Patent Description:
In multi-unit apartment buildings, etc. a delivery box (i.e., a home delivery box) for temporarily keeping a baggage delivered to a resident may be installed. Patent Literature <NUM> below proposes a system that uses a cellular phone of the user of the delivery box for authentication to unlock the delivery box.

<CIT> discloses methods and devices for wireless key management for authentication comprising a controlled device and a communication terminal, wherein the mobile communication terminal performs wireless communication with the controlled device. Furthermore, <CIT> discloses a device to unlock the vehicle door, wherein a request signal is transmitted to a portable machine, and answer signal transmitted by the portable machine according to the request signal is received. A response time until the answer signal is received after transmitting the request signal is measured. When the response time is shorter than a threshold time, the door is unlocked, when the response time is longer than the threshold time, the door is not unlocked.

Recently, malware that causes an information terminal such as a smartphone to perform an unauthorized operation has been around, and users may have their information terminals infected with malware unknowingly. In this background, it is required to ensure security when an external device is remotely controlled by using an information terminal of a user.

The disclosure addresses this issue, and a purpose thereof is to provide a technology of improving security when an external device is remotely controlled by using an information terminal of a user.

The above-mentioned problem is solved by a remote control system according to claim <NUM>, wherein claims <NUM> to <NUM> relate to specifically advantageous realizations of the control system according to claim <NUM>. A remote control system according to an embodiment of the present disclosure includes: a controlled device that is remotely controlled; and a mobile communication terminal that performs wireless communication with the controlled device. The controlled device transmits, when accepting remote control, first data to the communication terminal, the communication terminal transmits second data including a detail of remote control to the controlled device in response to the first data, and the controlled device performs a process determined by the detail of remote control included in the second data when a time elapsed since the first data is transmitted until the second data is received is less than a threshold value.

Optional combinations of the aforementioned constituting elements, and implementations of the present disclosure in the form of systems, computer programs, recording mediums recording computer programs, etc. may also be practiced as additional modes of the present disclosure.

According to the disclosure, it is possible to improve security when an external device is remotely controlled by using an information terminal of a user.

The device or the entity that executes the method according to the disclosure is provided with a computer. By causing the computer to run a program, the function of the apparatus or the entity that executes the method according to the disclosure is realized. The computer is comprised of a processor that operates in accordance with the program as a main hardware feature. The disclosure is non-limiting as to the type of the processor so long as the function is realized by running the program. The processor is comprised of one or a plurality of electronic circuits including a semiconductor integrated circuit (IC) or a large-scale integration (LSI). The terms IC and LSI may change depending on the integration degree, and the processor may be comprised of a system LSI, a very large scale integration (VLSI), or an ultra large scale integration (USLI). A field programmable gate array (FPGA) programmed after the LSI is manufactured, or a reconfigurable logic device, in which the connections inside the LSI are reconfigurable or the circuitry blocks inside the LSI can be set up, can be used for the same purpose. The plurality of electronic circuits may be integrated in one chip or provided in a plurality of chips. The plurality of chips may be aggregated in one device or provided in a plurality of apparatuses. The program is recorded in a non-transitory recording medium such as a computer-readable ROM, optical disk, and hard disk drive. The program may be stored in a recording medium in advance or supplied to a recording medium via wide area communication network including the Internet.

A summary of the embodiment is given below. <FIG> shows an exemplary operation (normally performed) to unlock a delivery box. When the delivery box is unlocked, the server transmits a nonce and control data (a command, etc.) for unlocking to a user terminal (a smartphone, etc.). A nonce is a one-time random value and is a measure to counter a replay attack. The user terminal transfers the nonce and the control data for unlocking to the delivery box. The delivery box unlocks the electric lock of the door in accordance with the control data.

<FIG> shows an exemplary operation (performed in the presence of an attack) to unlock a delivery box. <FIG> shows a case of a man in the middle attack. The user terminal is infected with malware, and the malware causes the control data to be transferred to an attacker terminal. When the attacker sees that the user leaves the delivery box because of the failure to unlock the delivery box, the attacker causes the attacker terminal to transmit the nonce and the control data to the delivery box to unlock the delivery box. As a result, the article in the delivery box is illegally acquired by the attacker.

Thus, the OS and wireless communication in a user terminal such as a smartphones have vulnerability. Therefore, there is a concern that the attacker gains control of the user terminal by exploiting the vulnerability of the user terminal and causing it to be infected with malware, retransmits the control data for controlling a remotely controlled device with a delay, and manipulates the controlled device illegally. In the embodiment, there is proposed a remote control system in which is introduced a scheme for protecting against a delayed retransmission attack on remote control of a target device (in the embodiment, the delivery box) via a user terminal.

