態に係る情報処理システムの構成を示すブロック図である。図１の情報処理システム１は、サーバ２、ＰＣ４、及びスマートフォン５を有して構成される。ＰＣは、Ｐｅｒｓｏｎａｌ　Ｃｏｍｐｕｔｅｒの略称である。サーバ２、ＰＣ４、及びスマートフォン５は、ネットワーク３に接続され、相互に通信することが可能である。ＰＣ４とスマートフォン５とは近距離無線通信６（本実施形態ではＢｌｕｅｔｏｏｔｈ（登録商標）を用いる。以下、Ｂｌｕｅｔｏｏｔｈをブルートゥースと表記する場合がある。）で相互に通信することが可能である。近距離無線通信６は、無線の到達距離が数メートル程度の近距離に限定した通信である。サーバ２、ＰＣ４、及びスマートフォン５のそれぞれは、他の如何なる情報処理装置であってもよい。スマートフォン５はユーザが携帯可能な装置であることが望ましい。ネットワーク３は、インターネット、有線、無線など如何なるネットワークであってもよい。本実施形態ではＰＣ４とスマートフォン５とはＢｌｕｅｔｏｏｔｈである近距離無線通信６で相互に通信するが、本発明はこれに限られるものではなく、ＰＣ４とスマートフォン５とは他の如何なる近距離無線通信技術によって相互に通信するものであってよい。 FIG. 1 is a block diagram showing a configuration of an information processing system according to an embodiment of the present invention. The information processing system 1 of FIG. 1 includes a server 2, a PC 4, and a smartphone 5. PC is an abbreviation for Personal Computer. The server 2, the PC 4, and the smartphone 5 are connected to the network 3 and can communicate with each other. The PC 4 and the smartphone 5 can communicate with each other by short-range wireless communication 6 (in this embodiment, Bluetooth (registered trademark) is used. Hereinafter, Bluetooth may be referred to as Bluetooth). The short-range wireless communication 6 is a communication limited to a short distance with a wireless reach of about several meters. Each of the server 2, the PC 4, and the smartphone 5 may be any other information processing device. It is desirable that the smartphone 5 is a device that can be carried by the user. The network 3 may be any network such as the Internet, wired, and wireless. In the present embodiment, the PC 4 and the smartphone 5 communicate with each other by Bluetooth short-range wireless communication 6, but the present invention is not limited to this, and the PC 4 and the smartphone 5 are any other short-range wireless communication technology. May be those that communicate with each other.
　情報処理システム１において、サーバ２、ＰＣ４、及びスマートフォン５のそれぞれは、複数設けられてもよい。例えば、情報処理システム１は、１台のサーバ２に対して複数のＰＣ４を設けた構成でもよく、１台のＰＣ４に対して複数のスマートフォン５を設けた構成でもよい。 In the information processing system 1, a plurality of each of the server 2, the PC 4, and the smartphone 5 may be provided. For example, the information processing system 1 may have a configuration in which a plurality of PCs 4 are provided for one server 2, or a configuration in which a plurality of smartphones 5 are provided for one PC4.
　図２は、本発明の一実施形態に係る情報処理装置の構成を示すブロック図である。図２の情報処理装置１０は、図１に示したサーバ２、ＰＣ４、及びスマートフォン５の構成の一例である。サーバ２、ＰＣ４、及びスマートフォン５のそれぞれは、図２の情報処理装置１０のすべての構成を有してもよいし、一部の構成を有してもよいし、図２に記載した以外の構成を有してもよい。 FIG. 2 is a block diagram showing a configuration of an information processing device according to an embodiment of the present invention. The information processing device 10 of FIG. 2 is an example of the configuration of the server 2, the PC 4, and the smartphone 5 shown in FIG. Each of the server 2, the PC 4, and the smartphone 5 may have all the configurations of the information processing device 10 of FIG. 2, a partial configuration, and other than those shown in FIG. It may have a configuration.
　情報処理装置１０は、ＣＰＵ１１、ＲＡＭ１２、及びＲＯＭ１３を有する。ＣＰＵ１１は、ＲＯＭ１３内に記憶されたプログラムや、外部デバイス１７が外部メモリである場合にこの外部メモリからＲＡＭ１２にロードされたＯＳ（オペレーションシステム）やアプリケーション等のプログラムを実行する。ＣＰＵは、Ｃｅｎｔｒａｌ　Ｐｒｏｃｅｓｓｉｎｇ　Ｕｎｉｔの略称である。ＲＯＭは、Ｒｅａｄ　Ｏｎｌｙ　Ｍｅｍｏｒｙの略称である。ＲＡＭは、Ｒａｎｄｏｍ　Ａｃｃｅｓｓ　Ｍｅｍｏｒｙの略称である。ＣＰＵ１１は、ＲＯＭ１３やＲＡＭ１２などの読み取り可能な記憶媒体に格納されたプログラムを実行することにより、後述する各処理を実行する各処理部として機能する。ＲＡＭ１２は、ＣＰＵ１１のメインメモリであり、ワークエリア等として機能する。情報処理装置１０は、内部バス２０を有する。ＣＰＵ１１、ＲＡＭ１２、及びＲＯＭ１３のそれぞれは、内部バス２０に接続される。内部バス２０に接続された各構成同士は、内部バス２０を介して相互に通信が可能である。 The information processing device 10 has a CPU 11, a RAM 12, and a ROM 13. The CPU 11 executes a program stored in the ROM 13 or a program such as an OS (operating system) or an application loaded in the RAM 12 from the external memory when the external device 17 is an external memory. CPU is an abbreviation for Central Processing Unit. ROM is an abbreviation for Read Only Memory. RAM is an abbreviation for Random Access Memory. The CPU 11 functions as each processing unit that executes each process described later by executing a program stored in a readable storage medium such as a ROM 13 or a RAM 12. The RAM 12 is the main memory of the CPU 11 and functions as a work area or the like. The information processing device 10 has an internal bus 20. Each of the CPU 11, the RAM 12, and the ROM 13 is connected to the internal bus 20. Each configuration connected to the internal bus 20 can communicate with each other via the internal bus 20.
　情報処理装置１０は、入出力コントローラ１４及び入出力装置１５を有する。入出力コントローラ１４は、入出力装置１５を制御する。入力コントローラ１４は、内部バス２０に接続される。入出力装置１５は、例えばキーボード、ポインティングデバイス（マウス、タッチパッド、タッチパネル、トラックボールなど）、ディスプレイなどである。 The information processing device 10 has an input / output controller 14 and an input / output device 15. The input / output controller 14 controls the input / output device 15. The input controller 14 is connected to the internal bus 20. The input / output device 15 is, for example, a keyboard, a pointing device (mouse, touch pad, touch panel, trackball, etc.), a display, or the like.
　情報処理装置１０は、デバイスコントローラ１６及び外部デバイス１７を有する。デバイスコントローラ１６は、外部デバイス１７を制御する。デバイスコントローラ１６は、内部バス２０に接続される。外部デバイス１７は、外部メモリ、外部マイク、外部スピーカ、外部カメラなどの各種デバイスである。 The information processing device 10 has a device controller 16 and an external device 17. The device controller 16 controls the external device 17. The device controller 16 is connected to the internal bus 20. The external device 17 is various devices such as an external memory, an external microphone, an external speaker, and an external camera.
　情報処理装置１０は、ネットワークインターフェース１８を有する。ネットワークインターフェース１８は、ネットワーク３に接続されて、ネットワーク３に接続された他の機器との通信制御処理を実行する。ネットワークインターフェース１８は、内部バス２０に接続される。 The information processing device 10 has a network interface 18. The network interface 18 is connected to the network 3 and executes a communication control process with another device connected to the network 3. The network interface 18 is connected to the internal bus 20.
　情報処理装置１０は、ブルートゥースインターフェース１９を有する。ブルートゥースインターフェース１９は、近距離無線通信６による他の機器との通信制御処理を実行する。ブルートゥースインターフェース１８は、内部バス２０に接続される。 The information processing device 10 has a Bluetooth interface 19. The Bluetooth interface 19 executes a communication control process with another device by the short-range wireless communication 6. The Bluetooth interface 18 is connected to the internal bus 20.
　図３は、本発明の一実施形態に係る情報処理システムの機能構成を示すブロック図である。本実施形態において、各々の機能ブロックは、ハードウェアとして搭載されるＣＰＵ１１１によって処理されるプログラムの塊を示す。 FIG. 3 is a block diagram showing a functional configuration of an information processing system according to an embodiment of the present invention. In the present embodiment, each functional block represents a mass of programs processed by the CPU 111 mounted as hardware.
　スマートフォン５は、有効性確認部５０１を有する。有効性確認部５０１は、スマートフォン５の有効性とユーザの有効性の確認を行う。有効性確認部５０１は、具体的には、以下の事前処理及び有効性確認処理を実行する。 The smartphone 5 has a validity confirmation unit 501. The effectiveness confirmation unit 501 confirms the effectiveness of the smartphone 5 and the effectiveness of the user. Specifically, the validity confirmation unit 501 executes the following pre-processing and validity confirmation processing.
　（事前処理）
・ユーザは、情報処理システム１に係るサービスの初期登録時のアクティベーションの際に、ユーザ情報と共にスマートフォン５の情報であるスマートフォン情報（ＩＭＥＩなどのデバイス情報）を、サーバ２に登録する。ＩＭＥＩは、Ｉｎｔｅｒｎａｔｉｏｎａｌ　Ｍｏｂｉｌｅ　Ｅｑｕｉｐｍｅｎｔ　Ｉｄｅｎｔｉｆｉｅｒの略称である。具体的には、有効性確認部５０１は、ユーザ情報及びスマートフォン情報（入出力装置１５からユーザが入力した情報やＲＯＭ１３に記憶してある情報）を、ネットワーク３を介してサーバ２に送信する。これらの情報を受信したサーバ２は、受信した情報を管理ＤＢ２０２に登録する。ＤＢは、データベースの略称である。 (Pre-processing)
-The user registers the smartphone information (device information such as IMEI), which is the information of the smartphone 5, together with the user information in the server 2 at the time of activation at the time of initial registration of the service related to the information processing system 1. IMEI is an abbreviation for International Mobile Equipment Identity. Specifically, the validity confirmation unit 501 transmits user information and smartphone information (information input by the user from the input / output device 15 and information stored in the ROM 13) to the server 2 via the network 3. The server 2 that has received this information registers the received information in the management DB 202. DB is an abbreviation for database.
　（有効性確認処理）
（１）ユーザは、事前処理が済んだスマートフォン５の入出力装置１５を操作して、情報処理システム１に係るアプリケーションをスマートフォン５で起動する。このアプリケーションの起動により、認証部５０４は、スマートフォン５を操作するユーザの本人認証を実行する。
（２）認証部５０４により、本人認証（例えばスマートフォン５本体の生体認証）が正常に行われ、本人であることが認証されると、有効性確認部５０１は、サーバ２にスマートフォン情報およびユーザ情報を送信する。
（３）サーバ２は、スマートフォン５から送信されてきた情報を、事前処理の初期登録時に管理ＤＢ２０２に登録された情報と照合する。
（４）サーバ２は、照合結果として、スマートフォン５から送信されてきた情報と管理ＤＢ２０２に登録された情報とが、一致した場合にはスマートフォン５にＯＫを返送し、一致しない場合にはスマートフォン５にＮＧを返送する。
（５）有効性確認部５０１は、ＯＫを受信した場合には有効性が確認されたとし、ＮＧを受信した場合には有効性が確認されないとする。 (Validity confirmation process)
(1) The user operates the input / output device 15 of the smartphone 5 that has been preprocessed to start the application related to the information processing system 1 on the smartphone 5. By activating this application, the authentication unit 504 executes the personal authentication of the user who operates the smartphone 5.
(2) When the personal authentication (for example, biometric authentication of the smartphone 5 main body) is normally performed by the authentication unit 504 and the person is authenticated, the validity confirmation unit 501 sends the smartphone information and the user information to the server 2. To send.
(3) The server 2 collates the information transmitted from the smartphone 5 with the information registered in the management DB 202 at the time of initial registration of the preprocessing.
(4) As a collation result, the server 2 returns OK to the smartphone 5 if the information transmitted from the smartphone 5 and the information registered in the management DB 202 match, and if they do not match, the smartphone 5 returns OK. NG will be returned to.
(5) The validity confirmation unit 501 assumes that the validity is confirmed when OK is received, and that the validity is not confirmed when NG is received.
　スマートフォン５は、分散ファイル５０２を有する。分散ファイル５０２は、スマートフォン５側の分散ファイルである。 The smartphone 5 has a distributed file 502. The distributed file 502 is a distributed file on the smartphone 5 side.
