[go: up one dir, main page]

WO2018131082A1 - Communication system - Google Patents

Communication system Download PDF

Info

Publication number
WO2018131082A1
WO2018131082A1 PCT/JP2017/000539 JP2017000539W WO2018131082A1 WO 2018131082 A1 WO2018131082 A1 WO 2018131082A1 JP 2017000539 W JP2017000539 W JP 2017000539W WO 2018131082 A1 WO2018131082 A1 WO 2018131082A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
command
data
reader
data update
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2017/000539
Other languages
French (fr)
Japanese (ja)
Inventor
三露　学
日下部　進
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Quadrac Co Ltd
Original Assignee
Quadrac Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Quadrac Co Ltd filed Critical Quadrac Co Ltd
Priority to PCT/JP2017/000539 priority Critical patent/WO2018131082A1/en
Priority to JP2017522561A priority patent/JP6157797B1/en
Publication of WO2018131082A1 publication Critical patent/WO2018131082A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements

Definitions

  • the present invention relates to a communication system.
  • Patent Documents 1 and 2 A communication system in which a server on a network controls a user device via a reader / writer has been proposed (see Patent Documents 1 and 2). Further, a communication system has been proposed in which a user device executes a predetermined process and returns a response to the reader / writer based on a command from the reader / writer (see Patent Document 3).
  • a server on a network controls a user device via a reader / writer
  • synchronization replication
  • the processing for the user device may not be correctly transferred from the normal server to the spare server.
  • a communication system including a first server and a second server, wherein the first server is connected to the second server and a reader / writer via a network, and transmits data update information to the second server.
  • the command and accompanying information of the command are transmitted to the user device via the reader / writer, and the second server connects the reader / writer with a network.
  • the data update information is received from the first server, the data in the second server is updated based on the received data update information, and after the update, from the first server
  • the switch to the second server occurs, the command and the accompanying information of the command are sent via the reader / writer based on the data in the second server.
  • Communication system for transmitting to over laser device.
  • FIG. 1 is a schematic diagram illustrating a configuration of a communication system 1 according to a first embodiment.
  • 3 is a schematic diagram for explaining data in a first server 30.
  • FIG. 4 is a schematic diagram for explaining data in a second server 40.
  • FIG. 6 is a sequence diagram illustrating an operation example of the communication system 1 according to the first embodiment.
  • FIG. 1 is a schematic diagram illustrating a configuration of a communication system 1 according to the first embodiment.
  • the communication system 1 according to the first embodiment is a communication system including a first server 30 and a second server 40, and the first server 30 includes a second server 40, a reader / writer 22, 24, the data update information is transmitted to the second server 40, the data update information is transmitted to the second server 40, and then the user device is connected via the reader / writers 22 and 24.
  • the second server 40 when the second server 40 is connected to the reader / writers 22 and 24 via the network 50 and receives data update information from the first server 30, When the data in the second server 40 is updated based on the received data update information, and the switching from the first server 30 to the second server 40 occurs after the update, the second server Based on the data in the 0 and accompanying information command and the command is a communication system that transmits to the user device 12, 14 through the reader-writer 22. Details will be described below.
  • the user devices 12 and 14 include, for example, an IC chip and a storage device, and data such as a balance of electronic money is stored in the storage device.
  • the data stored in the storage devices of the user devices 12 and 14 can be updated by the user devices 12 and 14 executing a command, for example.
  • the reader / writers 22 and 24 are devices for reading and writing data in the user devices 12 and 14, and are composed of, for example, a supermarket cash register device or a station ticket gate.
  • the number of user devices and reader / writers is not particularly limited. In this embodiment, it is assumed that two user devices 12 and 14 and two reader / writers 22 and 24 are arranged in the communication system 1.
  • the first server 30 is connected to the second server 40 and the reader / writers 22 and 24 via the network 50.
  • the network 50 is, for example, the Internet.
  • the first server 30 includes a CPU, a memory, and the like, and operates when the CPU executes a program stored in the memory. Data is stored in the memory of the first server 30.
  • the first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 based on the data in the first server 30.
  • the accompanying information of the command includes a sequence number and an execution number. In the present embodiment, it is assumed that both the sequence number and the execution number are included in the accompanying information of the command.
  • FIG. 2 is a schematic diagram for explaining data in the first server 30.
  • the data in the first server 30 is stored in a table format, for example.
  • the table has records, and the record has fields of record number, command, sequence number, execution number, session key, reader / writer number, status, and update time. Records are updated by adding new records.
  • Each data stored in the record is preferably encrypted. Encryption can be performed by, for example, a symmetric key system such as AES or DES, or an asymmetric key system such as RSA or ECC.
  • a record number is stored in the record number field.
  • the record number is a number for identifying the record.
  • the first server 30 and the second server 40 can generate a record number when adding a record, for example.
  • the sequence number is stored in the sequence number field.
  • the sequence number is a number for identifying a sequence in one session. For example, if sequence number 0001 is assigned to one sequence in a session, 0002 can be assigned to the next sequence and 0003 can be assigned to the next sequence.
  • the command number It is possible to easily determine whether or not the response is transmitted from the outside illegally.
  • the execution number is stored in the execution number field.
  • the execution number is a number with a different value for each command. For example, if the execution number 00AA is assigned to the command 1, the next command 2 can be assigned the execution number 00AB.
  • the same execution number as the number assigned previously is assigned. In this way, when the command is retransmitted from the server by negotiating the protocol that the command having the same execution number is not executed between the server and the user device, the user device 12, 14 is changed to the user device 12, 14 is prevented from being updated twice in error.
  • the session key is stored in the session key field.
  • the session key is data generated when the user devices 12 and 14 and the first server 30 perform mutual authentication for each session.
  • the session key is stored in the first server 30 and the user devices 12 and 14 after generation.
  • the session key generated for one session is valid only for that one session.
  • Data transmitted and received between the user devices 12 and 14 and the first server 30 can be encrypted with a session key including a command and accompanying information of the command.
  • the session key can be generated according to a symmetric key system such as AES or DES, or an asymmetric key system such as RSA or ECC.
  • the reader / writer number is stored in the reader / writer number field.
  • the reader / writer number is a number for identifying the reader / writer.
  • the status is stored in the status field.
  • the status can include, for example, Ready and Wait. “Ready” indicates a state in which a command is ready to be transmitted from the server to the user device, and “Wait” indicates a state in which the user device is waiting for a response.
  • the update time field stores the time when the record was added.
  • the first server 30 transmits data update information to the second server 40 before transmitting the command. Then, the first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 via the reader / writers 22 and 24 with the data update completion notification from the second server 40 as a trigger. For example, first, the first server 30 identifies a record whose status is Ready from the table in the first server 30, and changes the status of the identified record from Ready to Wait. Next, the first server 30 includes the data included in the record whose status is changed in the data update information and transmits the data update information to the second server 40.
  • the first server 30 uses the notification as a trigger to store the command and accompanying information (eg, sequence) stored in the record whose status has been changed. Number and execution number) with the session key of the record whose status has been changed, and this is encrypted via the reader / writers 22 and 24 identified by the reader / writer number of the record whose status has been changed, 14 is transmitted.
  • command and accompanying information eg, sequence
  • the first server 30 When the first server 30 does not receive a response from the user devices 12 and 14 within a predetermined time after transmitting the command, the first server 30 transmits (retransmits) the command and the accompanying information of the command again. Note that “transmission” in this specification includes transmission (retransmission) again in addition to transmission for the first time.
  • the second server 40 is connected to the first server 30 and the reader / writers 22 and 24 via the network 50.
  • the second server 40 includes a CPU, a memory, and the like, and operates when the CPU executes a program stored in the memory. Data is stored in the memory of the second server 40.
  • FIG. 3 is a schematic diagram for explaining data in the second server 40.
  • the data in the second server 40 is stored in a table format in the same manner as the data in the first server 30.
  • the table has records.
  • the data stored in the record, the encryption of the record, and the like are the same as in the case of the first server 30 and will not be described.
  • the second server 40 When the second server 40 receives the data update information from the first server 30, the second server 40 updates the data in the second server 40 based on the received data update information. Thereby, the data in the second server 40 is synchronized with the data in the first server 30. Data update is performed by adding a new record, and each data included in the data update information is stored in each field in the new record.
  • the second server 40 transmits a data update completion notification to the first server 30 after the data update.
  • the data update completion notification is a notification indicating that the data update is completed.
  • the second server 40 When the second server 40 switches from the first server 30 to the second server 40 after the data in the second server 40 is updated, the second server 40 attaches a command and a command based on the data in the second server 40.
  • Information is transmitted to the user devices 12 and 14 via the reader / writers 22 and 24. That is, the second server 40 takes charge of the processing for the user devices 12 and 14 instead of the first server 30 when switching from the first server 30 to the second server 40 occurs. Transmission from the second server 40 is performed based on data in the second server 40. Since the data in the second server 40 is kept up-to-date based on the data update information received from the first server 10, the command transmitted by the second server 40 is transmitted by the first server 30. Done in the same way.
  • the cause of switching is not particularly limited. As an example, switching occurs when a failure occurs in the first server 30 or when the first server 30 is overloaded.
  • FIG. 4 is a sequence diagram illustrating an operation example of the communication system 1 according to the first embodiment.
  • an operation example of the communication system 1 according to the first embodiment will be described with reference to FIG.
  • Step S11 the first server 30 updates data in the first server 30.
  • the data is updated by adding a new record to the table in the first server 30.
  • Step S12 the first server 30 transmits data update information to the second server 40 before transmitting the command.
  • the first server 30 identifies a record whose status is Ready from the table in the first server 30, and changes the status of the identified record from Ready to Wait.
  • the first server 30 includes the data included in the record whose status is changed in the data update information and transmits the data update information to the second server 40.
  • the second server 40 updates the data in the second server 40 based on the data update information received from the first server 30.
  • the data is updated by adding a new record to the table in the second server 40 based on the data update information, for example.
  • Data included in the received data update information is stored in each field of the newly added record.
  • the second server 40 adds a new record if the table in the second server 40 includes a record having an update time that is newer than the update time included in the received data update information.
  • the received data update information can be discarded.
  • Step S14 Next, the second server 40 transmits a data update completion notification to the first server 30.
  • Step S15, Step S16 the first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 via the reader / writers 22 and 24 with the data update completion notification from the second server 40 as a trigger.
  • Step S19 the user device 12 transmits a response indicating that the data update has been normally completed to the first server 30.
  • the user device 12 encrypts this response with a session key generated by mutual authentication with the first server 30 before transmitting the response.
  • Step S20 Next, it is assumed that a failure occurs in the first server 30 and processing for the user devices 12 and 14 is taken over from the first server 30 to the second server 40.
  • the processing for the user devices 12 and 14 is handled not by the first server 30 but by the second server 40 thereafter.
  • the second server 40 transmits polling to the first server 30 at a predetermined interval, and when the first server 30 does not respond to the polling, it is determined that a failure has occurred in the first server 30.
  • the processing can be taken over from the first server 30.
  • the second server 40 receives an instruction to take over from a load sharing device (load balancer) that monitors the load of the first server 30 and the second server 40, according to the received instruction, The processing of the first server 30 can be taken over.
  • load sharing device load balancer
  • Step S21, Step S22 the second server 40 determines whether or not a response has arrived within a predetermined time from the user devices 12 and 14 based on the data in the second server 40 (step S21). 2 Update the data in the server 40 (step S22).
  • the second server 40 determines that no response has been received from the user device 12 within a predetermined time, and updates the data in the second server 40.
  • the determination of whether or not the response has arrived is performed by, for example, identifying a record whose status is Wait among the records stored in the table in the second server 40 and determining a predetermined time from the update time of the identified record. This can be done by judging whether or not.
  • the sequence number is regularly incremented from 0002 to 0003 according to a predetermined protocol, but since the execution number is 00AA which is the same as the execution number of the command that has already updated the data, the data update condition is satisfied. Shall not. Therefore, the data update by the user device 12 is not performed.
  • the user device 12 uses the execution number received from the second server 40 as the stored execution number. It is possible to easily determine whether or not the execution number is the same as the execution number of the command that has already updated the data.
  • Step S27, Step S28 the user device 12 transmits a response to the data update to the second server 40.
  • the user device 12 encrypts the response with the session key generated by mutual authentication with the first server 30 before transmitting the response.
  • synchronization (replication) of the first server 30 and the second server 40 is performed at an appropriate timing. That is, before the command is transmitted from the first server 30 to the user devices 12 and 14, the data update information is transmitted from the first server 30 to the second server 40, and the data in the first server 30 and the second Data in the server 40 is synchronized (replicated). Therefore, even if a switch from the first server 30 to the second server 40 occurs after transmitting a command from the first server 30 to the user devices 12, 14, the user device 12, 14 can be correctly taken over.
  • the communication system 1 includes two servers, the first server 30 and the second server 40, but the communication system 1 may include three or more servers.
  • the third and subsequent servers can be operated in the same manner as the second server 40 described above, for example. Further, for example, the third and subsequent servers can take over the process of the second server 40 by the same method as the case of taking over the process of the first server 30 instead of the first server 30.
  • Comparative Example 1 As Comparative Example 1, a communication system in which data update information is transmitted from the first server 30 to the second server 40 after one second has elapsed after the command is transmitted from the first server 30 to the user devices 12 and 14. consider. In the first comparative example, after the command is transmitted from the first server 30 to the user devices 12 and 14, the first server 30 fails before the data update information is transmitted from the first server 30 to the second server 40. It is assumed that switching from the first server 30 to the second server 40 occurs.
  • the user apparatus 12 since the sequence number is not correctly transferred, the user apparatus 12 determines that the data update condition is not satisfied in step S25 described above, and updates the data in the user apparatus 12. Step S26 is not executed.
  • step S26 since the execution number is not taken over correctly, if the data update in step S26 is executed, the balance of electronic money stored in the user device 12 has already been increased by 100 yen. It will be increased by 100 yen again.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Hardware Redundancy (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