<FIG> shows a configuration of a remote control system <NUM> according to the first embodiment. The remote control system <NUM> includes a delivery box 12a, a delivery box 12b, a delivery box 12c (generically referred to as "a delivery box <NUM>"), a user terminal <NUM>, and a server <NUM>. The remote control system <NUM> can be said to be a communication system or an information processing system and realizes secure remote control of the delivery box <NUM> using the user terminal <NUM>.

The delivery box <NUM> can be said to be a controlled device that is remotely controlled. The user terminal <NUM> is a mobile communication terminal controlled by a user of the delivery box and, in the embodiment, a user who takes out a baggage from the delivery box. The user terminal <NUM> may be a smartphone or a tablet terminal and communicates wirelessly with the delivery box <NUM>. The server <NUM> is an information processing device provided on the cloud. The server <NUM> can be said to be an information consolidating device that controls a plurality of delivery boxes <NUM> in a consolidated manner.

The user terminal <NUM> and the delivery box <NUM> are connected via a near-field communication network <NUM>. On the other hand, the user terminal <NUM> and the server <NUM> are connected via a wide-area communication network. The near-field communication network <NUM> encompasses near-field wireless communication. In the embodiment, Bluetooth Low Energy ("Bluetooth" is a registered trademark) (hereinafter, referred to as "BLE") is assumed. The wide-area communication network <NUM> encompasses wide-area wireless communication. For example, the fourth generation mobile communication system or the Internet may be encompassed.

<FIG> is a block diagram showing the functional blocks of the delivery box <NUM> according to the first embodiment. The blocks depicted in the block diagram of this disclosure are implemented in hardware such as devices and mechanical apparatus exemplified by a CPU and a memory of a computer, and in software such as a computer program. <FIG> depicts functional blocks implemented by the cooperation of these elements. Therefore, it will be understood by those skilled in the art that the functional blocks may be implemented in a variety of manners by a combination of hardware and software.

The delivery box <NUM> includes a user operation unit <NUM>, a communication unit <NUM>, a power supply unit <NUM>, a door unit <NUM>, an electric lock <NUM>, a MAC key storage unit <NUM>, and a control unit <NUM>. In the embodiment, it is assumed that each of the plurality of delivery boxes <NUM> includes a plurality of functional blocks shown in <FIG>. In a variation, at least some functional blocks (e.g., the user operation unit <NUM>, the power supply unit <NUM>, etc.) of the plurality of functional blocks may be shared by a plurality of delivery boxes <NUM>.

The door unit <NUM> is an openable door provided at a baggage retrieval port of the delivery box. The electric lock <NUM> is a key to the door unit <NUM> capable of switching between a locked state and a unlocked state electrically. The power supply unit <NUM> supplies power to the parts of the delivery box <NUM>. The power supply unit <NUM> of the embodiment is a battery power supply. When caused by a sleep control unit <NUM> described later to make a transition to a suspended state (i.e., a sleep state) , the power supply unit <NUM> reduces the supply of power from a normal level. For example, the power supply unit <NUM> reduces the supply of power to the communication unit <NUM> in a suspended state.

The user operation unit <NUM> is a component that receives a user operation by a user. For example, the user operation unit <NUM> is a button provided on the casing of the delivery box <NUM>. In the embodiment, a predetermined user operation for unlocking the electric lock <NUM> (which can be said to be a predetermined user operation designating acceptance of remote control and hereinafter referred to as "an unlocking process start user operation") is input to the user operation unit <NUM>. For example, the unlocking process start user operation may be pressing of a predetermined button embodying the user operation unit <NUM>. When the unlocking process start user operation is input, the control unit <NUM> described later performs a data process and a communication process for accepting remote control designating unlocking of the electric lock <NUM>.

The communication unit <NUM> communicates with an external device by using a predetermined communication protocol (in the embodiment, BLE). The control unit <NUM> described later exchanges data with the user terminal <NUM> via the communication unit <NUM>. The communication unit <NUM> is driven by power supplied from the power supply unit <NUM> (in the embodiment, the battery). The communication unit <NUM> is provided with a normal state and a suspended state and reduces the amount of used power by restricting (e.g., stopping) the communication function in the suspended state.

The MAC key storage unit <NUM> stores a key (hereinafter, also referred to as "a MAC key") for generating a code for message authentication (hereinafter, also referred to as "MAC"). The same MAC key as the MAC stored in the MAC key storage unit <NUM> is also stored in the server <NUM>.