　スマートフォン５は、認証部５０４を有する。認証部５０４は、指紋、虹彩、顔認証、静脈などの生体認証を実行する。また、認証部５０４は、例えばＧＰＳ受信機を有してスマートフォン５の現在位置の位置情報を取得し、スマートフォン５の現在位置が予め定めた位置である場合に認証とする処理を実行するものでもよい。また、認証部５０４は、例えば管理者（例えば上司）による許可を受け付ける手段を有し、管理者が許可した場合に認証とする処理を実行するものでもよい。また、認証部５０４は、その都度発行するワンタイムパスワードの入力が正しくされた場合に認証とする処理を実行するものでもよい。また、認証部５０４は、上記の各認証処理のうちのいずれか複数の組み合わせによって認証とする処理を実行するものであってもよい。 The smartphone 5 has an authentication unit 504. The authentication unit 504 executes biometric authentication such as fingerprint, iris, face authentication, and vein. Further, the authentication unit 504 may have, for example, a GPS receiver to acquire the position information of the current position of the smartphone 5 and execute a process of authenticating when the current position of the smartphone 5 is a predetermined position. Good. Further, the authentication unit 504 may have a means for accepting permission from, for example, an administrator (for example, a boss), and may execute a process of authenticating when the administrator permits. Further, the authentication unit 504 may execute a process of authenticating when the one-time password issued each time is correctly input. In addition, the authentication unit 504 may execute a process for authentication by any combination of a plurality of the above authentication processes.
　スマートフォン５は、スイッチ制御部５０５を有する。スイッチ制御部５０５は、スマートフォン５から、ＰＣ４とのブルートゥース接続のオン／オフする。情報処理システム１に係るアプリケーションがスマートフォン５で起動すると、スマートフォン５の入出力装置１５は、ブルートゥース接続のオン／オフの切り替えの入力を受け付ける画面を表示する。スイッチ制御部５０５は、この画面におけるユーザの入力に応じてブルートゥース接続のオン／オフを切り替える。すなわち、スイッチ制御部５０５によれば、ユーザは、スマートフォン５とＰＣ４との距離によらず、手動でブルートゥース接続のオン／オフを切り替えることができる。 The smartphone 5 has a switch control unit 505. The switch control unit 505 turns on / off the Bluetooth connection with the PC 4 from the smartphone 5. When the application related to the information processing system 1 is started on the smartphone 5, the input / output device 15 of the smartphone 5 displays a screen for accepting an input for switching on / off of the Bluetooth connection. The switch control unit 505 switches the Bluetooth connection on / off according to the user's input on this screen. That is, according to the switch control unit 505, the user can manually switch the Bluetooth connection on / off regardless of the distance between the smartphone 5 and the PC 4.
　スマートフォン５は、ブルートゥース制御部５０６を有する。ブルートゥース制御部５０６は、スイッチ制御部５０５によってブルートゥース接続がオンされている場合に、近距離無線通信６によりＰＣ４と通信する。 The smartphone 5 has a Bluetooth control unit 506. The Bluetooth control unit 506 communicates with the PC 4 by short-range wireless communication 6 when the Bluetooth connection is turned on by the switch control unit 505.
　スマートフォン５は、入出力制御部５０３を有する。入出力制御部５０３は、事前にＰＣ４から受信したスマートフォン５側の分散ファイルを分散ファイル５０２として保存するとともに、詳しくは後述するログイン認証に際して、近距離無線通信６を介して分散ファイル５０２をＰＣ４に送信する。事前にＰＣ４から分散ファイルを受信するのは、ネットワーク３を介して行ってもよいし、近距離無線通信６を介して行ってもよい。 The smartphone 5 has an input / output control unit 503. The input / output control unit 503 saves the distributed file on the smartphone 5 side received from the PC 4 in advance as the distributed file 502, and at the time of login authentication, which will be described in detail later, transfers the distributed file 502 to the PC 4 via the short-range wireless communication 6. Send. The distributed file may be received from the PC 4 in advance via the network 3 or the short-range wireless communication 6.
　ＰＣ４は、距離測定部４０１を有する。距離測定部４０１は、ＰＣ４とスマートフォン５との距離を測定する。本実施形態では、ＰＣ４とスマートフォン５との距離が所定の距離（例えば１ｍ）以下である場合に、ユーザがＰＣ４にログイン可能であるとする。すなわち、本実施形態では、ＰＣ４とスマートフォン５との接続／切断の判断は、ＰＣ４とスマートフォン５との距離が所定の距離（例えば１ｍ）であるとしている。例えば、ＰＣ４とスマートフォン５との距離が、所定の距離（例えば１ｍ）以下であればＰＣ４とスマートフォン５とを接続し、所定の距離（例えば１ｍ）を超える距離であればＰＣ４とスマートフォン５との接続を切断する。本実施形態では、ＰＣ４側でＰＣ４とスマートフォン５との距離を測定することとしているが、本発明はこれに限られるものではなく、スマートフォン５側でＰＣ４とスマートフォン５との距離を測定してもよい。 PC4 has a distance measuring unit 401. The distance measuring unit 401 measures the distance between the PC 4 and the smartphone 5. In the present embodiment, it is assumed that the user can log in to the PC 4 when the distance between the PC 4 and the smartphone 5 is a predetermined distance (for example, 1 m) or less. That is, in the present embodiment, the determination of connection / disconnection between the PC 4 and the smartphone 5 is that the distance between the PC 4 and the smartphone 5 is a predetermined distance (for example, 1 m). For example, if the distance between the PC 4 and the smartphone 5 is less than or equal to a predetermined distance (for example, 1 m), the PC 4 and the smartphone 5 are connected, and if the distance exceeds the predetermined distance (for example, 1 m), the PC 4 and the smartphone 5 are connected. Disconnect. In the present embodiment, the distance between the PC 4 and the smartphone 5 is measured on the PC 4 side, but the present invention is not limited to this, and the distance between the PC 4 and the smartphone 5 can be measured on the smartphone 5 side. Good.
　距離測定部４０１は、例えば近距離無線通信６の電波強度（ｄＢｍ）によりＰＣ４とスマートフォン５との距離を測定する。近距離無線通信６の接続時の初期段階で、ＰＣ４とスマートフォン５との間の近距離無線通信６の電波強度を測定し、これを基準値として、例えば、
・基準値から、－５０ｄＢｍ以上になった場合、ＰＣ４とスマートフォン５との接続を切断し、
・基準値から、－５０ｄＢｍ未満になった場合、ＰＣ４とスマートフォン５との接続を維持する。
　距離測定部４０１は、初期設定処理として、スマートフォン５がＰＣ４に近接（例えばそれぞれのアンテナ同士の距離が約５ｃｍ以内）で電波強度のポーリングを行い、当該電波強度を基準値としてもよい。 The distance measuring unit 401 measures the distance between the PC 4 and the smartphone 5 by, for example, the radio wave intensity (dBm) of the short-range wireless communication 6. At the initial stage when the short-range wireless communication 6 is connected, the radio field strength of the short-range wireless communication 6 between the PC 4 and the smartphone 5 is measured, and using this as a reference value, for example, for example.
・ If the value exceeds -50 dBm from the standard value, the connection between the PC 4 and the smartphone 5 is disconnected.
-If the value is less than -50 dBm from the standard value, the connection between the PC 4 and the smartphone 5 is maintained.
As an initial setting process, the distance measuring unit 401 may poll the radio wave strength when the smartphone 5 is close to the PC 4 (for example, the distance between the antennas is within about 5 cm) and use the radio wave strength as a reference value.
　ＰＣ４は、ペアリング状態把握部４０２を有する。ペアリング状態把握部４０２は、近距離無線通信６のペアリング状態（現在接続中であるか否か）を把握する。 PC4 has a pairing state grasping unit 402. The pairing state grasping unit 402 grasps the pairing state (whether or not the connection is currently being made) of the short-range wireless communication 6.
　ＰＣ４は、ロック制御部４０３を有する。ロック制御部４０３は、ペアリング状態が接続中であってスマートフォン５との距離が所定の距離（例えば１ｍ）以下であれば、ＰＣ４をアンロックし利用可能な状態にし、ペアリング状態が未接続の場合、又は、スマートフォン５との距離が所定の距離（例えば１ｍ）を超える場合は、ＰＣ４をロックし利用不可能な状態にする。 PC4 has a lock control unit 403. If the pairing state is connected and the distance to the smartphone 5 is less than a predetermined distance (for example, 1 m), the lock control unit 403 unlocks the PC 4 to make it available, and the pairing state is not connected. In the case of, or when the distance to the smartphone 5 exceeds a predetermined distance (for example, 1 m), the PC 4 is locked to make it unusable.
　ＰＣ４は、認証情報４０８を有する。認証情報４０８は、スマートフォン５を携帯しているユーザがＰＣ４にログインするための認証情報である。 PC4 has authentication information 408. The authentication information 408 is authentication information for a user carrying the smartphone 5 to log in to the PC 4.
　ＰＣ４は、分散処理部４０７を有する。分散処理部４０７は、秘密分散技術における秘匿化処理を行う。秘匿化処理は、対象のデータを分散する処理である。データの分散方法は、既知の秘密分散技術の如何なる方法を用いてもよい。例えば、分散処理部４０７の分散処理は、閾値分散により、元のデータをｎ個の分散片に分散し、ｎ個のうちのいずれかｋ個（ｎ＞ｋ）の分散片を用いて元のデータを復元可能とするものであってもよい。例えば、分散処理部４０７の分散処理は、ＡＯＮＴ（Ａｌｌ　ｏｒ　Ｎｏｔｈｉｎｇ　Ｔｒａｎｓｆｏｒｍ）により、元のデータをｎ個の分散片に分散し、ｎ個すべての分散片を用いて元のデータを復元可能とするものであってもよい。 PC4 has a distributed processing unit 407. The distribution processing unit 407 performs concealment processing in the secret sharing technology. The concealment process is a process of distributing target data. As the data distribution method, any method of known secret sharing technology may be used. For example, in the dispersion processing of the dispersion processing unit 407, the original data is dispersed into n dispersion pieces by threshold dispersion, and the original k (n> k) dispersion pieces of the n pieces are used. The data may be recoverable. For example, in the dispersion processing of the dispersion processing unit 407, the original data is dispersed into n dispersion pieces by AONT (All or Nothing Transfer), and the original data can be restored by using all n dispersion pieces. It may be a thing.
　ＰＣ４は、設定情報４０９を有する。設定情報４０９は、例えば、以下の情報を含む。
（１）分散処理部４０７による秘密分散処理後に、分散片である分散ファイルを保存する保存先の情報（ＰＣ４側の保存場所（ディレクトリ／フォルダ）、及びスマートフォン５側の保存場所（ディレクトリ／フォルダ））
（２）サーバ２の接続情報（ＵＲＬ（Ｕｎｉｆｏｒｍ　Ｒｅｓｏｕｒｃｅ　Ｌｏｃａｔｏｒ）、ポート番号等）
（３）近距離無線通信６によるスマートフォン５との接続情報（スマートフォン５のデバイス情報やリンクキー、等） The PC 4 has the setting information 409. The setting information 409 includes, for example, the following information.
(1) Information on the save destination for saving the distributed file, which is a distributed piece, after the secret sharing process by the distributed processing unit 407 (storage location (directory / folder) on the PC4 side, and storage location (directory / folder) on the smartphone 5 side). )
(2) Connection information of server 2 (URL (Uniform Resource Locator), port number, etc.)
(3) Connection information with smartphone 5 by short-range wireless communication 6 (device information of smartphone 5, link key, etc.)
　ＰＣ４は、分散ファイル４０４を有する。分散ファイル４０４は、ＰＣ４側の分散ファイルである。分散処理部４０７は、認証情報４０８を分散し、スマートフォン５側の分散ファイル及びＰＣ４側の分散ファイルを取得する。スマートフォン５側の分散ファイルとＰＣ４側の分散ファイルとは別のファイルである。スマートフォン５側の分散ファイルは、分散ファイル５０２として保存され、ＰＣ４側の分散ファイルは、分散ファイル４０４として保存される。 PC4 has a distributed file 404. The distributed file 404 is a distributed file on the PC4 side. The distributed processing unit 407 distributes the authentication information 408 and acquires the distributed file on the smartphone 5 side and the distributed file on the PC 4 side. The distributed file on the smartphone 5 side and the distributed file on the PC 4 side are different files. The distributed file on the smartphone 5 side is saved as the distributed file 502, and the distributed file on the PC4 side is saved as the distributed file 404.
　ＰＣ４は、ブルートゥース制御部４０６を有する。ブルートゥース制御部４０６は、近距離無線通信６によりスマートフォン５と通信する。 PC4 has a Bluetooth control unit 406. The Bluetooth control unit 406 communicates with the smartphone 5 by short-range wireless communication 6.
　ＰＣ４は、入出力制御部４０５を有する。入出力制御部４０５は、事前に分散処理部４０７で取得したＰＣ４側の分散ファイルを分散ファイル４０４として保存するとともに、詳しくは後述するログイン認証に際して、分散ファイル４０４を復元処理部４１０に渡す。 PC4 has an input / output control unit 405. The input / output control unit 405 saves the distributed file on the PC4 side acquired by the distributed processing unit 407 in advance as the distributed file 404, and passes the distributed file 404 to the restoration processing unit 410 at the time of login authentication, which will be described in detail later.