[Problem] To provide a communication system in which a first server and a second server are synchronized with each other at suitable times, and the second server correctly takes over a process for a user device from the first server. [Solution] The first server is connected to the second server and a reader/writer via a network, transmits data update information to the second server, and also transmits a command and information associated with the command to the user device via the reader/writer after the transmission of the data update information to the second server. The second server is connected to the reader/writer via the network, and upon receiving the data update information from the first server, the second server updates data in the second server on the basis of the received data update information. After this update, if it becomes necessary for the second server to take over from the first server, then the second server transmits a command and information associated with the command to the user device via the reader/writer on the basis of the data in the second server.

Description

通信システムCommunications system

　本発明は通信システムに関する。 The present invention relates to a communication system.

　ネットワーク上のサーバがリーダライタを介してユーザ装置を制御する通信システムが提案されている（特許文献１、２参照）。また、リーダライタからのコマンドに基づき、ユーザ装置が所定の処理を実行してレスポンスをリーダライタに返す通信システムが提案されている（特許文献３参照）。 A communication system in which a server on a network controls a user device via a reader / writer has been proposed (see Patent Documents 1 and 2). Further, a communication system has been proposed in which a user device executes a predetermined process and returns a response to the reader / writer based on a command from the reader / writer (see Patent Document 3).

特開２００２－３１２７２６号公報JP 2002-31726 A 特開２０１２－１８５５６３号公報JP 2012-185563 A 特開２０００－３２２５３５号公報JP 2000-322535 A

　ネットワーク上のサーバがリーダライタを介してユーザ装置を制御する通信システムにおいては、サーバがデータを送受信できなくなる事態に備えて、予備のサーバを設けておくことが好ましい。しかしながら、通常時のサーバと予備のサーバの同期（レプリケーション）が適切なタイミングで行なわれない場合には、ユーザ装置に対する処理が通常時のサーバから予備のサーバへ正しく引き継がれない虞がある。 In a communication system in which a server on a network controls a user device via a reader / writer, it is preferable to provide a spare server in preparation for a situation where the server cannot transmit or receive data. However, if synchronization (replication) between the normal server and the spare server is not performed at an appropriate timing, the processing for the user device may not be correctly transferred from the normal server to the spare server.