The control unit <NUM> performs various data processes for accepting secure remote control. The control unit <NUM> includes a user operation detection unit <NUM>, a sleep control unit <NUM>, a challenge setting unit <NUM>, a challenge transmission unit <NUM>, a response reception unit <NUM>, an authentication unit <NUM>, and an unlocking unit <NUM>. A computer program in which the plurality of these functional blocks are implemented may be installed in the storage area (recording medium) in the delivery box <NUM>. The CPU of the delivery box <NUM> may cause the functional blocks to exhibit the functions by reading the computer program into the main memory and running the program.

When the unlocking process start user operation is input to the user operation unit <NUM>, the user operation detection unit <NUM> detects the input. When a series of processes related to acceptance of remote control, and, specifically, a series of processes related to unlocking of the electric lock <NUM> according to the embodiment, are completed, the sleep control unit <NUM> reduces the power consumption by causing the communication unit <NUM> to make a transition to the suspended state. Further, when an input of the unlocking process start user operation is detected, the sleep control unit <NUM> causes the communication unit <NUM> to return from the suspended state to the normal state and to start wireless communication.

When an input of the unlocking process start user operation is detected, the challenge setting unit <NUM> sets first data (also referred to as "challenge data") including a random value generated by a predetermined random value generator (also referred to as a challenge). The challenge data includes (<NUM>) a nonce, (<NUM>) a random value, and (<NUM>) a MAC. The challenge setting unit <NUM> generates a MAC based on the MAC key stored in the MAC key storage unit <NUM> (i.e., the MAC key shared with the server <NUM>) and the random value. The challenge transmission unit <NUM> transmits the challenge data set by the challenge setting unit <NUM> to the user terminal <NUM>. In the embodiment, a random value is set in the challenge data. In a variation, the challenge setting unit <NUM> may set, in the challenge data, data different from the random value and, more specifically, data having a unique value such as a counter value that varies each time it is generated.

The response reception unit <NUM> receives second data in response to the challenge data and, more specifically, response data transmitted from the user terminal <NUM>. The response data includes (<NUM>) a nonce, (<NUM>) a random value, (<NUM>) control data, and (<NUM>) a MAC. The random value in the response data is derived by converting the random value in the challenge data according to a rule predefined between the delivery box <NUM> and the server <NUM> and can be said to be an authentication value authenticated by the delivery box <NUM>. In the embodiment, the random value in the response data is derived by adding "<NUM>" to the random value in the challenge data. In a variation, the rule predefined between the delivery box <NUM> and the server <NUM> may be a particular basic arithmetic operation on a particular value.

The control data in the response data includes the detail of remote control (i.e., remote user operation) on the delivery box <NUM>. The control data according to the embodiment includes data designating unlocking of the electric lock <NUM>. The MAC in the response data is generated by the server <NUM> based on the MAC key stored in the server <NUM> (i.e., the MAC key shared with the delivery box <NUM>), the random value, and the control data.

The authentication unit <NUM> performs an authentication process based on the response data received by the response reception unit <NUM> to determine whether the response data is legitimate. When the authentication unit <NUM> determines that the response data is legitimate, the delivery box <NUM> performs a process determined by the detail of remote control included in the response data. In the embodiment, the unlocking unit <NUM> performs the process determined by the detail of remote control by unlocking the electric lock <NUM> in accordance with the control data included in the response data.

The process in the authentication unit <NUM> will be described in detail. The authentication unit <NUM> measures a time (hereinafter, also referred to as "a response time") elapsed since the challenge data is transmitted until the response data is received. The authentication unit <NUM> determines that the first condition is met provided that the response time is less than a predefined threshold value (which can be said to be an upper limit response time and is, for example, <NUM> seconds). An appropriate value may be determined to be the threshold value according to the knowledge of the developer of the remote control system <NUM> or an experiment using the the remote control system <NUM> (including actual communication).

Further, the authentication unit <NUM> checks whether the random value included in the response data corresponds to the random value included in the challenge data. Stated otherwise, the authentication unit <NUM> checks whether the random value included in the response data matches the value derived by converting the random value included in the challenge data according to the predefined rule. In the embodiment, the authentication unit <NUM> stores the random value included in the challenge data transmitted by the challenge transmission unit <NUM> and checks whether the random value included in the response data is the random value included in the challenge data + <NUM>. The authentication unit <NUM> determines that the second condition is met provided that the random value included in the response data corresponds to the random value included in the challenge data.