　ＰＣ４は、復元処理部４１０を有する。復元処理部４１０は、分散処理部４０７で分散したファイルの復元処理を実行する。すなわち、分散処理部４０７は、スマートフォン５から受信した分散ファイル５０２、及び入出力制御部４０５から得た分散ファイル４０４を用いて認証情報を復元する。 PC4 has a restoration processing unit 410. The restoration processing unit 410 executes the restoration processing of the files distributed by the distribution processing unit 407. That is, the distributed processing unit 407 restores the authentication information using the distributed file 502 received from the smartphone 5 and the distributed file 404 obtained from the input / output control unit 405.
　ＰＣ４は、ログイン認証部４１１を有する。ログイン認証部４１１は、復元処理部４１０で復元した認証情報を用いて、例えばＣｒｅｄｅｎｔｉａｌ　Ｐｒｏｖｉｄｅｒによりログインを実行する。 PC4 has a login authentication unit 411. The login authentication unit 411 executes login by, for example, a Credentialal Provider using the authentication information restored by the restoration processing unit 410.
　ＰＣ４は、ログ取得部４１２を有する。ログ取得部４１２は、各処理で生じた事柄をログとして記録する。これは、例えばイベントログとして記録される。ログ取得部４１２は、記録したログを、ネットワーク３を介してサーバ２に送信する。 PC4 has a log acquisition unit 412. The log acquisition unit 412 records the matters generated in each process as a log. This is recorded, for example, as an event log. The log acquisition unit 412 transmits the recorded log to the server 2 via the network 3.
　サーバ２は、ログファイル２０３を有する。ログファイル２０３は、ＰＣ４から受信したログを保存する。 Server 2 has a log file 203. The log file 203 stores the log received from the PC 4.
　サーバ２は、管理ＤＢ２０２を有する。管理ＤＢ２０２は、以下の情報を含む。
（１）ユーザ情報
（２）利用状況情報
（３）ログ管理情報
（４）テナント管理情報
（５）契約情報 The server 2 has a management DB 202. The management DB 202 includes the following information.
(1) User information (2) Usage status information (3) Log management information (4) Tenant management information (5) Contract information
　サーバ２は、制御部２０１を有する。制御部２０１は、以下の処理を実行する。
（１）管理ＤＢ２０２のユーザ情報に対する処理（登録、更新、削除、参照等）
（２）管理ＤＢ２０２の利用状況情報に対する処理（検索、参照等）
（３）管理ＤＢ２０２のログ管理情報に対する処理（検索、参照等）
（４）管理ＤＢ２０２のテナント管理情報に対する処理（登録、更新、削除、参照等）
（５）管理ＤＢ２０２の契約情報に対する処理（登録、更新、削除、参照等） The server 2 has a control unit 201. The control unit 201 executes the following processing.
(1) Processing for user information of management DB 202 (registration, update, deletion, reference, etc.)
(2) Processing for usage status information of management DB 202 (search, reference, etc.)
(3) Processing (search, reference, etc.) for log management information in the management DB 202
(4) Processing for tenant management information of management DB 202 (registration, update, deletion, reference, etc.)
(5) Processing for contract information of management DB 202 (registration, update, deletion, reference, etc.)
　次に、本実施形態において、分散ファイルを保存する処理の一例についてフローチャートを用いて説明する。図４は、本発明の一実施形態に係る情報処理システムの分散ファイル保存処理の一例を示すフローチャートである。
　まず、ステップＳ４００１において、情報処理システム１は、ユーザ登録を行う。具体的には、ユーザは、スマートフォン５の入出力装置１５やＰＣ４の入出力装置１５により、ユーザ情報を入力する。ユーザ情報の入力を受けたＰＣ４は、入力されたユーザ情報に対応付けた認証情報を作成し、認証情報４０８として保存する。またユーザ情報の入力を受けたＰＣ４は、入力されたユーザ情報を設定情報４０９に保存する。またユーザ情報の入力を受けたＰＣ４は、入力されたユーザ情報をサーバ２に送信する。ＰＣ４からユーザ情報を受信したサーバ２は、受信したユーザ情報を管理ＤＢ２０２に保存する。 Next, in the present embodiment, an example of the process of saving the distributed file will be described using a flowchart. FIG. 4 is a flowchart showing an example of the distributed file storage process of the information processing system according to the embodiment of the present invention.
First, in step S4001, the information processing system 1 performs user registration. Specifically, the user inputs user information through the input / output device 15 of the smartphone 5 and the input / output device 15 of the PC 4. The PC 4 that has received the input of the user information creates the authentication information associated with the input user information and saves it as the authentication information 408. Further, the PC 4 that has received the input of the user information saves the input user information in the setting information 409. Further, the PC 4 that has received the input of the user information transmits the input user information to the server 2. The server 2 that has received the user information from the PC 4 stores the received user information in the management DB 202.
　ステップＳ４００２において、情報処理システム１は、ステップＳ４００１で認証情報４０８に保存した認証情報を、分散処理部４０７により分散し、スマートフォン５側の分散ファイル及びＰＣ４側の分散ファイルを取得する。ＰＣ４は、ＰＣ４側の分散ファイルを分散ファイル４０４として保存する。 In step S4002, the information processing system 1 distributes the authentication information stored in the authentication information 408 in step S4001 by the distributed processing unit 407, and acquires the distributed file on the smartphone 5 side and the distributed file on the PC4 side. The PC4 saves the distributed file on the PC4 side as the distributed file 404.
　ステップＳ４００３において、情報処理システム１は、スマートフォン５とＰＣ４の近距離無線通信６のペアリングを実行する。このペアリングによりリンクキーが生成され、スマートフォン５とＰＣ４とは、このリンクキーを用いた暗号化通信を行う。 In step S4003, the information processing system 1 executes pairing of the short-range wireless communication 6 of the smartphone 5 and the PC 4. A link key is generated by this pairing, and the smartphone 5 and the PC 4 perform encrypted communication using this link key.
　ステップＳ４００４において、情報処理システム１は、ステップＳ４００１でペアリングした近距離無線通信６を介して、スマートフォン５側の分散ファイルを、ＰＣ４からスマートフォン５に送信する。スマートフォン５側の分散ファイルを受信したスマートフォン５は、そのスマートフォン５側の分散ファイルを分散ファイル５０２として保存する。 In step S4004, the information processing system 1 transmits the distributed file on the smartphone 5 side from the PC 4 to the smartphone 5 via the short-range wireless communication 6 paired in step S4001. The smartphone 5 that has received the distributed file on the smartphone 5 side saves the distributed file on the smartphone 5 side as the distributed file 502.
　以下、上述した実施形態の情報処理システム１についての実施例について説明する。 Hereinafter, an example of the information processing system 1 of the above-described embodiment will be described.
　図５は、本発明の実施例１に係る情報処理システム１の動作を説明する概略図である。図６は、本発明の実施例１の処理を示すフローチャートである。本実施例は、図１から図４を参照して上述した実施形態を基礎とした実施例であるため、図１から図４と同じ構成には同じ符号を付し、詳しい説明は省略する。 FIG. 5 is a schematic diagram illustrating the operation of the information processing system 1 according to the first embodiment of the present invention. FIG. 6 is a flowchart showing the process of the first embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
　本実施例では、図５に示すように、
（１）スマートフォン５の生体認証による本人認証
（２）本人認証を前提とし、近距離無線通信６のリンクキーの照合によるデバイス認証
（３）デバイス認証を前提とし、秘密分散技術により分散された分散ファイルを復元した認証情報によるログイン認証
の三段階の認証を行うことで、よりセキュアなログイン認証を可能にしている。 In this embodiment, as shown in FIG.
(1) Personal authentication by biometric authentication of smartphone 5 (2) Device authentication by collating the link key of short-range wireless communication 6 on the premise of personal authentication (3) Distribution distributed by secret sharing technology on the premise of device authentication More secure login authentication is made possible by performing three-step authentication of login authentication using the authentication information that restored the file.
　図６のステップＳ６００１において、情報処理システム１は、本人認証処理を実行する。具体的には、スマートフォン５の認証部５０４は、予め登録した指紋情報、虹彩情報、顔情報などによって、スマートフォン５を正当なユーザが操作しているのかを認証する。認証部５０４で認証に成功した場合はスイッチ制御部５０５により近距離無線通信６の利用が許容され、ステップＳ６００２に進む。認証部５０４で認証に失敗した場合はスイッチ制御部５０５により近距離無線通信６の利用が拒絶され、図６の処理を終了する。 In step S6001 of FIG. 6, the information processing system 1 executes the personal authentication process. Specifically, the authentication unit 504 of the smartphone 5 authenticates whether or not a legitimate user is operating the smartphone 5 by using fingerprint information, iris information, face information, etc. registered in advance. If the authentication unit 504 succeeds in authentication, the switch control unit 505 allows the use of the short-range wireless communication 6, and the process proceeds to step S6002. If the authentication unit 504 fails to authenticate, the switch control unit 505 rejects the use of the short-range wireless communication 6, and ends the process of FIG.
　図６のステップＳ６００２において、情報処理システム１は、デバイス認証処理を実行する。具体的には、スマートフォン５のブルートゥース接続部５０６は、近距離無線通信６により、ＰＣ４のブルートゥース接続部４０６との接続を試みる。情報処理システム１は、この接続に成功すればデバイス認証に成功したとし、この接続に失敗すればデバイス認証に失敗したとする。デバイス認証に成功した場合はステップＳ６００３に進む。デバイス認証に失敗した場合は図６の処理を終了する。 In step S6002 of FIG. 6, the information processing system 1 executes the device authentication process. Specifically, the Bluetooth connection unit 506 of the smartphone 5 attempts to connect to the Bluetooth connection unit 406 of the PC 4 by short-range wireless communication 6. If the information processing system 1 succeeds in this connection, it is assumed that the device authentication is successful, and if this connection fails, it is assumed that the device authentication fails. If the device authentication is successful, the process proceeds to step S6003. If the device authentication fails, the process shown in FIG. 6 ends.
　図６のステップＳ６００３において、情報処理システム１は、ログイン認証処理を実行する。具体的には、ログイン認証部４１１は、分散ファイルを復元して得た認証情報により認証を実行する。
　スマートフォン５側の分散ファイルは、分散ファイル５０２から読み出されて近距離無線通信６を介してＰＣ４に送信される。復元処理部４１０は、スマートフォン５から受信したスマートフォン５側の分散ファイルと、分散ファイル４０４から読み出したＰＣ４側の分散ファイルを用いて復元処理を実行して認証情報を得る。ログイン認証部４１１は、復元処理部４１０で得た認証情報により認証を実行する。ログイン認証部４１１で認証に成功した場合は、そのユーザのＰＣ４へのログインを実行する。ログイン認証部４１１で認証に失敗した場合は、そのユーザのＰＣ４へのログインを拒絶する。 In step S6003 of FIG. 6, the information processing system 1 executes a login authentication process. Specifically, the login authentication unit 411 executes authentication based on the authentication information obtained by restoring the distributed file.
The distributed file on the smartphone 5 side is read from the distributed file 502 and transmitted to the PC 4 via the short-range wireless communication 6. The restoration processing unit 410 executes a restoration process using the distributed file on the smartphone 5 side received from the smartphone 5 and the distributed file on the PC4 side read from the distributed file 404 to obtain authentication information. The login authentication unit 411 executes authentication based on the authentication information obtained by the restoration processing unit 410. If the login authentication unit 411 succeeds in authentication, the user is logged in to the PC4. If the login authentication unit 411 fails to authenticate, the user refuses to log in to the PC4.
　また、情報処理システム１は、ステップＳ６００３で認証に成功しログインが実行された後、距離測定部４０１により測定したＰＣ４とスマートフォン５との距離が所定の距離を超えた場合は、ロック制御部４０３によりＰＣ４をロック状態にし、使用できないようにしてもよい。 Further, when the distance between the PC 4 and the smartphone 5 measured by the distance measuring unit 401 exceeds a predetermined distance after the authentication is successful and the login is executed in step S6003, the information processing system 1 has the lock control unit 403. This may lock the PC4 so that it cannot be used.