　上記の課題は、例えば、次の手段により解決することができる。 The above problem can be solved by, for example, the following means.

　第１サーバと第２サーバを備えた通信システムであって、前記第１サーバは、前記第２サーバとリーダライタにネットワークを介して接続され、データ更新情報を前記第２サーバに対して送信し、前記データ更新情報を前記第２サーバに対して送信した後、前記リーダライタを介してユーザ装置に対しコマンドとコマンドの付随情報とを送信し、前記第２サーバは、前記リーダライタにネットワークを介して接続され、前記第１サーバから前記データ更新情報を受信した場合に、前記受信したデータ更新情報に基づいて前記第２サーバ内のデータを更新し、前記更新後、前記第１サーバから前記第２サーバへの切り替えが生じた場合、前記第２サーバ内のデータに基づいてコマンドとコマンドの付随情報とを前記リーダライタを介して前記ユーザ装置に対し送信する通信システム。 A communication system including a first server and a second server, wherein the first server is connected to the second server and a reader / writer via a network, and transmits data update information to the second server. After transmitting the data update information to the second server, the command and accompanying information of the command are transmitted to the user device via the reader / writer, and the second server connects the reader / writer with a network. And when the data update information is received from the first server, the data in the second server is updated based on the received data update information, and after the update, from the first server When the switch to the second server occurs, the command and the accompanying information of the command are sent via the reader / writer based on the data in the second server. Communication system for transmitting to over laser device.

　第１サーバと第２サーバの同期が適切なタイミングで行われ、ユーザ装置に対する処理が第１サーバから第２サーバへ正しく引き継がれる通信システムを提供することができる。 It is possible to provide a communication system in which synchronization between the first server and the second server is performed at an appropriate timing, and processing for the user device is correctly transferred from the first server to the second server.

実施形態１に係る通信システム１の構成を示す模式図である。1 is a schematic diagram illustrating a configuration of a communication system 1 according to a first embodiment. 第１サーバ３０内のデータを説明する模式図である。3 is a schematic diagram for explaining data in a first server 30. FIG. 第２サーバ４０内のデータを説明する模式図である。4 is a schematic diagram for explaining data in a second server 40. FIG. 実施形態１に係る通信システム１の動作例を説明するシーケンス図である。6 is a sequence diagram illustrating an operation example of the communication system 1 according to the first embodiment. FIG.

［実施形態１に係る通信システム１の構成］
　図１は実施形態１に係る通信システム１の構成を示す模式図である。図１に示すように、実施形態１に係る通信システム１は、第１サーバ３０と第２サーバ４０を備えた通信システムであって、第１サーバ３０は、第２サーバ４０とリーダライタ２２、２４とにネットワーク５０を介して接続され、データ更新情報を第２サーバ４０に対して送信し、データ更新情報を第２サーバ４０に対して送信した後、リーダライタ２２、２４を介してユーザ装置１２、１４に対しコマンドとコマンドの付随情報とを送信し、第２サーバ４０は、リーダライタ２２、２４にネットワーク５０を介して接続され、第１サーバ３０からデータ更新情報を受信した場合に、受信したデータ更新情報に基づいて第２サーバ４０内のデータを更新し、更新後、第１サーバ３０から第２サーバ４０への切り替えが生じた場合、第２サーバ４０内のデータに基づいてコマンドとコマンドの付随情報とをリーダライタ２２、２４を介してユーザ装置１２、１４に対し送信する通信システムである。以下、詳細に説明する。 [Configuration of Communication System 1 According to Embodiment 1]
FIG. 1 is a schematic diagram illustrating a configuration of a communication system 1 according to the first embodiment. As shown in FIG. 1, the communication system 1 according to the first embodiment is a communication system including a first server 30 and a second server 40, and the first server 30 includes a second server 40, a reader / writer 22, 24, the data update information is transmitted to the second server 40, the data update information is transmitted to the second server 40, and then the user device is connected via the reader / writers 22 and 24. 12 and 14, when the second server 40 is connected to the reader / writers 22 and 24 via the network 50 and receives data update information from the first server 30, When the data in the second server 40 is updated based on the received data update information, and the switching from the first server 30 to the second server 40 occurs after the update, the second server Based on the data in the 0 and accompanying information command and the command is a communication system that transmits to the user device 12, 14 through the reader-writer 22. Details will be described below.

（ユーザ装置１２、１４、リーダライタ２２、２４）
　ユーザ装置１２、１４には例えば非接触ＩＣカード（Ｃｏｎｔａｃｔｌｅｓｓ　ｓｍａｒｔ　ｃａｒｄｓ）やスマートフォンなどを用いることができる。ユーザ装置１２、１４とリーダライタ２２、２４との間の通信は例えば近距離無線通信方式（Ｎｅａｒ　Ｆｉｅｌｄ　Ｃｏｍｍｕｎｉｃａｔｉｏｎ）に従って行なわれる。ユーザ装置１２、１４は例えばＩＣチップと記憶装置を備えており、記憶装置には例えば電子マネーの残高などのデータが記憶されている。ユーザ装置１２、１４の記憶装置に記憶されているデータは、ユーザ装置１２、１４が例えばコマンドを実行することにより更新することができる。リーダライタ２２、２４は、ユーザ装置１２、１４内のデータを読み書きする装置であり、例えばスーパーマーケットのレジ装置や駅の改札機などからなる。ユーザ装置やリーダライタの数は特に限定されないが、本実施形態では、２台のユーザ装置１２、１４と２台のリーダライタ２２、２４が通信システム１に配置されているものとする。 (User devices 12, 14, reader / writers 22, 24)
For the user devices 12 and 14, for example, contactless smart cards or smartphones can be used. Communication between the user devices 12 and 14 and the reader / writers 22 and 24 is performed in accordance with, for example, a near field communication system (Near Field Communication). The user devices 12 and 14 include, for example, an IC chip and a storage device, and data such as a balance of electronic money is stored in the storage device. The data stored in the storage devices of the user devices 12 and 14 can be updated by the user devices 12 and 14 executing a command, for example. The reader / writers 22 and 24 are devices for reading and writing data in the user devices 12 and 14, and are composed of, for example, a supermarket cash register device or a station ticket gate. The number of user devices and reader / writers is not particularly limited. In this embodiment, it is assumed that two user devices 12 and 14 and two reader / writers 22 and 24 are arranged in the communication system 1.

（第１サーバ３０）
　第１サーバ３０はネットワーク５０を介して第２サーバ４０とリーダライタ２２、２４に接続されている。ネットワーク５０は例えばインターネットである。第１サーバ３０はＣＰＵやメモリなどを備えており、ＣＰＵがメモリなどに記憶されているプログラムを実行することにより動作する。第１サーバ３０のメモリにはデータが記憶されている。第１サーバ３０は、第１サーバ３０内のデータに基づいてユーザ装置１２、１４に対しコマンド及びコマンドの付随情報を送信する。コマンドの付随情報にはシーケンス番号や実行番号などが含まれる。本実施形態では、シーケンス番号と実行番号の双方がコマンドの付随情報に含まれるものとする。 (First server 30)
The first server 30 is connected to the second server 40 and the reader / writers 22 and 24 via the network 50. The network 50 is, for example, the Internet. The first server 30 includes a CPU, a memory, and the like, and operates when the CPU executes a program stored in the memory. Data is stored in the memory of the first server 30. The first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 based on the data in the first server 30. The accompanying information of the command includes a sequence number and an execution number. In the present embodiment, it is assumed that both the sequence number and the execution number are included in the accompanying information of the command.

　図２は第１サーバ３０内のデータを説明する模式図である。図２に示すように、第１サーバ３０内のデータは例えばテーブル形式で記憶される。テーブルはレコードを有しており、レコードはレコード番号、コマンド、シーケンス番号、実行番号、セッション鍵、リーダライタ番号、ステータス、及び更新時刻のフィールドを有している。レコードの更新は新たなレコードを追加することにより行なわれる。レコードに格納される各データは暗号化されていることが好ましい。暗号化は例えばＡＥＳやＤＥＳなどの対称鍵方式やＲＳＡやＥＣＣなどの非対称鍵方式により行うことができる。 FIG. 2 is a schematic diagram for explaining data in the first server 30. As shown in FIG. 2, the data in the first server 30 is stored in a table format, for example. The table has records, and the record has fields of record number, command, sequence number, execution number, session key, reader / writer number, status, and update time. Records are updated by adding new records. Each data stored in the record is preferably encrypted. Encryption can be performed by, for example, a symmetric key system such as AES or DES, or an asymmetric key system such as RSA or ECC.