Further, the authentication unit <NUM> checks whether message authentication using the MAC included in the response data is successful. More specifically, the authentication unit <NUM> generates a MAC based on the MAC key stored in the MAC key storage unit <NUM>, the random value, and the control data included in the response data. The authentication unit <NUM> determines that the message authentication is successful provided that the generated MAC matches the MAC included in the response data. The authentication unit <NUM> determines that the third condition is met when the message authentication is successful. When all of the first condition, the second condition, and the third condition are met, the authentication unit <NUM> determines that the response data is legitimate. When at least one of the first condition, the second condition, and the third condition is not met, on the other hand, the authentication unit <NUM> determines that the response data is not legitimate.

The authentication unit <NUM> restricts (in the embodiment, prohibits) the execution of the process determined by the detail of remote control included in the response data in accordance with the response time elapsed since the transmission of the challenge data until the reception of the response data. Further, the authentication unit <NUM> restricts the execution of the process determined by the detail of remote control included in the response data in accordance with the random number included in the response data. Further, the authentication unit <NUM> restricts the execution of the process determined by the detail of remote control included in the response data in accordance with the result of message authentication using the MAC included in the response data.

<FIG> is a block diagram showing the functional blocks of the user terminal <NUM> according to the first embodiment. The user terminal <NUM> includes a user operation unit <NUM>, a display unit <NUM>, a communication unit <NUM>, and a control unit <NUM>. The user operation unit <NUM> is a component that receives a user operation by a user. The display unit <NUM> includes a screen and presents various information to the user. The user operation unit <NUM> and the display unit <NUM> may be integrated in, for example, a liquid crystal display provided a touch panel function.

The communication unit <NUM> communicates with an external device by using a predetermined communication protocol. In the embodiment, the communication unit <NUM> communicates with the delivery box <NUM> by using BLE and also communicates with the server <NUM> by using wide-area wireless communication (e.g., the fourth-generation mobile communication system). The control unit <NUM> performs various data processes. The control unit <NUM> exchanges data with the delivery box <NUM> and the server <NUM> via the communication unit <NUM>.

The control unit <NUM> includes a challenge transfer unit <NUM>, a response transfer unit <NUM>, and a display control unit <NUM>. A computer program (e.g., a client application for remote control) in which these plurality of functional blocks are implemented may be stored in a recording medium and installed in the storage area in the user terminal <NUM> via the recording medium. Alternatively, the computer program may be downloaded via a network and installed in the storage area in the user terminal <NUM>. The CPU of the user terminal <NUM> may cause the functional blocks to exhibit the functions by reading the computer program into the main memory and running the program.

The challenge transfer unit <NUM> receives the challenge data transmitted from the delivery box <NUM> and transfers the received challenge data to the server <NUM>. The response transfer unit <NUM> receives the response data transmitted from the server <NUM> and transfers the received response data to the delivery box <NUM> as a response to the challenge data.

The display control unit <NUM> causes the display unit <NUM> that communication is proceeding during communicating with the server <NUM> and the delivery box <NUM>. The display control unit <NUM> may further cause the display unit <NUM> to display a content that prompts the user to wait for a while until the delivery box <NUM> is unlocked. In a variation, the display control unit <NUM> may cause the display unit <NUM> to display that communication is proceeding during communication with at least the server <NUM>.

<FIG> is a block diagram showing the functional blocks of the server <NUM> according to the first embodiment. The server <NUM> includes a control unit <NUM>, a storage unit <NUM>, and a communication unit <NUM>. The control unit <NUM> operates in coordination with the plurality of delivery boxes <NUM> and performs a data process for performing remote control (in the embodiment, unlocking) of the plurality of delivery boxes <NUM> in a consolidated manner. The storage unit <NUM> stores data referred to or updated by the control unit <NUM>.

The communication unit <NUM> communicates with an external device by using a predetermined communication protocol. In the embodiment, the communication unit <NUM> communicates with the user terminal <NUM> by using wide-area communication (e.g. the Internet or the fourth-generation mobile communication system). The control unit <NUM> exchanges data with the user terminal <NUM> via the communication unit <NUM>.

The storage unit <NUM> includes a control data storage unit <NUM> and a MAC key storage unit <NUM>. The control data storage unit <NUM> stores data for controlling the delivery box <NUM> remotely. In the embodiment, the control data storage unit <NUM> stores control data (a command, etc.) for designating unlocking of the electric lock <NUM>. The MAC key storage unit <NUM> stores the MAC key shared with the delivery box <NUM>. The MAC key storage unit <NUM> may store MAC keys that are shared with the plurality of delivery boxes <NUM> and that are different for different delivery boxes <NUM>.

The control unit <NUM> includes an authentication unit <NUM>, a response setting unit <NUM>, and a response transmission unit <NUM>. A computer program in which these plurality of functional blocks are implemented may be installed in the storage area (recording medium) in the server <NUM>. The CPU of the delivery box <NUM> may cause the functional blocks to exhibit the functions by reading the computer program into the main memory and running the program.