　図７は、本発明の実施例２に係る情報処理システム１の動作を説明する概略図である。図８は、本発明の実施例２の処理を示すフローチャートである。本実施例は、図１から図４を参照して上述した実施形態を基礎とした実施例であるため、図１から図４と同じ構成には同じ符号を付し、詳しい説明は省略する。 FIG. 7 is a schematic diagram illustrating the operation of the information processing system 1 according to the second embodiment of the present invention. FIG. 8 is a flowchart showing the process of the second embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
　本実施例は、図７に示すように、同一のユーザがスマートフォン５を携帯してＰＣ４にログインする場合と、スマートフォン５とは別のスマートフォンであるスマートフォン７を携帯してＰＣ４にログインする場合とについて、異なる処理を実行する実施例である。 In this embodiment, as shown in FIG. 7, the same user carries the smartphone 5 and logs in to the PC 4, and the same user carries the smartphone 7, which is a smartphone different from the smartphone 5, and logs in to the PC 4. It is an example which executes a different process with respect to.
　ユーザがスマートフォン５を携帯してＰＣ４にログインする場合は、実施例１と同様にログインでき、本実施例では、この場合に特に制限を設けない。一方、同一のユーザがスマートフォン７を携帯してＰＣ４にログインする場合は、各種の制限を加えることができる。
　本実施例では、スマートフォン５の紛失やスマートフォン５の故障の場合に、ユーザがＰＣ４にログインできなくなってしまうことを避け、スマートフォン７でもＰＣ４にログインできるが、スマートフォン７の場合は認証に制限を設けようというものである。 When the user carries the smartphone 5 and logs in to the PC 4, he / she can log in in the same manner as in the first embodiment, and in this embodiment, no particular limitation is provided in this case. On the other hand, when the same user carries the smartphone 7 and logs in to the PC 4, various restrictions can be added.
In this embodiment, in the case of loss of the smartphone 5 or failure of the smartphone 5, the user can avoid being unable to log in to the PC 4, and the smartphone 7 can also log in to the PC 4, but in the case of the smartphone 7, authentication is restricted. It is something like that.
　図８のステップＳ８００１において、情報処理システム１は、認証処理を実行する。具体的には、スマートフォン７の認証部（スマートフォン５の認証部５０４に相当）は、予め登録した指紋情報、虹彩情報、顔情報などによって、スマートフォン７を正当なユーザが操作しているのかを認証する。この際、スマートフォン７の認証部は、そのユーザが制限なく使用できるユーザか、制限を設けて使用できるユーザか、を判断する。情報処理システム１は、そのユーザが制限なく使用できるユーザであれば、以降、図６のステップＳ６００２及びＳ６００３と同様の処理を実行して処理を終了する。 In step S8001 of FIG. 8, the information processing system 1 executes the authentication process. Specifically, the authentication unit of the smartphone 7 (corresponding to the authentication unit 504 of the smartphone 5) authenticates whether a legitimate user is operating the smartphone 7 by using fingerprint information, iris information, face information, etc. registered in advance. To do. At this time, the authentication unit of the smartphone 7 determines whether the user can use the user without limitation or can use the smartphone with restrictions. If the user is a user who can use the information processing system 1 without limitation, the information processing system 1 subsequently executes the same processing as in steps S6002 and S6003 of FIG. 6 to end the processing.
　情報処理システム１は、そのユーザが制限なく使用できるユーザでなければ、そのユーザに対してあらかじめ定められた制限を課する。例えば、情報処理システム１は、スマートフォン７に設けたＧＰＳ受信機により現在位置を検出し、予め定めた場所（例えば会社、自宅）であれば、認証成功として処理をステップＳ８００２に進める。例えば、情報処理システム１は、スマートフォン７を操作しているユーザの上司の承認を入力する手段を設け、上司承認が入力された場合に認証成功として処理をステップＳ８００２に進める。例えば、情報処理システム１は、スマートフォン７を操作しているユーザに対してワンタイムパスワードを発行し、そのワンタイムパスワードがスマートフォン７に入力された場合に認証成功として処理をステップＳ８００２に進める。認証に失敗した場合は、図８の処理を終了する。 The information processing system 1 imposes predetermined restrictions on the user unless the user can use the user without restrictions. For example, the information processing system 1 detects the current position by the GPS receiver provided in the smartphone 7, and if it is a predetermined location (for example, a company or home), the process proceeds to step S8002 as authentication is successful. For example, the information processing system 1 provides a means for inputting the approval of the boss of the user operating the smartphone 7, and when the boss approval is input, the process proceeds to step S8002 as authentication success. For example, the information processing system 1 issues a one-time password to the user operating the smartphone 7, and when the one-time password is input to the smartphone 7, the process proceeds to step S8002 as authentication is successful. If the authentication fails, the process shown in FIG. 8 ends.
　続くステップＳ８００２は図６のステップＳ６００２に相当する処理であり、ステップＳ８００３は図６のステップＳ６００３に相当する処理であるので、説明を省略する。なお、本実施例では、スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイルが、スマートフォン７の分散ファイル７０２にも保存してあり、スマートフォン７が、分散ファイル７０２から読み出した分散ファイルをＰＣ４に送信することによってログイン認証が実行される。 Since the following step S8002 is a process corresponding to step S6002 in FIG. 6 and step S8003 is a process corresponding to step S6003 in FIG. 6, description thereof will be omitted. In this embodiment, the same file as the distributed file saved in the distributed file 502 of the smartphone 5 is also saved in the distributed file 702 of the smartphone 7, and the distributed file read from the distributed file 702 by the smartphone 7. Is sent to the PC4 to execute login authentication.
　図９は、本発明の実施例３に係る情報処理システム１の動作を説明する概略図である。図１０は、本発明の実施例３の処理を示すフローチャートである。本実施例は、図１から図４を参照して上述した実施形態を基礎とした実施例であるため、図１から図４と同じ構成には同じ符号を付し、詳しい説明は省略する。 FIG. 9 is a schematic diagram illustrating the operation of the information processing system 1 according to the third embodiment of the present invention. FIG. 10 is a flowchart showing the process of the third embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
　本実施例は、図９に示すように、同一のユーザがスマートフォン５を携帯してＰＣ４にログインする場合と、スマートフォン５とは別のスマートフォンであるスマートフォン８を携帯してＰＣ４にログインする場合とについて、異なる処理を実行する実施例である。 In this embodiment, as shown in FIG. 9, the same user carries the smartphone 5 and logs in to the PC 4, and the same user carries the smartphone 8 which is a smartphone different from the smartphone 5 and logs in to the PC 4. It is an example which executes a different process with respect to.
　ユーザがスマートフォン５を携帯してＰＣ４にログインする場合は、実施例１と同様にログインでき、本実施例では、この場合に特に制限を設けない。一方、同一のユーザがスマートフォン８を携帯してＰＣ４にログインする場合は、各種の制限を加えることができる。
　本実施例では、スマートフォン５の紛失やスマートフォン５の故障の場合に、ユーザがＰＣ４にログインできなくなってしまうことを避け、スマートフォン８でもＰＣ４にログインできるが、スマートフォン８の場合は認証に制限を設けようというものである。 When the user carries the smartphone 5 and logs in to the PC 4, he / she can log in in the same manner as in the first embodiment, and in this embodiment, no particular limitation is provided in this case. On the other hand, when the same user carries the smartphone 8 and logs in to the PC 4, various restrictions can be added.
In this embodiment, in the case of loss of the smartphone 5 or failure of the smartphone 5, the user can avoid being unable to log in to the PC 4, and the smartphone 8 can also log in to the PC 4, but in the case of the smartphone 8, authentication is restricted. It is something like that.
　図１０のステップＳ１０００１において、情報処理システム１は、認証処理を実行する。具体的には、スマートフォン８の認証部（スマートフォン５の認証部５０４に相当）は、予め登録した指紋情報、虹彩情報、顔情報などによって、スマートフォン８を正当なユーザが操作しているのかを認証する。この際、スマートフォン８の認証部は、そのユーザが制限なく使用できるユーザか、制限を設けて使用できるユーザか、を判断する。情報処理システム１は、そのユーザが制限なく使用できるユーザであれば、以降、図６のステップＳ６００２及びＳ６００３と同様の処理を実行して処理を終了する。 In step S10001 of FIG. 10, the information processing system 1 executes the authentication process. Specifically, the authentication unit of the smartphone 8 (corresponding to the authentication unit 504 of the smartphone 5) authenticates whether a legitimate user is operating the smartphone 8 by using fingerprint information, iris information, face information, etc. registered in advance. To do. At this time, the authentication unit of the smartphone 8 determines whether the user can be used without limitation or can be used with limitation. If the user is a user who can use the information processing system 1 without limitation, the information processing system 1 subsequently executes the same processing as in steps S6002 and S6003 of FIG. 6 to end the processing.
　情報処理システム１は、そのユーザが制限なく使用できるユーザでなければ、ステップＳ１０００２に処理を進める。本実施例では、スマートフォン８の分散ファイル８０２には、スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイルを保存していない。スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイルは、クラウド８ａの分散ファイル８０２ａに保存してある。スマートフォン８は、クラウド８ａの分散ファイル８０２ａに保存してある分散ファイル（スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイル）を、所定の制限のもとに分散ファイル８０２にダウンロードし、以降の認証に使用する。 The information processing system 1 proceeds to step S10002 if the user is not a user who can use it without limitation. In this embodiment, the distributed file 802 of the smartphone 8 does not store the same file as the distributed file stored in the distributed file 502 of the smartphone 5. The same file as the distributed file saved in the distributed file 502 of the smartphone 5 is saved in the distributed file 802a of the cloud 8a. The smartphone 8 downloads the distributed file stored in the distributed file 802a of the cloud 8a (the same file as the distributed file stored in the distributed file 502 of the smartphone 5) to the distributed file 802 under predetermined restrictions. , Used for subsequent authentication.
　例えば、ステップＳ１０００２において、情報処理システム１は、スマートフォン８に設けたＧＰＳ受信機により現在位置を検出し、予め定めた場所（例えば会社、自宅）であれば、認証成功として、分散ファイル８０２ａに保存してある分散ファイル（スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイル）を、分散ファイル８０２にダウンロードする。 For example, in step S10002, the information processing system 1 detects the current position by the GPS receiver provided in the smartphone 8, and if it is a predetermined location (for example, a company or home), it is saved in the distributed file 802a as authentication success. The distributed file (the same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802.
　例えば、情報処理システム１は、スマートフォン７を操作しているユーザの上司の承認を入力する手段を設け、上司承認が入力された場合に認証成功として、分散ファイル８０２ａに保存してある分散ファイル（スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイル）を、分散ファイル８０２にダウンロードする。なお、情報処理システム１は、上司承認１回につき、１回のダウンロードができるという制限を設けてもよい。 For example, the information processing system 1 provides a means for inputting the approval of the boss of the user operating the smartphone 7, and when the boss approval is input, the authentication is successful and the distributed file stored in the distributed file 802a ( The same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802. The information processing system 1 may be limited to one download per approval by the boss.
　例えば、情報処理システム１は、スマートフォン７を操作しているユーザに対してワンタイムパスワードを発行し、そのワンタイムパスワードがスマートフォン７に入力された場合に認証成功として、分散ファイル８０２ａに保存してある分散ファイル（スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイル）を、分散ファイル８０２にダウンロードする。 For example, the information processing system 1 issues a one-time password to the user operating the smartphone 7, and when the one-time password is entered in the smartphone 7, the authentication is successful and the file is saved in the distributed file 802a. A certain distributed file (the same file as the distributed file saved in the distributed file 502 of the smartphone 5) is downloaded to the distributed file 802.