＜レコード番号のフィールド＞
　レコード番号のフィールドにはレコード番号が格納される。レコード番号はレコードを識別する番号である。第１サーバ３０や第２サーバ４０は例えばレコードを追加する際にレコード番号を生成することができる。 <Record number field>
A record number is stored in the record number field. The record number is a number for identifying the record. The first server 30 and the second server 40 can generate a record number when adding a record, for example.

＜コマンドのフィールド＞
　コマンドのフィールドにはコマンドが格納される。コマンドには、例えば、「電子マネーの残高を１００円増額する」や「電子マネーの残高を１００円減額する」などがある。どのような値でコマンドを符号化するのかは、第１サーバ３０とユーザ装置１２、１４との間で予め取り決められたプロトコルに従う。例えば、「電子マネーの残高を１００円増額する」＝Ｕ￥１００、「電子マネーの残高を１００円減額する」＝Ｄ￥１００などと取り決めることができる。 <Command field>
Commands are stored in the command field. Examples of the command include “increase electronic money balance by 100 yen” and “decrease electronic money balance by 100 yen”. What value is used to encode the command depends on a protocol determined in advance between the first server 30 and the user devices 12 and 14. For example, “Increase the balance of electronic money by 100 yen” = U ¥ 100, “Decrease the balance of electronic money by 100 yen” = D ¥ 100, etc.

＜シーケンス番号のフィールド＞
　シーケンス番号のフィールドにはシーケンス番号が格納される。シーケンス番号は一のセッション内のシーケンスを識別する番号である。例えば、あるセッションにおける一のシーケンスにシーケンス番号０００１を割り当てたとすると、次のシーケンスには０００２を割り当て、その次のシーケンスには０００３を割り当てることができる。シーケンス番号を用いれば、シーケンス番号の値が規則正しく変化しているかどうかを判断することにより（上記の例ではシーケンスごとにシーケンス番号が一つずつインクリメントされているかどうかを判断することにより）、コマンドやレスポンスが外部から不正に送信されたものであるかどうかなどを容易に判断することができる。 <Sequence number field>
The sequence number is stored in the sequence number field. The sequence number is a number for identifying a sequence in one session. For example, if sequence number 0001 is assigned to one sequence in a session, 0002 can be assigned to the next sequence and 0003 can be assigned to the next sequence. By using a sequence number, by determining whether the value of the sequence number changes regularly (in the above example, by determining whether the sequence number is incremented by one for each sequence), the command number It is possible to easily determine whether or not the response is transmitted from the outside illegally.

＜実行番号のフィールド＞
　実行番号のフィールドには実行番号が格納される。実行番号はコマンドごとに値が異なる番号である。例えば、コマンド１に対して実行番号００ＡＡを割り当てたとすると、次のコマンド２には実行番号００ＡＢを割り当てることができる。なお、一度送信したコマンドを再送する場合には先に割り当てた番号と同じ実行番号を割り当てるものとする。このようにすれば、同じ実行番号のコマンドは実行しないとのプロトコルをサーバとユーザ装置との間で取り決めることにより、コマンドがサーバから再送される場合において、ユーザ装置１２、１４がユーザ装置１２、１４内のデータを誤って二重に更新することが防止される。 <Run number field>
The execution number is stored in the execution number field. The execution number is a number with a different value for each command. For example, if the execution number 00AA is assigned to the command 1, the next command 2 can be assigned the execution number 00AB. When retransmitting a command once transmitted, the same execution number as the number assigned previously is assigned. In this way, when the command is retransmitted from the server by negotiating the protocol that the command having the same execution number is not executed between the server and the user device, the user device 12, 14 is changed to the user device 12, 14 is prevented from being updated twice in error.

＜セッション鍵のフィールド＞
　セッション鍵のフィールドにはセッション鍵が格納される。セッション鍵は、ユーザ装置１２、１４と第１サーバ３０とがセッションごとに相互認証を行うことにより生成されるデータである。セッション鍵は、生成後、第１サーバ３０とユーザ装置１２、１４とに記憶される。一のセッション用に生成されたセッション鍵は、当該一のセッションに限り有効である。ユーザ装置１２、１４と第１サーバ３０との間で送受信されるデータは、コマンド及びコマンドの付随情報を含め、セッション鍵により暗号化することができる。セッション鍵は例えばＡＥＳやＤＥＳなどの対称鍵方式やＲＳＡやＥＣＣなどの非対称鍵方式に従い生成することができる。 <Session key field>
The session key is stored in the session key field. The session key is data generated when the user devices 12 and 14 and the first server 30 perform mutual authentication for each session. The session key is stored in the first server 30 and the user devices 12 and 14 after generation. The session key generated for one session is valid only for that one session. Data transmitted and received between the user devices 12 and 14 and the first server 30 can be encrypted with a session key including a command and accompanying information of the command. The session key can be generated according to a symmetric key system such as AES or DES, or an asymmetric key system such as RSA or ECC.

＜リーダライタ番号のフィールド＞
　リーダライタ番号のフィールドにはリーダライタ番号が格納される。リーダライタ番号はリーダライタを識別する番号である。 <Reader / writer number field>
The reader / writer number is stored in the reader / writer number field. The reader / writer number is a number for identifying the reader / writer.

＜ステータスのフィールド＞
　ステータスのフィールドにはステータスが格納される。ステータスには例えばＲｅａｄｙとＷａｉｔを含めることができる。Ｒｅａｄｙはサーバからユーザ装置にコマンドを送信する準備ができている状態を示し、Ｗａｉｔはユーザ装置のレスポンスを待っている状態を示す。 <Status field>
The status is stored in the status field. The status can include, for example, Ready and Wait. “Ready” indicates a state in which a command is ready to be transmitted from the server to the user device, and “Wait” indicates a state in which the user device is waiting for a response.

＜更新時刻のフィールド＞
　更新時刻のフィールドにはレコードを追加した時刻が格納される。 <Update time field>
The update time field stores the time when the record was added.

　第１サーバ３０は、コマンドの送信前に、データ更新情報を第２サーバ４０に対して送信する。そして、第１サーバ３０は、第２サーバ４０からのデータ更新完了通知をトリガーとして、リーダライタ２２、２４を介して、ユーザ装置１２、１４に対し、コマンドとコマンドの付随情報とを送信する。例えば、まず、第１サーバ３０は、第１サーバ３０内のテーブルからステータスがＲｅａｄｙであるレコードを特定し、この特定したレコードのステータスをＲｅａｄｙからＷａｉｔに変更する。次いで、第１サーバ３０は、このステータスが変更されたレコードに含まれるデータをデータ更新情報に含めて、第２サーバ４０に送信する。次いで、第１サーバ３０は、第２サーバ４０からのデータ更新完了通知を受信した場合に、この通知をトリガーとして、そのステータスを変更したレコードに格納されるコマンドとコマンドの付随情報（例：シーケンス番号と実行番号）を、そのステータスを変更したレコードのセッション鍵で暗号化し、これを、そのステータスを変更したレコードのリーダライタ番号により識別されるリーダライタ２２、２４を介して、ユーザ装置１２、１４に対して送信する。 The first server 30 transmits data update information to the second server 40 before transmitting the command. Then, the first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 via the reader / writers 22 and 24 with the data update completion notification from the second server 40 as a trigger. For example, first, the first server 30 identifies a record whose status is Ready from the table in the first server 30, and changes the status of the identified record from Ready to Wait. Next, the first server 30 includes the data included in the record whose status is changed in the data update information and transmits the data update information to the second server 40. Next, when the first server 30 receives a data update completion notification from the second server 40, the first server 30 uses the notification as a trigger to store the command and accompanying information (eg, sequence) stored in the record whose status has been changed. Number and execution number) with the session key of the record whose status has been changed, and this is encrypted via the reader / writers 22 and 24 identified by the reader / writer number of the record whose status has been changed, 14 is transmitted.