The response setting unit <NUM> receives the challenge data transmitted (transferred) from the user terminal <NUM> and sets the response data based on the challenge data. As already described, the response data includes (<NUM>) a nonce, (<NUM>) a random value, (<NUM>) control data, and (<NUM>) a MAC. The response setting unit <NUM> sets, as the random value in the response data, a value derived by converting the random number in the challenge data according to a rule predefined between the delivery box <NUM> and the server <NUM>. In the embodiment, the value derived by adding "<NUM>" to the random value in the challenge data is set as the random value in the response data.

Further, the response setting unit <NUM> set, as the control data in the response data, the control data (in the embodiment, an instruction for unlocking) stored in the control data storage unit <NUM>. More specifically, the response setting unit <NUM> generates a MAC based on the MAC key stored in the MAC key storage unit <NUM>, the random value, and the control data. The response setting unit <NUM> sets the MAC in the control data. The response transmission unit <NUM> transmits the response data set by the response setting unit <NUM> to the user terminal <NUM> in response to the challenge data.

The authentication unit <NUM> checks whether message authentication using the MAC included in the challenge data is successful. More specifically, the authentication unit <NUM> generates a MAC based on the MAC key stored in the MAC key storage unit <NUM> and the random value included in the response data. The authentication unit <NUM> determines that the message authentication is successful provided that the generated MAC matches the MAC included in the challenge data. The authentication unit <NUM> permits transmission of the response data when the message authentication is successful. When the message authentication fails, on the other hand, the authentication unit <NUM> restricts (i.e., prohibits) the setting or transmission of the response data.

A description will be given of the operation of the remote control system <NUM> according to the first embodiment having the above configuration. <FIG> is a chart showing the operation of the devices in the remote control system <NUM> according to the first embodiment. Of the delivery box 12a, the delivery box 12b, and the delivery box 12c shown in <FIG>, the reference numeral <NUM> in the figure denotes a particular delivery box that the user intends to unlock (i.e., that is controlled remotely). The same operation is performed regardless of which of the delivery box 12a, the delivery box 12b, and the delivery box 12c is unlocked.

A common MAC key is stored in the server <NUM> and the delivery box <NUM> in advance. The user inputs a predetermined unlocking process start user operation in the delivery box <NUM>. The user operation detection unit <NUM> of the delivery box <NUM> detects the input of the unlocking process start user operation, and the sleep control unit <NUM> of the delivery box <NUM> returns the communication unit <NUM> from a suspended state to a normal state (S10). The challenge setting unit <NUM> of the delivery box <NUM> sets challenge data, and the challenge transmission unit <NUM> of the delivery box <NUM> transmits the challenge data to the user terminal <NUM> (S12).

When communication with the delivery box <NUM> is started, the display control unit <NUM> of the user terminal <NUM> starts displaying "communication proceeding" on the display unit <NUM>. The challenge transfer unit <NUM> of the user terminal <NUM> transfers the challenge data to the server <NUM> (S14). The authentication unit <NUM> of the server <NUM> performs message authentication based on the MAC included in the challenge data (S16). When the legitimacy (i.e., tamper-proof property) of the challenge data is verified by message authentication, the response setting unit <NUM> of the server <NUM> generates response data based on the challenge data. The response transmission unit <NUM> of the server <NUM> transmits the response data to the user terminal <NUM> (S18).

The response transfer unit <NUM> of the user terminal <NUM> transfers the response data to the delivery box <NUM> (S20). When communication with the delivery box <NUM> is terminated, the display control unit <NUM> of the user terminal <NUM> terminates the display of "communication proceeding" on the display unit <NUM>.

The response reception unit <NUM> of the delivery box <NUM> receives the response data. The authentication unit <NUM> of the delivery box <NUM> checks whether the response data is legitimate based on (<NUM>) the response time t elapsed since the transmission of the challenge data until the reception of the response data, (<NUM>) the random value in the response data, and ((<NUM>) the MAC in the response data. When it is determined that the response data is legitimate, the unlocking unit <NUM> of the delivery box <NUM> unlocks the electric lock <NUM> (S24). The user can open the door unit <NUM> of the delivery box <NUM> and take out the article stored in the delivery box <NUM>. When the response data is determined to be illegitimate, S24 is skipped.

In the remote control system <NUM> according to the first embodiment, the control data from the server <NUM> is relayed by the user terminal <NUM> and delivered to the delivery box <NUM>. It is therefore not necessary for the delivery box <NUM> to connect to the wide-area communication network <NUM> and may only perform near-field communication with the user terminal <NUM> so that an increase in the cost of the delivery box <NUM> is inhibited.