　なお、情報処理システム１は、分散ファイル８０２にダウンロードした分散ファイルは、当日中にのみ有効であるとしてもよい。 Note that the information processing system 1 may consider that the distributed file downloaded to the distributed file 802 is valid only on the same day.
　続くステップＳ１０００２は図６のステップＳ６００２に相当する処理であり、ステップＳ１０００３は図６のステップＳ６００３に相当する処理であるので、説明を省略する。なお、本実施例では、スマートフォン５の分散ファイル５０２に保存してある分散ファイルと同じファイルを、スマートフォン８の分散ファイル８０２にダウンロードし、スマートフォン８が、分散ファイル８０２から読み出した分散ファイルをＰＣ４に送信することによってログイン認証が実行される。 Since the following step S10002 is a process corresponding to step S6002 in FIG. 6 and step S1003 is a process corresponding to step S6003 in FIG. 6, description thereof will be omitted. In this embodiment, the same file as the distributed file saved in the distributed file 502 of the smartphone 5 is downloaded to the distributed file 802 of the smartphone 8, and the distributed file read from the distributed file 802 by the smartphone 8 is transferred to the PC 4. Login authentication is executed by sending.
　図１１は、本発明の実施例４に係る情報処理システム１の動作を説明する概略図である。図１２は、本発明の実施例４の処理を示すフローチャートである。本実施例は、図１から図４を参照して上述した実施形態を基礎とした実施例であるため、図１から図４と同じ構成には同じ符号を付し、詳しい説明は省略する。 FIG. 11 is a schematic diagram illustrating the operation of the information processing system 1 according to the fourth embodiment of the present invention. FIG. 12 is a flowchart showing the process of the fourth embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
　本実施例は、秘密分散の対象ファイルである特定ファイルについて、あるユーザ（ユーザＡとする）はその特定ファイルの更新が可能な状態とし、別のユーザ（ユーザＢとする）はその特定ファイルの参照が可能な状態とする場合の例である。特定ファイルは認証情報でもよいし、他の如何なる情報のファイルであってもよい。 In this embodiment, for a specific file that is a target file of secret sharing, a certain user (referred to as user A) can update the specific file, and another user (referred to as user B) of the specific file. This is an example when the reference is possible. The specific file may be authentication information or any other information file.
　分散処理部４０７は、特定ファイルをＡＯＮＴにより２分割し、分散ファイル４０４に保存する。具体的には、分散処理部４０７は、特定ファイルをファイル４０４ａとファイル４０４ｂとに分割する。さらに分散処理部４０７は、ファイル４０４ｂを閾値分散により３分割する。情報処理システム１は、分散処理部４０７により３分割したファイルのうちのあるひとつをＰＣ４の分散ファイル４０４に保存し、分散処理部４０７により３分割したファイルのうちの別のひとつをスマートフォン５の分散ファイル５０２に保存し、分散処理部４０７により３分割したファイルのうちのさらに別のひとつをスマートフォン９の分散ファイル９０２に保存する。本実施例では、閾値分散によりファイルを３分割した場合に、３つのうちの２つがあれば、元のファイルを復元できるようにしている。また本実施例では、ユーザＡのスマートフォン５の分散ファイル５０２に保存したファイルの属性を更新可能な属性としておくことで、ユーザＡは、復元した特定ファイルを更新可能とすることができる。また本実施例では、ユーザＢのスマートフォン９の分散ファイル９０２に保存したファイルの属性を参照可能な属性としておくことで、ユーザＢは、復元した特定ファイルを参照可能とすることができる。本実施例によれば、これにより、ユーザ毎に特定ファイルのアクセス制限を定めることができる。 The distributed processing unit 407 divides the specific file into two by AONT and saves it in the distributed file 404. Specifically, the distributed processing unit 407 divides the specific file into a file 404a and a file 404b. Further, the dispersion processing unit 407 divides the file 404b into three by threshold dispersion. The information processing system 1 stores one of the files divided into three by the distributed processing unit 407 in the distributed file 404 of the PC 4, and distributes another one of the files divided into three by the distributed processing unit 407 of the smartphone 5. The file is saved in the file 502, and another one of the files divided into three by the distributed processing unit 407 is saved in the distributed file 902 of the smartphone 9. In this embodiment, when the file is divided into three by the threshold variance, the original file can be restored if there are two of the three. Further, in this embodiment, the user A can update the restored specific file by setting the attribute of the file saved in the distributed file 502 of the smartphone 5 of the user A as an updatable attribute. Further, in this embodiment, by setting the attribute of the file saved in the distributed file 902 of the smartphone 9 of the user B as a referenceable attribute, the user B can refer to the restored specific file. According to this embodiment, it is possible to set access restrictions for specific files for each user.
　図１０のステップＳ１２００１において、情報処理システム１は、デバイス認証処理を実行する。このデバイス認証処理において、スマートフォン５又はスマートフォン９がＰＣ４とのブルートゥース接続が許可された装置であることが認証された場合は、処理をステップＳ１２００２に進める。 In step S12001 of FIG. 10, the information processing system 1 executes the device authentication process. In this device authentication process, if it is authenticated that the smartphone 5 or the smartphone 9 is a device that is permitted to connect to the PC 4 via Bluetooth, the process proceeds to step S12002.
　ステップＳ１２００２において、ＰＣ４は、スマートフォン５の分散ファイル５０２のファイル及びスマートフォン９の分散ファイル９０２のファイルのいずれか一方を受信する。復元処理部４１０は、この受信したファイルと、３分割したファイルのうちのあるひとつであってＰＣ４の分散ファイル４０４に保存してあるファイルとを用いて、ファイル４０４ｂを復元する。さらに復元処理部４１０は、復元したファイル４０４ｂと、ＰＣ４の分散ファイル４０４に保存してあるファイル４０４ａとを用いて特定ファイルを復元する。 In step S12002, the PC 4 receives either the file of the distributed file 502 of the smartphone 5 or the file of the distributed file 902 of the smartphone 9. The restoration processing unit 410 restores the file 404b by using the received file and a file that is one of the three divided files and is stored in the distributed file 404 of the PC4. Further, the restoration processing unit 410 restores the specific file by using the restored file 404b and the file 404a stored in the distributed file 404 of the PC4.
　ステップＳ１２００３において、情報処理システム１は、スマートフォン５又はスマートフォン９のユーザに対して、ステップＳ１２００２で復元した特定ファイルのアクセス権限を与える。このとき、スマートフォン５の分散ファイル５０２のファイル又はスマートフォン９の分散ファイル９０２のファイルの属性に応じてアクセスが制限される。 In step S12003, the information processing system 1 gives the user of the smartphone 5 or the smartphone 9 access authority to the specific file restored in step S12002. At this time, access is restricted according to the attributes of the file of the distributed file 502 of the smartphone 5 or the file of the distributed file 902 of the smartphone 9.
　図１３は、本発明の実施例５に係る情報処理システム１の動作を説明する概略図である。図１４は、本発明の実施例５の処理を示すフローチャートである。本実施例は、図１から図４を参照して上述した実施形態を基礎とした実施例であるため、図１から図４と同じ構成には同じ符号を付し、詳しい説明は省略する。 FIG. 13 is a schematic diagram illustrating the operation of the information processing system 1 according to the fifth embodiment of the present invention. FIG. 14 is a flowchart showing the process of the fifth embodiment of the present invention. Since this embodiment is an embodiment based on the above-described embodiment with reference to FIGS. 1 to 4, the same components as those in FIGS. 1 to 4 are designated by the same reference numerals, and detailed description thereof will be omitted.
　本実施例は、ＰＣ４において、分散ファイルを復元することで認証情報を得てログイン認証を実行しログインした場合と、他の方法（例えばＩＤとパスワードを入力する方法）でログインした場合とで、そのユーザに提供する機能を異ならせる。例えば、分散ファイルを復元することでログインした場合は、ＰＣ４においてネットワークを利用可能とし、ネットワーク３に接続されたクラウド４ａを利用可能とする。例えば、ＩＤ及びパスワードでログインした場合は、ＰＣ４においてネットワークを利用不可とし、ネットワーク３に接続されたクラウド４ａを利用不可とする。
　例えば、ユーザがＰＣ４にログインして使用するファイルのうち特定ファイルをあらかじめクラウド４ａに移動しておくことで、ユーザがアクセス可能なファイルを制限することができる。
　また、例えば、ユーザがＰＣ４にログインして使用するファイルを秘密分散技術により分散し、分散ファイルの一部をあらかじめクラウド４ａに移動しておくことで、ユーザがアクセス可能なファイルを制限するようにしてもよい。 In this embodiment, there are cases where the PC4 is logged in by obtaining authentication information by restoring the distributed file and performing login authentication, and a case where the user logs in by another method (for example, a method of entering an ID and password). Different functions are provided to the user. For example, when logging in by restoring a distributed file, the network can be used on the PC 4 and the cloud 4a connected to the network 3 can be used. For example, when logged in with an ID and password, the network is disabled on the PC 4 and the cloud 4a connected to the network 3 is disabled.
For example, by moving a specific file among the files used by the user to log in to the PC 4 to the cloud 4a in advance, the files that the user can access can be restricted.
Further, for example, the files that the user logs in to the PC 4 and used are distributed by the secret sharing technology, and a part of the distributed files is moved to the cloud 4a in advance to limit the files that the user can access. You may.
　図１４のステップＳ１４００１において、情報処理システム１は、ログイン認証処理を実行する。このログイン認証処理では、分散ファイルを復元することでログインする方法、及び他の方法のいずれでもログイン可能とする。 In step S14001 of FIG. 14, the information processing system 1 executes the login authentication process. In this login authentication process, it is possible to log in by either a method of logging in by restoring the distributed file or another method.
　ステップＳ１４００２において、ＰＣ４は、ログイン認証の方法に応じて機能制限をかける。この機能制限は、上述のようにネットワーク接続の可否を定めるものであってもよいし、ＰＣ４が提供する他の如何なる機能についての制限であってもよい。 In step S14002, the PC4 limits the functions according to the login authentication method. This function restriction may determine whether or not network connection is possible as described above, or may be a restriction on any other function provided by the PC 4.
　以上、本発明の好ましい実施形態について説明したが、本発明は、これらの実施形態に限定されるものではない。本発明の目的は、上述の実施例の機能を実現するプログラムコード（コンピュータプログラム）を格納した記憶媒体をシステムあるいは装置に供給し、供給されたシステムあるいは装置のコンピュータが記憶媒体に格納されたプログラムコードを読み出し実行することによっても達成される。この場合、記憶媒体から読み出されたプログラムコード自体が上述した実施例の機能を実現することになり、そのプログラムコードを記憶した記憶媒体は本発明を構成することになる。また、上述した実施形態では、コンピュータがプログラムを実行することにより、各処理部として機能するものとしたが、処理の一部または全部を専用の電子回路（ハードウェア）で構成するようにしても構わない。本発明は、説明された特定の実施例に限定されるものではなく、特許請求の範囲に記載された本発明の趣旨の範囲内において、種々の変形・変更が可能である。 Although the preferred embodiments of the present invention have been described above, the present invention is not limited to these embodiments. An object of the present invention is to supply a storage medium containing a program code (computer program) that realizes the functions of the above-described embodiment to a system or device, and a program in which the computer of the supplied system or device is stored in the storage medium. It is also achieved by reading and executing the code. In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the storage medium storing the program code constitutes the present invention. Further, in the above-described embodiment, the computer functions as each processing unit by executing the program, but even if a part or all of the processing is configured by a dedicated electronic circuit (hardware). I do not care. The present invention is not limited to the specific examples described, and various modifications and modifications can be made within the scope of the gist of the present invention described in the claims.
１　情報処理システム
２　サーバ
３　ネットワーク
４　ＰＣ
５　スマートフォン
６　ブルートゥース 1 Information processing system 2 Server 3 Network 4 PC
5 smartphone 6 bluetooth