　第１サーバ３０は、コマンドの送信後、所定の時間内にユーザ装置１２、１４からレスポンスを受信しなかった場合、コマンドとコマンドの付随情報とを再び送信（再送）する。なお、本明細書における「送信」には、初めての送信のほか、再度の送信（再送）も含まれる。 When the first server 30 does not receive a response from the user devices 12 and 14 within a predetermined time after transmitting the command, the first server 30 transmits (retransmits) the command and the accompanying information of the command again. Note that “transmission” in this specification includes transmission (retransmission) again in addition to transmission for the first time.

（第２サーバ４０）
　第２サーバ４０はネットワーク５０を介して第１サーバ３０とリーダライタ２２、２４とに接続されている。第２サーバ４０はＣＰＵやメモリなどを備えており、ＣＰＵがメモリなどに記憶されているプログラムを実行することにより動作する。第２サーバ４０のメモリにはデータが記憶されている。 (Second server 40)
The second server 40 is connected to the first server 30 and the reader / writers 22 and 24 via the network 50. The second server 40 includes a CPU, a memory, and the like, and operates when the CPU executes a program stored in the memory. Data is stored in the memory of the second server 40.

　図３は第２サーバ４０内のデータを説明する模式図である。図３に示すように、第２サーバ４０内のデータは、第１サーバ３０内のデータと同様に、テーブル形式で記憶されている。テーブルはレコードを有している。レコードに格納されるデータやレコードの暗号化などについては第１サーバ３０の場合と同様であるので説明を省略する。 FIG. 3 is a schematic diagram for explaining data in the second server 40. As shown in FIG. 3, the data in the second server 40 is stored in a table format in the same manner as the data in the first server 30. The table has records. The data stored in the record, the encryption of the record, and the like are the same as in the case of the first server 30 and will not be described.

　第２サーバ４０は、第１サーバ３０からデータ更新情報を受信した場合に、受信したデータ更新情報に基づいて第２サーバ４０内のデータを更新する。これにより、第２サーバ４０内のデータが第１サーバ３０内のデータに同期される。データの更新は、新たなレコードを追加することにより行なわれ、新たなレコード中の各フィールドには、データ更新情報に含まれる各データが格納される。 When the second server 40 receives the data update information from the first server 30, the second server 40 updates the data in the second server 40 based on the received data update information. Thereby, the data in the second server 40 is synchronized with the data in the first server 30. Data update is performed by adding a new record, and each data included in the data update information is stored in each field in the new record.

　第２サーバ４０は、データの更新後、データ更新完了通知を第１サーバ３０に対して送信する。データ更新完了通知はデータの更新が完了したこと示す通知である。 The second server 40 transmits a data update completion notification to the first server 30 after the data update. The data update completion notification is a notification indicating that the data update is completed.

　第２サーバ４０は、第２サーバ４０内のデータの更新後、第１サーバ３０から第２サーバ４０への切り替えが生じた場合、第２サーバ４０内のデータに基づいて、コマンドとコマンドの付随情報とをリーダライタ２２、２４を介してユーザ装置１２、１４に対し送信する。つまり、第２サーバ４０は、第１サーバ３０から第２サーバ４０への切り替えが生じた場合、第１サーバ３０に代わり、ユーザ装置１２、１４に対する処理を受け持つことになる。第２サーバ４０からの送信は、第２サーバ４０内のデータに基づいて行なわれる。第２サーバ４０内のデータは第１サーバ１０から受信したデータ更新情報に基づき最新の状態に保たれているため、第２サーバ４０によるコマンドなどの送信は、第１サーバ３０によるコマンドなどの送信と同様に行なわれる。切り替わりの原因は特に限定されない。一例を挙げると、切り替わりは、第１サーバ３０に障害が発生した場合や第１サーバ３０が過負荷である場合に生じる。 When the second server 40 switches from the first server 30 to the second server 40 after the data in the second server 40 is updated, the second server 40 attaches a command and a command based on the data in the second server 40. Information is transmitted to the user devices 12 and 14 via the reader / writers 22 and 24. That is, the second server 40 takes charge of the processing for the user devices 12 and 14 instead of the first server 30 when switching from the first server 30 to the second server 40 occurs. Transmission from the second server 40 is performed based on data in the second server 40. Since the data in the second server 40 is kept up-to-date based on the data update information received from the first server 10, the command transmitted by the second server 40 is transmitted by the first server 30. Done in the same way. The cause of switching is not particularly limited. As an example, switching occurs when a failure occurs in the first server 30 or when the first server 30 is overloaded.

［実施形態１に係る通信システム１の動作例］
　図４は実施形態１に係る通信システム１の動作例を説明するシーケンス図である。以下、図４を参照しつつ、実施形態１に係る通信システム１の動作例について説明する。 [Operation Example of Communication System 1 According to Embodiment 1]
FIG. 4 is a sequence diagram illustrating an operation example of the communication system 1 according to the first embodiment. Hereinafter, an operation example of the communication system 1 according to the first embodiment will be described with reference to FIG.

（ステップＳ１１）
　まず、第１サーバ３０が第１サーバ３０内のデータを更新する。データの更新は、例えば、第１サーバ３０内のテーブルに新しいレコードを追加することにより行う。ここでは、新しいレコードに、レコード番号＝１、コマンド＝電子マネーの残高を１００円増額、シーケンス番号＝０００１、実行番号＝００ＡＡ、セッション鍵、リーダライタ番号＝リーダライタ２２、ステータス＝Ｒｅａｄｙ、及び更新時刻が格納されるものとする。 (Step S11)
First, the first server 30 updates data in the first server 30. For example, the data is updated by adding a new record to the table in the first server 30. Here, the record number = 1, command = electronic money balance is increased by 100 yen, sequence number = 0001, execution number = 00AA, session key, reader / writer number = reader / writer 22, status = Ready, and update to a new record It is assumed that the time is stored.

（ステップＳ１２）
　次いで、第１サーバ３０が、コマンドの送信前に、データ更新情報を第２サーバ４０に対して送信する。例えば、まず、第１サーバ３０は、第１サーバ３０内のテーブルからステータスがＲｅａｄｙであるレコードを特定し、この特定したレコードのステータスをＲｅａｄｙからＷａｉｔに変更する。次いで、第１サーバ３０は、このステータスが変更されたレコードに含まれるデータをデータ更新情報に含めて、第２サーバ４０に送信する。 (Step S12)
Next, the first server 30 transmits data update information to the second server 40 before transmitting the command. For example, first, the first server 30 identifies a record whose status is Ready from the table in the first server 30, and changes the status of the identified record from Ready to Wait. Next, the first server 30 includes the data included in the record whose status is changed in the data update information and transmits the data update information to the second server 40.

（ステップＳ１３）
　次いで、第２サーバ４０が、第１サーバ３０から受信したデータ更新情報に基づいて第２サーバ４０内のデータを更新する。データの更新は、例えば、データ更新情報に基づいて第２サーバ４０内のテーブルに新しいレコードを追加することにより行う。新たに追加されるレコードの各フィールドには、受信したデータ更新情報に含まれるデータが格納される。なお、第２サーバ４０は、第２サーバ４０内のテーブルに、受信したデータ更新情報に含まれる更新時刻よりも新しい更新時刻を有するレコードが含まれている場合には、新しくレコードを追加することなく、受信したデータ更新情報を破棄することができる。 (Step S13)
Next, the second server 40 updates the data in the second server 40 based on the data update information received from the first server 30. The data is updated by adding a new record to the table in the second server 40 based on the data update information, for example. Data included in the received data update information is stored in each field of the newly added record. The second server 40 adds a new record if the table in the second server 40 includes a record having an update time that is newer than the update time included in the received data update information. The received data update information can be discarded.

（ステップＳ１４）
　次いで、第２サーバ４０が、第１サーバ３０に対して、データ更新完了通知を送信する。 (Step S14)
Next, the second server 40 transmits a data update completion notification to the first server 30.