In further accordance with the remote control system <NUM> according to the first embodiment, a restriction is imposed on the response time elapsed since the transmission of the challenge data to the reception of the response data. This prevents unauthorized remote control (e.g., unauthorized unlocking) by means of response data theft and delayed retransmission by an attacker (i.e., a man in the middle attack).

In further accordance with the remote control system <NUM>, the random value is set in the challenge data, and the authentication value corresponding to the random value in the challenge data is set in the response data. This allows the delivery box <NUM> to check whether the response data corresponds to the challenge data transmitted by the delivery box <NUM> so that the security of the delivery box <NUM> is further enhanced.

In further accordance with the remote control system <NUM>, instructions for remote control (unlocking) of the plurality of delivery boxes <NUM> are executed by the server <NUM> in a consolidated manner. This simplifies management of authentication, etc. in the remote control system <NUM>. For example, the process in the user terminal <NUM> is simplified.

Further, the remote control system <NUM> can realize message authentication (e.g., tamer-proof check) between the delivery box <NUM> and the server <NUM> by setting the MAC in the challenge data and the response data and so can enhance the security of the delivery box <NUM> even further.

It is considered that the communication unit <NUM>, the control unit <NUM>, etc. of the delivery box <NUM> are often provided after the delivery box <NUM> is installed. It is therefore desired that the communication unit <NUM>, the control unit <NUM>, etc. of the delivery box <NUM> be driven by a battery. In the case of battery driving, it is desired that consumption of the battery is reduced as much as possible. Thus, the communication unit <NUM> of the delivery box <NUM> in the remote control system <NUM> returns from a suspended state and performs wireless communication in response to the input of the unlocking process start user operation. This suppresses consumption of the battery in the delivery box <NUM>.

Further, the user terminal <NUM> in the remote control system <NUM> displays that communication is proceeding during communication with the delivery box <NUM> and the server <NUM>. This prevents the user from moving outside the communication rage, i.e., prevents the user from leaving the delivery box <NUM>, thereby preventing unauthorized acquisition of the article by the attacker even more properly.

The configuration of the remote control system <NUM> according to the second embodiment is similar to the configuration of the remote control system <NUM> according to the first embodiment shown in <FIG>. A difference is that the remote control system <NUM> according to the second embodiment further includes a function whereby the delivery box <NUM> pins the user terminal <NUM> and a function whereby the server <NUM> pins the user terminal <NUM>. Hereinafter, features that are different from those of the first embodiment will be mainly explained, and duplication of an explanation from the first embodiment will be omitted appropriately.

<FIG> is a block diagram showing the functional blocks of the delivery box <NUM> according to the second embodiment. In addition to the functional blocks of the first embodiment, the delivery box <NUM> according to the second embodiment includes an address acquisition unit <NUM>.

When the input of the unlocking process start user operation is detected by the user operation detection unit <NUM>, the communication unit <NUM> broadcasts a predetermined advertisement packet around. An address acquisition unit <NUM> acquires the address of the user terminal <NUM> (hereinafter, referred to as "a user terminal address") communicated from the user terminal <NUM> in response to the advertisement packet. The user terminal address in the embodiment is the address for BLE communication (access address).

The challenge data of the second embodiment includes data corresponding to the user terminal address communicated from the user terminal <NUM>. More specifically, the challenge setting unit <NUM> sets data derived by synthesizing (e.g., concatenating) a random value and the user terminal address in the field for a random data in the challenge data. The challenge setting unit <NUM> may set a value derived by converting the user terminal address according to a predefined rule in the challenge data, instead of setting the user terminal address itself in the challenge data.

As described later, the response data of the second embodiment includes data corresponding to the user terminal address included in the challenge data. When the data included in the response data and corresponding to the user terminal address does not match the destination address of the challenge data stored in the challenge transmission unit <NUM> of the delivery box <NUM>, the authentication unit <NUM> restricts the execution of the process determined by the detail of remote control included in the response data.

More specifically, the authentication unit <NUM> checks whether the user terminal address included in the field for a random number in the response data matches the destination address (to be more specific, the access address included in a BLE packet) of the challenge data stored in the challenge transmission unit <NUM> of the delivery box <NUM>. When the addresses match, the authentication unit <NUM> determines that the fourth condition is met. When all of the first condition, the second condition, and the third condition described in the first embodiment plus the fourth condition described above are met, the authentication unit <NUM> determines that the response data is legitimate.

When at least the fourth condition is not met, the authentication unit <NUM> determines that the response data is not legitimate. As a result, the execution of the process (in the embodiment, unlocking) determined by the detail of remote control included in the response data is restricted.