Claims (11)

  1. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散部と、
    　前記第１分散ファイルを第１情報処理装置に記憶する第１記憶部と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶部と、
    　前記第２情報処理装置の使用者が正当な使用者であることを認証する使用者認証部と、
    　前記使用者認証部により前記第２情報処理装置の使用者が正当な使用者であると認証された場合にのみ前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続する通信部と、
    　前記第２記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する送信部と、
    　前記通信部によって前記第２情報処理装置から前記第２分散ファイルを受信する受信部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する復元部と、
    　前記復元部で復元した前記認証情報を用いて前記第１情報処理装置のログイン認証を行うログイン認証部と、を有する
    ことを特徴とする情報処理システム。     A distributed part that distributes authentication information to the first distributed file and the second distributed file by the secret sharing method,
    A first storage unit that stores the first distributed file in the first information processing device, and
    A second storage unit that stores the second distributed file in the second information processing device, and
    A user authentication unit that authenticates that the user of the second information processing device is a legitimate user,
    The first information processing device and the second information processing device are connected by short-range wireless communication only when the user of the second information processing device is authenticated as a legitimate user by the user authentication unit. Communication department and
    A transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and a transmission unit.
    A receiving unit that receives the second distributed file from the second information processing device by the communication unit, and a receiving unit.
    A restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the reception unit.
    An information processing system including a login authentication unit that performs login authentication of the first information processing apparatus using the authentication information restored by the restoration unit.
  2. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散部と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶部と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶部と、
    　前記第２分散ファイルを第３情報処理装置に記憶する第３記憶部と、
    　前記第３情報処理装置の使用者が正当な使用者であることを認証する使用者認証部と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続するとともに、前記使用者認証部により前記第３情報処理装置の使用者が正当な使用者であると認証された場合にのみ前記第１情報処理装置と前記第３情報処理装置とを近距離無線通信で接続する通信部と、
    　前記第２記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する第１送信部と、
    　前記第３記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する第２送信部と、
    　前記通信部によって前記第２情報処理装置から前記第２分散ファイルを受信する第１受信部と、
    　前記通信部によって前記第３情報処理装置から前記第２分散ファイルを受信する第２受信部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記第１受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する第１復元部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記第２受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する第２復元部と、
    　前記第１復元部または前記第２復元部で復元した前記認証情報を用いて前記第１情報処理装置へのログイン認証を行うログイン認証部と、を有する
    ことを特徴とする情報処理システム。     A distributed part that distributes authentication information to the first distributed file and the second distributed file by the secret sharing method,
    A first storage unit that stores the first distributed file in the first information processing device, and
    A second storage unit that stores the second distributed file in the second information processing device, and
    A third storage unit that stores the second distributed file in the third information processing device, and
    A user authentication unit that authenticates that the user of the third information processing device is a legitimate user,
    The first information processing device and the second information processing device are connected by short-range wireless communication, and the user of the third information processing device is authenticated as a legitimate user by the user authentication unit. Only in the case of a communication unit that connects the first information processing device and the third information processing device by short-range wireless communication,
    A first transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and a first transmission unit.
    A second transmission unit that transmits the second distributed file stored in the third storage unit to the first information processing device by the communication unit, and a second transmission unit.
    A first receiving unit that receives the second distributed file from the second information processing device by the communication unit, and
    A second receiving unit that receives the second distributed file from the third information processing device by the communication unit, and
    A first restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the first receiving unit.
    A second restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the second receiving unit.
    An information processing system including a login authentication unit that performs login authentication to the first information processing apparatus using the authentication information restored by the first restoration unit or the second restoration unit.
  3. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散部と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶部と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶部と、
    　前記第２分散ファイルを第４情報処理装置に記憶する第４記憶部と、
    　第３情報処理装置の使用者が正当な使用者であることを認証する使用者認証部と、
    　前記使用者認証部により前記第３情報処理装置の使用者が正当な使用者であると認証された場合にのみ、前記第４記憶部で記憶した前記第２分散ファイルを前記第３情報処理装置に記憶する第３記憶部と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続するとともに、前記第１情報処理装置と前記第３情報処理装置とを近距離無線通信で接続する通信部と、
    　前記第２記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する第１送信部と、
    　前記第３記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する第２送信部と、
    　前記通信部によって前記第２情報処理装置から前記第２分散ファイルを受信する第１受信部と、
    　前記通信部によって前記第３情報処理装置から前記第２分散ファイルを受信する第２受信部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記第１受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する第１復元部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記第２受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する第２復元部と、
    　前記第１復元部または前記第２復元部で復元した前記認証情報を用いて前記第１情報処理装置へのログイン認証を行うログイン認証部と、を有する
    ことを特徴とする情報処理システム。     A distributed part that distributes authentication information to the first distributed file and the second distributed file by the secret sharing method,
    A first storage unit that stores the first distributed file in the first information processing device, and
    A second storage unit that stores the second distributed file in the second information processing device, and
    A fourth storage unit that stores the second distributed file in the fourth information processing device, and
    The user authentication unit that authenticates that the user of the third information processing device is a legitimate user,
    Only when the user of the third information processing device is authenticated by the user authentication unit as a legitimate user, the second distributed file stored in the fourth storage unit is stored in the third information processing device. The third storage unit to be stored in
    A communication unit that connects the first information processing device and the second information processing device by short-range wireless communication, and connects the first information processing device and the third information processing device by short-range wireless communication.
    A first transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and a first transmission unit.
    A second transmission unit that transmits the second distributed file stored in the third storage unit to the first information processing device by the communication unit, and a second transmission unit.
    A first receiving unit that receives the second distributed file from the second information processing device by the communication unit, and
    A second receiving unit that receives the second distributed file from the third information processing device by the communication unit, and
    A first restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the first receiving unit.
    A second restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the second receiving unit.
    An information processing system including a login authentication unit that performs login authentication to the first information processing apparatus using the authentication information restored by the first restoration unit or the second restoration unit.
  4. 　対象ファイルを秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する第１分散部と、
    　前記第２分散ファイルを秘密分散法にて第３分散ファイル、第４分散ファイル及び第５分散ファイルに分散する第２分散部と、
    　前記第１分散ファイルを第１情報処理装置に記憶する第１記憶部と、
    　前記第３分散ファイルを前記第１情報処理装置に記憶する第２記憶部と、
    　前記第４分散ファイルを第２情報処理装置に記憶する第３記憶部と、
    　前記第５分散ファイルを第３情報処理装置に記憶する第４記憶部と、
    　前記第３記憶部で記憶した前記第４分散ファイルと前記第２記憶部で記憶した前記第３分散ファイルとを用いて前記第２分散ファイルを復元する第１復元部と、
    　前記第４記憶部で記憶した前記第５分散ファイルと前記第２記憶部で記憶した前記第３分散ファイルとを用いて前記第２分散ファイルを復元する第２復元部と、
    　前記第１復元部で復元した前記第２分散ファイルと前記第１記憶部で記憶した前記第１分散ファイルとを用いて前記対象ファイルを復元する第３復元部と、
    　前記第２復元部で復元した前記第２分散ファイルと前記第１記憶部で記憶した前記第１分散ファイルとを用いて前記対象ファイルを復元する第４復元部と、
    　前記第３復元部で復元した前記対象ファイルと前記第４復元部で復元した前記対象ファイルとでファイル属性を異ならせる
    ことを特徴とする情報処理システム。     The first distributed part that distributes the target file to the first distributed file and the second distributed file by the secret sharing method, and
    A second distributed unit that distributes the second distributed file into a third distributed file, a fourth distributed file, and a fifth distributed file by a secret sharing method.
    A first storage unit that stores the first distributed file in the first information processing device, and
    A second storage unit that stores the third distributed file in the first information processing device, and
    A third storage unit that stores the fourth distributed file in the second information processing device, and
    A fourth storage unit that stores the fifth distributed file in the third information processing device, and
    A first restoration unit that restores the second distributed file using the fourth distributed file stored in the third storage unit and the third distributed file stored in the second storage unit.
    A second restoration unit that restores the second distributed file using the fifth distributed file stored in the fourth storage unit and the third distributed file stored in the second storage unit.
    A third restoration unit that restores the target file using the second distributed file restored by the first restoration unit and the first distributed file stored in the first storage unit, and a third restoration unit.
    A fourth restoration unit that restores the target file using the second distributed file restored by the second restoration unit and the first distributed file stored in the first storage unit, and a fourth restoration unit.
    An information processing system characterized in that the file attributes of the target file restored by the third restoration unit and the target file restored by the fourth restoration unit are different.
  5. 　認証情報を用いて第１情報処理装置のログイン認証を行うログイン認証部と、
    　前記認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散部と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶部と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶部と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続する通信部と、
    　前記第２記憶部で記憶した前記第２分散ファイルを前記通信部によって前記第１情報処理装置に送信する送信部と、
    　前記通信部によって前記第２情報処理装置から前記第２分散ファイルを受信する受信部と、
    　前記第１記憶部で記憶した前記第１分散ファイルと前記受信部で受信した前記第２分散ファイルとを用いて前記認証情報を復元する復元部と、
    　前記復元部で復元した前記認証情報を用いて前記第１情報処理装置にログインした場合に比べて、他の方法で前記第１情報処理装置にログインした場合に実行可能な前記第１情報処理装置の機能を制限ずるよう制御する制御部と、を有する
    ことを特徴とする情報処理システム。     A login authentication unit that performs login authentication for the first information processing device using authentication information,
    A distribution unit that distributes the authentication information to the first distributed file and the second distributed file by the secret sharing method, and
    A first storage unit that stores the first distributed file in the first information processing device, and
    A second storage unit that stores the second distributed file in the second information processing device, and
    A communication unit that connects the first information processing device and the second information processing device by short-range wireless communication,
    A transmission unit that transmits the second distributed file stored in the second storage unit to the first information processing device by the communication unit, and a transmission unit.
    A receiving unit that receives the second distributed file from the second information processing device by the communication unit, and a receiving unit.
    A restoration unit that restores the authentication information using the first distributed file stored in the first storage unit and the second distributed file received by the reception unit.
    The first information processing apparatus that can be executed when the first information processing apparatus is logged in by another method as compared with the case where the authentication information restored by the restoration unit is used to log in to the first information processing apparatus. An information processing system characterized by having a control unit that controls so as to limit the functions of the information processing system.
  6. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散工程と、
    　前記第１分散ファイルを第１情報処理装置に記憶する第１記憶工程と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶工程と、
    　前記第２情報処理装置の使用者が正当な使用者であることを認証する使用者認証工程と、
    　前記使用者認証工程により前記第２情報処理装置の使用者が正当な使用者であると認証された場合にのみ前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続する通信工程と、
    　前記第２記憶工程で記憶した前記第２分散ファイルを前記通信工程により前記第１情報処理装置に送信する送信工程と、
    　前記通信工程によって前記第２情報処理装置から前記第２分散ファイルを受信する受信工程と、
    　前記第１記憶工程で記憶した前記第１分散ファイルと前記受信工程で受信した前記第２分散ファイルとを用いて前記認証情報を復元する復元工程と、
    　前記復元工程で復元した前記認証情報を用いて前記第１情報処理装置のログイン認証を行うログイン認証工程と、を有する
    ことを特徴とする情報処理方法。     A distribution process that distributes authentication information to a first distributed file and a second distributed file by the secret sharing method,