（ステップＳ１５、ステップＳ１６）
　次いで、第１サーバ３０が、第２サーバ４０からのデータ更新完了通知をトリガーとして、リーダライタ２２、２４を介して、ユーザ装置１２、１４に対し、コマンドとコマンドの付随情報とを送信する。例えば、第１サーバ３０は、第２サーバ４０からのデータ更新完了通知を受信した場合に、ステップＳ１２でステータスを変更したレコードに格納されるコマンド＝電子マネーの残高を１００円増額、シーケンス番号＝０００１、及び実行番号＝００ＡＡを、そのステータスを変更したレコードのセッション鍵で暗号化し、これを、そのステータスを変更したレコードのリーダライタ番号により識別されるリーダライタ２２を介して、ユーザ装置１２に対して送信する。本ステップによりコマンドを送信するシーケンスは、シーケンス番号＝０００１で識別される。 (Step S15, Step S16)
Next, the first server 30 transmits a command and accompanying information of the command to the user devices 12 and 14 via the reader / writers 22 and 24 with the data update completion notification from the second server 40 as a trigger. For example, when the first server 30 receives a data update completion notification from the second server 40, the command stored in the record whose status has been changed in step S12 = the balance of electronic money is increased by 100 yen, and the sequence number = 0001 and execution number = 00AA are encrypted with the session key of the record whose status is changed, and this is transmitted to the user apparatus 12 via the reader / writer 22 identified by the reader / writer number of the record whose status is changed. Send to. The sequence for transmitting a command in this step is identified by sequence number = 0001.

（ステップＳ１７）
　次いで、ユーザ装置１２が、第１サーバ３０から受信したシーケンス番号＝０００１、及び実行番号＝００ＡＡを参照しつつ、第１サーバ３０から受信したコマンドを実行し、データの更新条件が満たされているかどうかを判断する（ステップＳ１７）。そして、ユーザ装置１２は、満たされている場合にはユーザ装置１２内のデータを更新する（ステップＳ１８）。ここでは、データの更新条件が満たされているものとして、ユーザ装置１２はデータを更新する。また、ユーザ装置１２内に記憶される電子マネーの残高があらかじめ２００円であったものとし、電子マネーの残高は２００円から３００円に変更されるものとする。なお、ユーザ装置１２、１４は、例えば、ユーザ装置１２、１４内の記憶装置に、データ更新を行ったコマンドの実行番号を記憶しておくことができる。このようすれば、既にデータ更新を行ったコマンドであるかどうかを容易に判断することができる。 (Step S17)
Next, the user device 12 executes the command received from the first server 30 while referring to the sequence number = 0001 and the execution number = 00AA received from the first server 30, and the data update condition is satisfied. It is determined whether or not (step S17). And the user apparatus 12 updates the data in the user apparatus 12 when satisfy | filling (step S18). Here, it is assumed that the data update condition is satisfied, and the user device 12 updates the data. Also, it is assumed that the balance of electronic money stored in the user device 12 is 200 yen in advance, and the balance of electronic money is changed from 200 yen to 300 yen. Note that the user devices 12 and 14 can store the execution number of the command that updated the data, for example, in a storage device in the user devices 12 and 14. In this way, it is possible to easily determine whether the command has already been updated.

（ステップＳ１９）
　次いで、ユーザ装置１２が、第１サーバ３０に対して、データの更新が正常に完了したことを示すレスポンスを送信する。ユーザ装置１２は、レスポンスの送信前に、このレスポンスを第１サーバ３０との相互認証により生成したセッション鍵により暗号化する。本ステップによりレスポンスを送信するシーケンスは、シーケンス番号＝０００２で識別される。なお、本実施形態では、本ステップによりユーザ装置１２から送信されたレスポンスが第１サーバ３０に到達する前に喪失されてしまうものとする。 (Step S19)
Next, the user device 12 transmits a response indicating that the data update has been normally completed to the first server 30. The user device 12 encrypts this response with a session key generated by mutual authentication with the first server 30 before transmitting the response. The sequence for transmitting the response in this step is identified by sequence number = 0002. In the present embodiment, it is assumed that the response transmitted from the user device 12 in this step is lost before reaching the first server 30.

（ステップＳ２０）
　次いで、第１サーバ３０に障害が発生し、第１サーバ３０から第２サーバ４０へユーザ装置１２、１４に対する処理が引き継がれるものとする。これにより、以後、ユーザ装置１２、１４に対する処理は第１サーバ３０ではなく第２サーバ４０が受け持つことになる。なお、例えば、第２サーバ４０は第１サーバ３０に対して所定のインターバルでポーリングを送信し、第１サーバ３０からポーリングに対する返答がない場合には、第１サーバ３０に障害が生じたと判断して、第１サーバ３０から処理を引き継ぐことができる。また、例えば、第２サーバ４０は、第１サーバ３０と第２サーバ４０の負荷を監視する負荷分担装置（ロードバランサ）から引き継ぎを行う旨の命令を受信した場合に、この受信した命令に従い、第１サーバ３０の処理を引き継ぐことができる。 (Step S20)
Next, it is assumed that a failure occurs in the first server 30 and processing for the user devices 12 and 14 is taken over from the first server 30 to the second server 40. As a result, the processing for the user devices 12 and 14 is handled not by the first server 30 but by the second server 40 thereafter. For example, the second server 40 transmits polling to the first server 30 at a predetermined interval, and when the first server 30 does not respond to the polling, it is determined that a failure has occurred in the first server 30. Thus, the processing can be taken over from the first server 30. Further, for example, when the second server 40 receives an instruction to take over from a load sharing device (load balancer) that monitors the load of the first server 30 and the second server 40, according to the received instruction, The processing of the first server 30 can be taken over.

（ステップＳ２１、ステップＳ２２）
　次いで、第２サーバ４０が、第２サーバ４０内のデータに基づき、ユーザ装置１２、１４から所定時間以内にレスポンスが届いていないかどうかを判断し（ステップＳ２１）、届いていない場合には第２サーバ４０内のデータを更新する（ステップＳ２２）。本実施形態では、第２サーバ４０は、ユーザ装置１２から所定時間以内にレスポンスが届いていないものと判断し、第２サーバ４０内のデータを更新する。レスポンスが届いていないかどうかの判断は、例えば、第２サーバ４０内のテーブルに記憶されているレコードのうち、ステータスがＷａｉｔであるレコードを特定し、この特定したレコードの更新時刻から所定の時間が経過しているかどうかを判断することにより行うことができる。 (Step S21, Step S22)
Next, the second server 40 determines whether or not a response has arrived within a predetermined time from the user devices 12 and 14 based on the data in the second server 40 (step S21). 2 Update the data in the server 40 (step S22). In the present embodiment, the second server 40 determines that no response has been received from the user device 12 within a predetermined time, and updates the data in the second server 40. The determination of whether or not the response has arrived is performed by, for example, identifying a record whose status is Wait among the records stored in the table in the second server 40 and determining a predetermined time from the update time of the identified record. This can be done by judging whether or not.

　ステップＳ２２によるデータの更新は、例えば、次のように行うことができる。すなわち、まず、第２サーバ４０が、第２サーバ４０内に記憶するテーブルからステータスがＷａｉｔであるレコードを特定する。次いで、第２サーバ４０が、この特定したレコードからコマンド＝電子マネーの残高を１００円増額、シーケンス番号＝０００１、実行番号＝００ＡＡ、セッション鍵、リーダライタ番号＝リーダライタ２２、及びステータス＝Ｗａｉｔを読み出す。次いで、第２サーバ４０が、読み出したシーケンス番号＝０００１に基づき新たなシーケンス番号＝０００３を生成し、新たなレコード番号＝２、読み出したコマンド＝電子マネーの残高を１００円増額、生成したシーケンス番号＝０００３、読み出した実行番号＝００ＡＡ、読み出したセッション鍵、読み出したリーダライタ番号＝リーダライタ２２、ステータス＝Ｒｅａｄｙ、及び更新時刻を有する新たなレコードを第２サーバ４０内のテーブルに追加する。 The data update in step S22 can be performed as follows, for example. That is, first, the second server 40 specifies a record whose status is Wait from the table stored in the second server 40. Next, the second server 40 increases the balance of command = electronic money from this specified record by 100 yen, sequence number = 0001, execution number = 00AA, session key, reader / writer number = reader / writer 22, and status = Wait. read out. Next, the second server 40 generates a new sequence number = 0003 based on the read sequence number = 0001, the new record number = 2, the read command = the balance of electronic money is increased by 100 yen, and the generated sequence number = 0003, read execution number = 00AA, read session key, read reader / writer number = reader / writer 22, status = Ready, and a new record having update time is added to the table in the second server 40.