<FIG> is a block diagram showing the functional blocks of the user terminal <NUM> according to the second embodiment. The user terminal <NUM> according to the second embodiment includes a storage unit <NUM>, an authentication unit <NUM>, an address communication unit <NUM> in addition to the functional blocks of the first embodiment.

The storage unit <NUM> stores data updated or referred to by the control unit <NUM>. The storage unit <NUM> includes a certificate storage unit <NUM>. The certificate storage unit <NUM> stores a client certificate which is a certificate of the user terminal <NUM> issued by a certificate authority.

The authentication unit <NUM> performs mutual authentication with the server <NUM>. When the authentication unit <NUM> performs mutual authentication with the server <NUM>, the authentication unit <NUM> transmits the client certificate stored in the certificate storage unit <NUM> to the server <NUM>. Additionally, the authentication unit <NUM> authenticates the server <NUM> based on the electronic certificate of the server <NUM> provided from the server <NUM>, and, in the embodiment, based on the Secure Sockets Layer (SSL) server certificate.

When the advertisement packet transmitted from the delivery box <NUM> is received by the communication unit <NUM>, the address communication unit <NUM> transmits the address (access address) of the user terminal <NUM> in BLE communication to the delivery box <NUM>.

<FIG> is a block diagram showing the functional blocks of the server <NUM> according to the second embodiment. In addition to the functional blocks of the first embodiment, the server <NUM> according to the second embodiment includes a certificate storage unit <NUM>. The certificate storage unit <NUM> stores the SSL server certificate that is the electronic certificate of the server <NUM> issued by a certificate authority. The SSL server certificate can be said to be an SSL/TLS (Transport Layer Security) serer certificate.

The authentication unit <NUM> performs mutual authentication with the user terminal <NUM>. When the authentication unit <NUM> performs mutual authentication with the user terminal <NUM>, the authentication unit <NUM> transmits the SSL server certificate stored in the certificate storage unit <NUM> to the user terminal <NUM>. Additionally, the authentication unit <NUM> authenticates the user terminal <NUM> based on the client certificate provided from the user terminal <NUM>. In other words, the authentication unit <NUM> performs client authentication of the user terminal <NUM>.

The authentication unit <NUM> restricts communication with the user terminal <NUM> depending on the result of client authentication. For example, the authentication unit <NUM> prohibits communication with the user terminal <NUM>. When client authentication fails, the communication unit <NUM> may not establish an SSL session with the user terminal <NUM> or disconnect from the user terminal <NUM>. Alternatively, the authentication unit <NUM> may prohibit the response setting unit <NUM> from receiving the challenge data. Still alternatively, the authentication unit <NUM> may prohibit the response transmission unit <NUM> from transmitting response data.

The response setting unit <NUM> sets, in the field for a random value in the response data, data derived by synthesizing (e.g., concatenating) a value derived by converting the random value included in the challenge data (in the embodiment, the random value in the challenge data + <NUM>) and the user terminal address included in the challenge data.

A description will be given of the operation of the remote control system <NUM> according to the second embodiment.

<FIG> shows the operation of the devices in the remote control system <NUM> according to the second embodiment. As in the first embodiment, the common MAC key is stored in advance in the server <NUM> and the delivery box <NUM>. The authentication unit <NUM> of the server <NUM> and the authentication unit <NUM> of the user terminal <NUM> perform mutual authentication including client authentication (S30). It is assumed here that mutual authentication is successful and that the server <NUM> and the user terminal <NUM> can communicate in an encrypted tunnel (which can be said to be an "SSL tunnel"), i.e., that encryption and tunneling communication are enabled.

The user inputs a predetermined unlocking process start user operation in the delivery box <NUM>. The user operation detection unit <NUM> of the delivery box <NUM> detects the input of the unlocking process start user operation, and the sleep control unit <NUM> of the delivery box <NUM> returns the communication unit <NUM> from a suspended state to a normal state (S32). The communication unit <NUM> of the delivery box <NUM> broadcasts an advertisement packet around (S34). In response to the reception of the advertisement packet, the address communication unit <NUM> of the user terminal <NUM> transmits data indicating the user terminal address to the delivery box <NUM> (S36).

The challenge setting unit <NUM> of the delivery box <NUM> sets challenge data including the user terminal address, and the challenge transmission unit <NUM> of the delivery box <NUM> transmits the challenge data to the user terminal <NUM> (S38). When communication with the delivery box <NUM> is started, the display control unit <NUM> of the user terminal <NUM> starts to cause the display unit <NUM> to display "communication proceeding". The challenge transfer unit <NUM> of the user terminal <NUM> transfers the challenge data to the server <NUM> via an encrypted tunnel (i.e., by SSL communication) (S40).