    A first storage step of storing the first distributed file in the first information processing device, and
    A second storage step of storing the second distributed file in the second information processing device, and
    A user authentication process for authenticating that the user of the second information processing apparatus is a legitimate user, and
    The first information processing device and the second information processing device are connected by short-range wireless communication only when the user of the second information processing device is authenticated as a legitimate user by the user authentication step. Communication process and
    A transmission step of transmitting the second distributed file stored in the second storage step to the first information processing apparatus by the communication step, and a transmission step of transmitting the second distributed file to the first information processing apparatus.
    A receiving step of receiving the second distributed file from the second information processing apparatus by the communication step, and
    A restoration step of restoring the authentication information using the first distributed file stored in the first storage step and the second distributed file received in the receiving step, and a restoration step.
    An information processing method comprising: a login authentication step of performing login authentication of the first information processing apparatus using the authentication information restored in the restoration step.
  7. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散工程と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶工程と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶工程と、
    　前記第２分散ファイルを第３情報処理装置に記憶する第３記憶工程と、
    　前記第３情報処理装置の使用者が正当な使用者であることを認証する使用者認証工程と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続するとともに、前記使用者認証工程により前記第３情報処理装置の使用者が正当な使用者であると認証された場合にのみ前記第１情報処理装置と前記第３情報処理装置とを近距離無線通信で接続する通信工程と、
    　前記第２記憶工程により記憶した前記第２分散ファイルを前記通信工程によって前記第１情報処理装置に送信する第１送信工程と、
    　前記第３記憶工程により記憶した前記第２分散ファイルを前記通信工程によって前記第１情報処理装置に送信する第２送信工程と、
    　前記通信工程によって前記第２情報処理装置から前記第２分散ファイルを受信する第１受信工程と、
    　前記通信工程によって前記第３情報処理装置から前記第２分散ファイルを受信する第２受信工程と、
    　前記第１記憶工程により記憶した前記第１分散ファイルと前記第１受信工程により受信した前記第２分散ファイルとを用いて前記認証情報を復元する第１復元工程と、
    　前記第１記憶工程により記憶した前記第１分散ファイルと前記第２受信工程により受信した前記第２分散ファイルとを用いて前記認証情報を復元する第２復元工程と、
    　前記第１復元工程または前記第２復元工程で復元した前記認証情報を用いて前記第１情報処理装置へのログイン認証を行うログイン認証工程と、を有する
    ことを特徴とする情報処理方法。     A distribution process that distributes authentication information to a first distributed file and a second distributed file by the secret sharing method,
    A first storage step of storing the first distributed file in the first information processing device, and
    A second storage step of storing the second distributed file in the second information processing device, and
    A third storage step of storing the second distributed file in the third information processing device, and
    A user authentication process for authenticating that the user of the third information processing apparatus is a legitimate user, and
    The first information processing device and the second information processing device are connected by short-range wireless communication, and the user of the third information processing device is authenticated as a legitimate user by the user authentication step. Only in the case of a communication process in which the first information processing device and the third information processing device are connected by short-range wireless communication,
    A first transmission step of transmitting the second distributed file stored in the second storage step to the first information processing apparatus by the communication step, and a first transmission step.
    A second transmission step of transmitting the second distributed file stored in the third storage step to the first information processing apparatus by the communication step, and a second transmission step.
    A first receiving step of receiving the second distributed file from the second information processing apparatus by the communication step, and
    A second receiving step of receiving the second distributed file from the third information processing apparatus by the communication step, and
    A first restoration step of restoring the authentication information using the first distributed file stored by the first storage step and the second distributed file received by the first receiving step.
    A second restoration step of restoring the authentication information using the first distributed file stored by the first storage step and the second distributed file received by the second receiving step.
    An information processing method comprising: a login authentication step of performing login authentication to the first information processing apparatus using the authentication information restored in the first restoration step or the second restoration step.
  8. 　認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散工程と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶工程と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶工程と、
    　前記第２分散ファイルを第４情報処理装置に記憶する第４記憶工程と、
    　第３情報処理装置の使用者が正当な使用者であることを認証する使用者認証工程と、
    　前記使用者認証工程により前記第３情報処理装置の使用者が正当な使用者であると認証された場合にのみ、前記第４記憶工程により記憶した前記第２分散ファイルを前記第３情報処理装置に記憶する第３記憶工程と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続するとともに、前記第１情報処理装置と前記第３情報処理装置とを近距離無線通信で接続する通信工程と、
    　前記第２記憶工程により記憶した前記第２分散ファイルを前記通信工程によって前記第１情報処理装置に送信する第１送信工程と、
    　前記第３記憶工程により記憶した前記第２分散ファイルを前記通信工程によって前記第１情報処理装置に送信する第２送信工程と、
    　前記通信工程によって前記第２情報処理装置から前記第２分散ファイルを受信する第１受信工程と、
    　前記通信工程によって前記第３情報処理装置から前記第２分散ファイルを受信する第２受信工程と、
    　前記第１記憶工程により記憶した前記第１分散ファイルと前記第１受信工程により受信した前記第２分散ファイルとを用いて前記認証情報を復元する第１復元工程と、
    　前記第１記憶工程により記憶した前記第１分散ファイルと前記第２受信工程により受信した前記第２分散ファイルとを用いて前記認証情報を復元する第２復元工程と、
    　前記第１復元工程または前記第２復元工程で復元した前記認証情報を用いて前記第１情報処理装置へのログイン認証を行うログイン認証工程と、を有する
    ことを特徴とする情報処理方法。     A distribution process that distributes authentication information to a first distributed file and a second distributed file by the secret sharing method,
    A first storage step of storing the first distributed file in the first information processing device, and
    A second storage step of storing the second distributed file in the second information processing device, and
    A fourth storage step of storing the second distributed file in the fourth information processing device, and
    A user authentication process that authenticates that the user of the third information processing device is a legitimate user,
    Only when the user of the third information processing apparatus is authenticated as a legitimate user by the user authentication step, the second distributed file stored by the fourth storage step is stored in the third information processing apparatus. The third storage process to be stored in
    A communication process in which the first information processing device and the second information processing device are connected by short-range wireless communication, and the first information processing device and the third information processing device are connected by short-range wireless communication.
    A first transmission step of transmitting the second distributed file stored in the second storage step to the first information processing apparatus by the communication step, and a first transmission step.
    A second transmission step of transmitting the second distributed file stored in the third storage step to the first information processing apparatus by the communication step, and a second transmission step.
    A first receiving step of receiving the second distributed file from the second information processing apparatus by the communication step, and
    A second receiving step of receiving the second distributed file from the third information processing apparatus by the communication step, and
    A first restoration step of restoring the authentication information using the first distributed file stored by the first storage step and the second distributed file received by the first receiving step.
    A second restoration step of restoring the authentication information using the first distributed file stored by the first storage step and the second distributed file received by the second receiving step.
    An information processing method comprising: a login authentication step of performing login authentication to the first information processing apparatus using the authentication information restored in the first restoration step or the second restoration step.
  9. 　対象ファイルを秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する第１分散工程と、
    　前記第２分散ファイルを秘密分散法にて第３分散ファイル、第４分散ファイル及び第５分散ファイルに分散する第２分散工程と、
    　前記第１分散ファイルを第１情報処理装置に記憶する第１記憶工程と、
    　前記第３分散ファイルを前記第１情報処理装置に記憶する第２記憶工程と、
    　前記第４分散ファイルを第２情報処理装置に記憶する第３記憶工程と、
    　前記第５分散ファイルを第３情報処理装置に記憶する第４記憶工程と、
    　前記第３記憶工程により記憶した前記第４分散ファイルと前記第２記憶工程により記憶した前記第３分散ファイルとを用いて前記第２分散ファイルを復元する第１復元工程と、
    　前記第４記憶工程により記憶した前記第５分散ファイルと前記第２記憶工程により記憶した前記第３分散ファイルとを用いて前記第２分散ファイルを復元する第２復元工程と、
    　前記第１復元工程により復元した前記第２分散ファイルと前記第１記憶工程により記憶した前記第１分散ファイルとを用いて前記対象ファイルを復元する第３復元工程と、
    　前記第２復元工程により復元した前記第２分散ファイルと前記第１記憶工程により記憶した前記第１分散ファイルとを用いて前記対象ファイルを復元する第４復元工程と、
    　前記第３復元工程により復元した前記対象ファイルと前記第４復元工程により復元した前記対象ファイルとでファイル属性を異ならせる
    ことを特徴とする情報処理方法。     The first distributed process of distributing the target file to the first distributed file and the second distributed file by the secret sharing method, and
    A second distributed step of distributing the second distributed file into a third distributed file, a fourth distributed file, and a fifth distributed file by a secret sharing method.
    A first storage step of storing the first distributed file in the first information processing device, and
    A second storage step of storing the third distributed file in the first information processing device, and
    A third storage step of storing the fourth distributed file in the second information processing device, and
    A fourth storage step of storing the fifth distributed file in the third information processing device, and
    A first restoration step of restoring the second distributed file using the fourth distributed file stored by the third storage step and the third distributed file stored by the second storage step.
    A second restoration step of restoring the second distributed file using the fifth distributed file stored in the fourth storage step and the third distributed file stored in the second storage step.
    A third restoration step of restoring the target file using the second distributed file restored by the first restoration step and the first distributed file stored by the first storage step, and a third restoration step.
    A fourth restoration step of restoring the target file using the second distributed file restored by the second restoration step and the first distributed file stored by the first storage step.
    An information processing method characterized in that the file attributes of the target file restored by the third restoration step and the target file restored by the fourth restoration step are different.
  10. 　認証情報を用いて第１情報処理装置のログイン認証を行うログイン認証工程と、
    　前記認証情報を秘密分散法にて第１分散ファイル及び第２分散ファイルに分散する分散工程と、
    　前記第１分散ファイルを前記第１情報処理装置に記憶する第１記憶工程と、
    　前記第２分散ファイルを第２情報処理装置に記憶する第２記憶工程と、
    　前記第１情報処理装置と前記第２情報処理装置とを近距離無線通信で接続する通信工程と、
    　前記第２記憶工程で記憶した前記第２分散ファイルを前記通信工程によって前記第１情報処理装置に送信する送信工程と、
    　前記通信工程によって前記第２情報処理装置から前記第２分散ファイルを受信する受信工程と、
    　前記第１記憶工程により記憶した前記第１分散ファイルと前記受信工程により受信した前記第２分散ファイルとを用いて前記認証情報を復元する復元工程と、
    　前記復元工程により復元した前記認証情報を用いて前記第１情報処理装置にログインした場合に比べて、他の方法で前記第１情報処理装置にログインした場合に実行可能な前記第１情報処理装置の機能を制限ずるよう制御する制御工程と、を有する
    ことを特徴とする情報処理方法。     A login authentication process that performs login authentication for the first information processing device using authentication information,
    A distribution step of distributing the authentication information to the first distributed file and the second distributed file by the secret sharing method, and
    A first storage step of storing the first distributed file in the first information processing device, and
    A second storage step of storing the second distributed file in the second information processing device, and
    A communication process for connecting the first information processing device and the second information processing device by short-range wireless communication,
    A transmission step of transmitting the second distributed file stored in the second storage step to the first information processing apparatus by the communication step, and a transmission step of transmitting the second distributed file to the first information processing apparatus.
    A receiving step of receiving the second distributed file from the second information processing apparatus by the communication step, and
    A restoration step of restoring the authentication information using the first distributed file stored in the first storage step and the second distributed file received in the receiving step.
    The first information processing apparatus that can be executed when the first information processing apparatus is logged in by another method as compared with the case where the authentication information restored by the restoration step is used to log in to the first information processing apparatus. An information processing method characterized by having a control process for controlling so as to limit the functions of the information processing.
  11. 　請求項１乃至５のいずれか１項に記載の情報処理システムの各部としてコンピュータを機能させるためのプログラム。 A program for operating a computer as each part of the information processing system according to any one of claims 1 to 5.
PCT/JP2019/038174 2019-09-27 2019-09-27 Information processing system, information processing method, and program WO2021059491A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2020505519A JP6829341B1 (en) 2019-09-27 2019-09-27 Information processing systems, information processing methods, and programs
PCT/JP2019/038174 WO2021059491A1 (en) 2019-09-27 2019-09-27 Information processing system, information processing method, and program