（ステップＳ２３、ステップＳ２４）
　次いで、第２サーバ４０が、第２サーバ４０内のデータに基づいて、コマンド、シーケンス番号、及び実行番号をリーダライタ２２を介してユーザ装置１２に対し送信する。例えば、第２サーバ４０は、第２サーバ４０内のテーブルからステータスがＲｅａｄｙであるレコードを特定し、この特定したレコードのステータスをＲｅａｄｙからＷａｉｔに変更する。次いで、第２サーバ４０は、このステータスを変更したレコードに格納されているコマンド、シーケンス番号、及び実行番号を、このステータスを変更したレコードに格納されているセッション鍵で暗号化し、このステータスを変更したレコードのリーダライタ番号で識別されるリーダライタ２２を介して、そのリーダライタ２２との間で通信を行うユーザ装置１２に対して送信する。本ステップによりコマンドを送信するシーケンスは、シーケンス番号＝０００３で識別される。 (Step S23, Step S24)
Next, the second server 40 transmits a command, a sequence number, and an execution number to the user device 12 via the reader / writer 22 based on the data in the second server 40. For example, the second server 40 identifies a record whose status is Ready from the table in the second server 40, and changes the status of the identified record from Ready to Wait. Next, the second server 40 encrypts the command, sequence number, and execution number stored in the record whose status has been changed with the session key stored in the record whose status has been changed, and changes this status. The data is transmitted to the user device 12 that communicates with the reader / writer 22 via the reader / writer 22 identified by the reader / writer number of the record. The sequence for transmitting the command in this step is identified by sequence number = 0003.

（ステップＳ２５、ステップＳ２６）
　次いで、ユーザ装置１２が、第２サーバ４０から受信したシーケンス番号＝０００３及び実行番号＝００ＡＡを参照しつつ、第２サーバ４０から受信したコマンドを実行し、データの更新条件が満たされているかどうか判断する（ステップＳ２４）。そして、ユーザ装置１２は、データの更新条件が満たされている場合にはユーザ装置１２内のデータを更新する（ステップＳ２５）。ここでは、シーケンス番号が予め定められたプロトコルに従い０００２から０００３に規則正しくインクリメントされているが、実行番号が既にデータ更新を行ったコマンドの実行番号と同じ００ＡＡであるため、データの更新条件は満たされていないものとする。したがって、ユーザ装置１２によるデータの更新は行われない。なお、ユーザ装置１２は、ユーザ装置１２内の記憶装置に既にデータ更新を行ったコマンドの実行番号が記憶されている場合は、第２サーバ４０から受信した実行番号をこの記憶されている実行番号と比較することにより、実行番号が既にデータ更新を行ったコマンドの実行番号と同じであるかどうかを容易に判断することができる。 (Step S25, Step S26)
Next, the user device 12 executes the command received from the second server 40 while referring to the sequence number = 0003 and the execution number = 00AA received from the second server 40, and whether or not the data update condition is satisfied Judgment is made (step S24). Then, the user device 12 updates the data in the user device 12 when the data update condition is satisfied (step S25). Here, the sequence number is regularly incremented from 0002 to 0003 according to a predetermined protocol, but since the execution number is 00AA which is the same as the execution number of the command that has already updated the data, the data update condition is satisfied. Shall not. Therefore, the data update by the user device 12 is not performed. If the execution number of the command that has already been updated is stored in the storage device in the user device 12, the user device 12 uses the execution number received from the second server 40 as the stored execution number. It is possible to easily determine whether or not the execution number is the same as the execution number of the command that has already updated the data.

（ステップＳ２７、ステップＳ２８）
　次いで、ユーザ装置１２が、第２サーバ４０に対して、データの更新に対するレスポンスを送信する。ユーザ装置１２は、このレスポンスの送信前に、このレスポンスを第１サーバ３０との相互認証により生成したセッション鍵により暗号化する。本ステップによりレスポンスを送信するシーケンスは、シーケンス番号＝０００４で識別される。 (Step S27, Step S28)
Next, the user device 12 transmits a response to the data update to the second server 40. The user device 12 encrypts the response with the session key generated by mutual authentication with the first server 30 before transmitting the response. The sequence for transmitting the response in this step is identified by sequence number = 0004.

　以上説明した実施形態１に係る通信システムによれば、第１サーバ３０と第２サーバ４０の同期（レプリケーション）が適切なタイミングで行われる。すなわち、第１サーバ３０からユーザ装置１２、１４に対しコマンドを送信する前に、第１サーバ３０から第２サーバ４０に対してデータ更新情報が送信され、第１サーバ３０内のデータと第２サーバ４０内のデータとが同期（レプリケーション）される。したがって、第１サーバ３０からユーザ装置１２、１４に対しコマンドを送信した後に第１サーバ３０から第２サーバ４０への切り替わりが生じても、第１サーバ３０から第２サーバ４０へユーザ装置１２、１４に対する処理を正しく引き継ぐことができる。 According to the communication system according to the first embodiment described above, synchronization (replication) of the first server 30 and the second server 40 is performed at an appropriate timing. That is, before the command is transmitted from the first server 30 to the user devices 12 and 14, the data update information is transmitted from the first server 30 to the second server 40, and the data in the first server 30 and the second Data in the server 40 is synchronized (replicated). Therefore, even if a switch from the first server 30 to the second server 40 occurs after transmitting a command from the first server 30 to the user devices 12, 14, the user device 12, 14 can be correctly taken over.

　なお、本実施形態では、通信システム１が、第１サーバ３０と第２サーバ４０という２台のサーバを備えるものとしたが、通信システム１は、３台以上のサーバを備えていてもよい。この場合、３台目以降のサーバは、例えば、上記で説明した第２サーバ４０と同様に動作させることができる。また、３台目以降のサーバには、例えば、第１サーバ３０ではなく、第１サーバ３０の処理を引き継ぐ場合と同様の方法により、第２サーバ４０の処理を引き継がせることもできる。 In the present embodiment, the communication system 1 includes two servers, the first server 30 and the second server 40, but the communication system 1 may include three or more servers. In this case, the third and subsequent servers can be operated in the same manner as the second server 40 described above, for example. Further, for example, the third and subsequent servers can take over the process of the second server 40 by the same method as the case of taking over the process of the first server 30 instead of the first server 30.

［比較例１］
　比較例１として、第１サーバ３０からユーザ装置１２、１４に対しコマンドを送信した後、１秒経過後、第１サーバ３０から第２サーバ４０に対してデータ更新情報が送信される通信システムを検討する。比較例１では、第１サーバ３０からユーザ装置１２、１４に対しコマンドを送信した後、第１サーバ３０から第２サーバ４０に対してデータ更新情報を送信する前に、第１サーバ３０に障害が生じ、第１サーバ３０から第２サーバ４０への切り替わりが生じるものとする。 [Comparative Example 1]
As Comparative Example 1, a communication system in which data update information is transmitted from the first server 30 to the second server 40 after one second has elapsed after the command is transmitted from the first server 30 to the user devices 12 and 14. consider. In the first comparative example, after the command is transmitted from the first server 30 to the user devices 12 and 14, the first server 30 fails before the data update information is transmitted from the first server 30 to the second server 40. It is assumed that switching from the first server 30 to the second server 40 occurs.

　比較例１では、第２サーバ４０内のデータはコマンド送信後における第１サーバ３０内の最新データと同期されず、第２サーバ４０内のテーブルには、コマンド＝電子マネーの残高を１００円増額、シーケンス番号＝０００１、実行番号＝００ＡＡ、セッション鍵、リーダライタ番号＝リーダライタ２２、及びステータス＝Ｗａｉｔが存在しない。したがって、比較例１では、第１サーバ３０から第２サーバ４０に対してユーザ装置１２、１４に対する処理を正しく引き継ぐことができない。 In Comparative Example 1, the data in the second server 40 is not synchronized with the latest data in the first server 30 after the command transmission, and the command = electronic money balance is increased by 100 yen in the table in the second server 40. , Sequence number = 0001, execution number = 00AA, session key, reader / writer number = reader / writer 22, and status = Wait do not exist. Therefore, in the first comparative example, the processing for the user devices 12 and 14 cannot be correctly taken over from the first server 30 to the second server 40.