The authentication unit <NUM> of the server <NUM> executes message authentication based on the MAC included in the challenge data (S42). When the legitimacy of the challenge data is verified by the message authentication, the response setting unit <NUM> of the server <NUM> generates response data based on the challenge data. The response transmission unit <NUM> of the server <NUM> transmits the response data to the user terminal <NUM> via an encrypted tunnel (i.e., by SSL communication) (S44). The response transfer unit <NUM> of the user terminal <NUM> transfers the response data to the delivery box <NUM> (S46).

The authentication unit <NUM> of the delivery box <NUM> checks whether the response data is legitimate based on (<NUM>) the response time t elapsed since the transmission of the challenge data until the reception of the response data, (<NUM>) the random value in the response data, ((<NUM>) the MAC in the response data, and (<NUM>) the user terminal address in the response data (S48). When it is determined that the response data is legitimate, the unlocking unit <NUM> of the delivery box <NUM> unlocks the electric lock <NUM> (S50). The user can open the door unit <NUM> of the delivery box <NUM> and take out the article stored in the delivery box <NUM>.

The remote control system <NUM> according to the second embodiment provides the same advantage as the remote control system <NUM> according to the first embodiment. In the remote control system <NUM> according to the second embodiment, the delivery box <NUM> acquires the address of the user terminal <NUM> in advance and checks the identity with the address of the transmitter of the control data. This prevents a spoofing attack from an attacker terminal on the user terminal <NUM> (e.g., a man in the middle attack) even more properly.

In the remote control system <NUM> according to the second embodiment, the server <NUM> checks the legitimacy of the user terminal <NUM> by client authentication. This prevents a spoofing attack from an attacker terminal on the user terminal <NUM> (e.g., a man in the middle attack) even more properly.

Given above is a description of the disclosure based on the first and second embodiments. The embodiments are intended to be illustrative only and it will be understood by those skilled in the art that various modifications to constituting elements and processes could be developed and that such modifications are also within the scope of the present disclosure.

The remote control system <NUM> according to the first and second embodiments includes the delivery box <NUM>, the user terminal <NUM>, and the server <NUM>. In a variation, the remote control system <NUM> includes the delivery box <NUM> and the user terminal <NUM> but may not include the server <NUM>. In this case, the user terminal <NUM> may be provided with the function of the response setting unit <NUM> of the server <NUM> of the embodiments. For example, the user terminal <NUM> may generate response data including control data and transmit the generated response data to the delivery box <NUM>. This variation equally provides the same advantage as the first and second embodiments. For example, unauthorized remote control by response data theft and delayed retransmission can be prevented by providing a restriction on the response time elapsed since the transmission of the challenge data until the reception of the response data.

In the remote control system <NUM> according to the first and second embodiments, the controlled device that is remotely controlled is exemplified by the delivery box <NUM>. However, the controlled device to which the technology disclosed in the first and second embodiments can be applied is not limited to the delivery box <NUM>. The controlled device may any of various devices remotely controlled by a communication terminal such as a smartphone. For example, the controlled device may be a smart lock device, a keyless entry device of a vehicle, a man location system using a Local Positioning System (LPS), or a cashless purchase system using a Radio Frequency IDentifier (RFID).

The disclosure is applicable to a system for controlling a target device remotely.

Claim 1:
A remote control system comprising (<NUM>):
a controlled device (<NUM>) that is remotely controlled; and
a mobile communication terminal (<NUM>) that is configured to perform wireless communication with the controlled device (<NUM>), wherein
the controlled device (<NUM>) is configured to transmit, when accepting remote control, first data to the communication terminal (<NUM>),
the mobile communication terminal (<NUM>) is configured to transmit second data including a detail of remote control to the controlled device in response to the first data, and
the controlled device (<NUM>) is configured to perform a process determined by the detail of remote control included in the second data when a time elapsed since the first data is transmitted until the second data is received is less than a threshold value,
further comprising:
a server (<NUM>) connected to the communication terminal (<NUM>) via a network, wherein
the mobile communication terminal (<NUM>) is configured to transfer the first data received to the server (<NUM>), is configured to transmit
the server (<NUM>) the second data to the mobile communication terminal (<NUM>) in response to the first data, and
the mobile communication terminal (<NUM>) is configured to transfer the second data received to the controlled device (<NUM>),
wherein
the mobile communication terminal (<NUM>) is configured to display that communication is proceeding during communication with the server (<NUM>) or during communication with the server (<NUM>) and the controlled device (<NUM>).