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2019/038174 WO2021059491A1 (en) 2019-09-27 2019-09-27 Information processing system, information processing method, and program

Publications (1)

Publication Number Publication Date
WO2021059491A1 true WO2021059491A1 (en) 2021-04-01

Family

ID=74529709

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/038174 WO2021059491A1 (en) 2019-09-27 2019-09-27 Information processing system, information processing method, and program

Country Status (2)

Country Link
JP (1) JP6829341B1 (en)
WO (1) WO2021059491A1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220021536A1 (en) * 2020-07-20 2022-01-20 Seagate Technology Llc Computing system with decentralized authentication and authorization
WO2023053164A1 (en) * 2021-09-28 2023-04-06 エアトラスト株式会社 Information processing system, information processing device, information processing method, and program

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009181153A (en) * 2008-01-29 2009-08-13 Dainippon Printing Co Ltd User authentication system and method, program, medium

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009181153A (en) * 2008-01-29 2009-08-13 Dainippon Printing Co Ltd User authentication system and method, program, medium

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
FUKUMITSU, MASAYUKI ET AL.: "A Proposal of a password manager satisfying security and usability by using the secret sharing and a personal server", PROCEEDINGS OF COMPUTER SECURITY SYMPOSIUM 2014 IN SAPPORO, vol. 2014, no. 2, 15 October 2014 (2014-10-15), pages 619 - 626 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220021536A1 (en) * 2020-07-20 2022-01-20 Seagate Technology Llc Computing system with decentralized authentication and authorization
US11985240B2 (en) * 2020-07-20 2024-05-14 Seagate Technology Llc Computing system with decentralized authentication and authorization
WO2023053164A1 (en) * 2021-09-28 2023-04-06 エアトラスト株式会社 Information processing system, information processing device, information processing method, and program

Also Published As

Publication number Publication date
JPWO2021059491A1 (en) 2021-10-07
JP6829341B1 (en) 2021-02-10

Similar Documents

Publication Publication Date Title
US9451454B2 (en) Mobile device identification for secure device access
US20190090131A1 (en) Method and apparatus for remote portable wireless device authentication
JP4301997B2 (en) Authentication method for information appliances using mobile phones
US9025769B2 (en) Method of registering smart phone when accessing security authentication device and method of granting access permission to registered smart phone
US20120192260A1 (en) System and method for user authentication by means of web-enabled personal trusted device
CN110266642A (en) Identity identifying method and server, electronic equipment
CN107291432A (en) Cloud desktop management-control method, device and cloud desktop access method, device
US11824854B2 (en) Communication system and computer readable storage medium
CN107395634B (en) Password-free identity authentication method of wearable equipment
CN109995699B (en) Multimedia equipment management system
JP6829341B1 (en) Information processing systems, information processing methods, and programs
CN104247485A (en) Network application function authorisation in a generic bootstrapping architecture
KR102308859B1 (en) Surrogate authentication service system and method based on biometric information
CN108920919A (en) Control method, device and system of interactive intelligent equipment
GB2408129A (en) User authentication via short range communication from a portable device (eg a mobile phone)
CN109410384B (en) Safety management system
CN101594615B (en) Method, system and equipment for network management of terminal triple information security
CN103152326A (en) Distributed authentication method and authentication system
JP7042292B2 (en) Information processing systems, information processing methods, and programs
CN106453327B (en) Log in the method and mobile terminal for needing the computer application of authenticating identity
CN111709538B (en) System and method for authenticating ground maintenance equipment of an aircraft
KR100538924B1 (en) Method for providing Web Service, Remote Storage Service and Remote Control Service based on Peer-to-Peer between a Plurality of Client Terminals and Personal Computers Operated as Server
KR101368122B1 (en) Method for security of computer using mobile communication terminal and computer therefor
WO2023053164A1 (en) Information processing system, information processing device, information processing method, and program
WO2022162857A1 (en) Information processing system, information processing method, and program

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2020505519

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19947038

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19947038

Country of ref document: EP

Kind code of ref document: A1