　具体的には、比較例１によると、シーケンス番号が正しく引き継がれないため、ユーザ装置１２は、上記したステップＳ２５でデータの更新条件を満たさないと判断し、ユーザ装置１２内のデータを更新するステップＳ２６を実行しない。 Specifically, according to Comparative Example 1, since the sequence number is not correctly transferred, the user apparatus 12 determines that the data update condition is not satisfied in step S25 described above, and updates the data in the user apparatus 12. Step S26 is not executed.

　また、実行番号が正しく引き継がれないため、仮にステップＳ２６のデータ更新が実行されると、ユーザ装置１２内に記憶される電子マネーの残高が既に１００円増加されているにもかかわらず、誤って再び１００円増額されることになる。 In addition, since the execution number is not taken over correctly, if the data update in step S26 is executed, the balance of electronic money stored in the user device 12 has already been increased by 100 yen. It will be increased by 100 yen again.

　以上、実施形態について説明したが、これらの説明は、本発明の一例に関するものであり、本発明は、これらの説明によって何ら限定されるものではない。 As mentioned above, although embodiment was described, these description is related with an example of this invention, and this invention is not limited at all by these description.

１　　　　　通信システム
１２、１４　ユーザ装置
２２、２４　リーダライタ
３０　　　　第１サーバ
４０　　　　第２サーバ
５０　　　　ネットワーク
  DESCRIPTION OF SYMBOLS 1 Communication system 12, 14 User apparatus 22, 24 Reader / writer 30 1st server 40 2nd server 50 Network

Claims (5)

　第１サーバと第２サーバを備えた通信システムであって、
　前記第１サーバは、
　前記第２サーバとリーダライタとにネットワークを介して接続され、
　データ更新情報を前記第２サーバに対して送信し、
　前記データ更新情報を前記第２サーバに対して送信した後、前記リーダライタを介してユーザ装置に対しコマンドとコマンドの付随情報とを送信し、
　前記第２サーバは、
　前記リーダライタにネットワークを介して接続され、
　前記第１サーバから前記データ更新情報を受信した場合に、前記受信したデータ更新情報に基づいて前記第２サーバ内のデータを更新し、
　前記更新後、前記第１サーバから前記第２サーバへの切り替えが生じた場合、前記第２サーバ内のデータに基づいてコマンドとコマンドの付随情報とを前記リーダライタを介して前記ユーザ装置に対し送信する通信システム。 A communication system comprising a first server and a second server,
The first server is
Connected to the second server and the reader / writer via a network;
Sending data update information to the second server;
After transmitting the data update information to the second server, a command and accompanying information of the command are transmitted to the user device via the reader / writer,
The second server is
Connected to the reader / writer via a network;
When the data update information is received from the first server, the data in the second server is updated based on the received data update information,
After the update, when a switch from the first server to the second server occurs, a command and accompanying information of the command are sent to the user device via the reader / writer based on data in the second server. A communication system for transmission. 　前記データ更新情報にはシーケンス番号が含まれ、
　前記シーケンス番号はシーケンスごとに値が異なる請求項１に記載の通信システム。 The data update information includes a sequence number,
The communication system according to claim 1, wherein the sequence number has a different value for each sequence. 　前記データ更新情報には実行番号が含まれ、
　前記実行番号はコマンドごとに値が異なる請求項１または２に記載の通信システム。 The data update information includes an execution number,
The communication system according to claim 1, wherein the execution number has a different value for each command. 　前記データ更新情報にはセッション鍵が含まれ、
　前記セッション鍵はセッションごとに生成される鍵であり、
　前記コマンド及び前記コマンドの付随情報並びに前記ユーザ装置から送信されるレスポンスは前記セッション鍵により暗号化されている請求項１から３のいずれか１項に記載の通信システム。 The data update information includes a session key,
The session key is a key generated for each session;
The communication system according to any one of claims 1 to 3, wherein the command, accompanying information of the command, and a response transmitted from the user apparatus are encrypted by the session key. 　前記第２サーバは前記受信したデータ更新情報を暗号化して記憶している請求項１から４のいずれか１項に記載の通信システム。
  The communication system according to claim 1, wherein the second server stores the received data update information encrypted.
PCT/JP2017/000539 2017-01-11 2017-01-11 Communication system Ceased WO2018131082A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2017/000539 WO2018131082A1 (en) 2017-01-11 2017-01-11 Communication system
JP2017522561A JP6157797B1 (en) 2017-01-11 2017-01-11 Communications system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2017/000539 WO2018131082A1 (en) 2017-01-11 2017-01-11 Communication system

Publications (1)

Publication Number Publication Date
WO2018131082A1 true WO2018131082A1 (en) 2018-07-19

Family

ID=59272980

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2017/000539 Ceased WO2018131082A1 (en) 2017-01-11 2017-01-11 Communication system

Country Status (2)

Country Link
JP (1) JP6157797B1 (en)
WO (1) WO2018131082A1 (en)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000149080A (en) * 1998-11-13 2000-05-30 Toshiba Corp Access control device and access control system
JP2008123334A (en) * 2006-11-14 2008-05-29 National Institute Of Advanced Industrial & Technology Distributed server system
JP2015170226A (en) * 2014-03-07 2015-09-28 富士通株式会社 data transfer system and method

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000149080A (en) * 1998-11-13 2000-05-30 Toshiba Corp Access control device and access control system
JP2008123334A (en) * 2006-11-14 2008-05-29 National Institute Of Advanced Industrial & Technology Distributed server system
JP2015170226A (en) * 2014-03-07 2015-09-28 富士通株式会社 data transfer system and method

Also Published As

Publication number Publication date
JPWO2018131082A1 (en) 2019-01-17
JP6157797B1 (en) 2017-07-05

Similar Documents

Publication Publication Date Title
CN109756582B (en) Information recording method, device, node and storage medium in block chain network
JP5818816B2 (en) Method for identifying and authenticating a wireless tag by a reader
US20060031262A1 (en) Synchronizing client data and server data
US8769100B2 (en) Method and apparatus for cluster data processing
US20240275600A1 (en) Secure element, method for registering tokens, and token reference register
CN101443741A (en) System and method for using a dynamic credential to identify a cloned device
JP5040486B2 (en) Network system and program
JP2017525018A (en) Electronic device, system, and method for NFC
CN106375064B (en) A kind of code keyboard usb communication abnormal restoring method and system
JP2009015748A (en) Network system and program
TW201349005A (en) Security information interactive system, security information interactive device and security information interactive method based on spreading parameter set
JP6157797B1 (en) Communications system
US7828218B1 (en) Method and system of communicating devices, and devices therefor, with protected data transfer
US20230222509A1 (en) Method, terminal, and coin register for transmitting electronic coin data sets
US10536280B2 (en) RFID tag for secure access to a service from an access terminal
JP5979719B2 (en) ATM system and method
JP2025110134A (en) ELECTRONIC INFORMATION STORAGE MEDIUM, IC CHIP, IC CARD, SECURE CHANNEL OPENING METHOD, AND PROGRAM
US10514850B2 (en) Information processing system, server device, Information processing method, and computer program product
CN119585760A (en) Secure element, method for registering tokens, and token reference register
JP6801448B2 (en) Electronic information storage media, authentication systems, authentication methods, and authentication application programs
CN103164912B (en) A kind of POS system and information processing method based on this POS system
JP2023088716A (en) Information processing device, information processing system and program
JP2007173911A (en) Data processing apparatus, program, and system
JP2015050736A (en) Settlement terminal and settlement terminal program
JP2009230315A (en) Terminal, information storing medium, service providing system, and data updating method

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2017522561

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17891782

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17891782

Country of ref document: EP

Kind code of ref document: A1