JP7556543B2 - COMMUNICATION DEVICE, DEVICE, COMMUNICATION SYSTEM, PROVISIONING METHOD, AND PROGRAM - Google Patents

Description

This invention relates to technology for turning non-IoT (Internet of Things) devices into IoT devices.

With the recent spread of IoT, there are many services that use devices that have been commercialized as IoT devices from the start. IoT devices are devices that can connect to a network and exchange information with the outside world.

On the other hand, there are many non-IoT devices, such as machine tools, that have been in use since before IoT became widespread and are still in use today.

In order to turn such non-IoT devices into IoT devices, there are cases where data collection, etc. is achieved by connecting external devices with network functions such as mobile networks or wireless LANs to the non-IoT devices.

Some external devices with network functionality have a built-in SIM (Subscriber Identity Module), making it possible to build a more secure network.

JP 2014-164565 A

IoT devices are often used to upload data stored in the IoT device to a data collection system.

In order for IoT devices to be able to upload data to a data collection system, provisioning, such as registering initial setting information, is required for the IoT devices. However, as the number of IoT devices continues to grow, provisioning each and every one of them becomes an enormous task.

The present invention has been made in consideration of the above points, and aims to provide a technology that enables automatic provisioning of IoT devices.

According to the disclosed technology, there is provided a communication device having a SIM,
a device information acquisition unit that detects a connection between the communication device and a device;
a communication control unit that transmits a provisioning information request to a management system after detecting the connection and receives provisioning information from the management system;
a provisioning control unit on the SIM that executes provisioning using the provisioning information;
The communication control unit transmits an authentication key generated from the authentication information acquired from the SIM and the device specific information acquired from the device by the device information acquisition unit to the management system, thereby requesting authentication of the device and the communication device.
A communications device is provided.

The disclosed technology makes it possible to automatically perform provisioning on IoT devices.

FIG. 1 is a configuration diagram of a communication system according to a first embodiment. FIG. 2 is a sequence diagram according to the first embodiment. FIG. 11 is a configuration diagram of a communication system according to a second embodiment. FIG. 11 is a sequence diagram according to the second embodiment. FIG. 2 is a diagram showing an overview of the configuration of a SIM. FIG. 1 is a diagram illustrating a concept of profile switching. FIG. 2 is a diagram illustrating an example of a hardware configuration of a SIM. FIG. 2 is a diagram illustrating a hardware configuration of the device.

The following describes an embodiment of the present invention (the present embodiment) with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applicable is not limited to the following embodiment.

(Overview of the embodiment)
In this embodiment, in order to IoT-ify a non-IoT device, a SIM equipped with a program (application) that performs automatic provisioning in the SIM applet area is used as the SIM to be installed in a communication device that is connected to the non-IoT device and used.

By using a device equipped with such a SIM, it is possible to connect to a system that has provisioning information and automatically perform the steps up to downloading and registering the provisioning information.

In addition, in this embodiment, as an example of authentication processing, in addition to SIM authentication using the SIM provided in the communication device, device authentication is performed using information on the device to which the communication device is connected.

The information used for device authentication may be any information that is unique to the device. In this embodiment, the "device-specific ID," "hash value of device software," and "device-specific behavior" are used as examples.

As described above, in this embodiment, an authentication method of SIM authentication + device authentication is used, which makes it possible to prevent unauthorized acquisition of data by connecting a communication device such as an external device with a SIM to a malicious device.

In the present embodiment, the information used for device authentication, "device-specific ID," "device software hash value," and "device-specific behavior," may be any one of these, any two of these, or all three. These are collectively referred to as device-specific information.

For example, one type of device authentication may be used, such as SIM authentication + device-specific ID, or two types of device authentication may be used, such as SIM authentication + device-specific ID + device software hash value.

In addition, "SIM authentication + device authentication" is performed by a program, which may be installed in the SIM as a SIM applet, or in a communication device (other than the SIM) that is an external device, or in the device itself.

Below, examples 1 to 3 are described as examples of the specific configuration and operation of this embodiment.

Example 1
Fig. 1 is a configuration diagram of a communication system in Example 1. As shown in Fig. 1, the communication system in Example 1 includes a device 100, a communication device 200, a management system 300, and an authentication system 400. The communication device 200, the management system 300, and the authentication system 400 are capable of communicating with other devices via a network as shown in the figure.

The device 100 is a non-IoT device. As an example, a machine tool or the like is used as the device 100.

The communication device 200 is an external device containing a SIM card, and is used by connecting it to the device 100. The communication device 200 may be called a "dongle." The communication device 200 is assumed to be small, but is not limited to being small, and may be, for example, a PC.

As shown in FIG. 1, the communication device 200 has a device information acquisition unit 201, a communication control unit 202, an authentication control unit 203, and an SIM 204. The SIM 204 also has a provisioning control unit 205. The provisioning control unit 205 is a program (applet) for performing provisioning. The SIM 204 has a processor (CPU) and can execute programs by itself. The processing operations of each unit will be explained in the sequence explanation below.

The management system 300 stores provisioning information and has a function of providing the provisioning information to a request source based on a request. The management system 300 also has a function of performing authentication processing using the authentication system 400. The authentication system 400 is a system that performs authentication.

An example of the operation of the communication system according to the first embodiment having the above configuration will be described with reference to the sequence in FIG. 2.

When the communication device 200 is connected to the device 100 and power supply to the communication device 200 begins, or when the communication device 200 is powered on and connected to the device 100, the SIM authentication + device authentication process begins.

After the device information acquisition unit 201 installed in the communication device 200 detects a connection between the communication device 200 and the device 100, in S101, the device information acquisition unit 201 acquires device-specific information of the device 100, and in S103, passes the acquisition result based on a request from the authentication control unit 203. The device-specific information is one or more of the following: "device-specific ID", "hash value of device software", and "device-specific behavior".

Note that "device-specific behavior" may be any information that represents device-specific behavior, and is not limited to specific information. For example, "device-specific behavior" may be fluctuation information (period, magnitude, etc.) of power usage, statistics (average, median, etc.) of values obtained from a sensor connected to device 100, or other information.

The authentication control unit 203 is a program installed in the application area of the communication device 200 or on the SIM applet, but in the first embodiment, as an example, the authentication control unit 203 is installed in the application area of the communication device 200.

In S102, the authentication control unit 203 requests SIM information from the SIM 204 and acquires the SIM information. The SIM information is information consisting of an IMSI (International Mobile Subscriber Identity) and an authentication key. The SIM information may also be called authentication information.

After acquiring the SIM information (IMSI and authentication key), the authentication control unit 203 generates an authentication key from the SIM information and device-specific information. The authentication control unit 203 may use the device-specific information and SIM information as the authentication key as is, or may generate new information from the device-specific information and SIM information and use this as the authentication key.

After generating the authentication key, the authentication control unit 203 transmits the authentication key to the communication control unit 202 in S104.

In S105, the communication control unit 202, which has received the authentication key, sends a provisioning information request to the management system 300. The provisioning information request includes an authentication request having the above-mentioned authentication key.

In S106, the management system 300, which has received the provisioning information request and authentication request, uses the authentication key to make an authentication request for the communication device 200 to the authentication system 400.

When the authentication system 400 receives an authentication request, it checks the authentication information held within the system and the authentication key accompanying the authentication request, determines whether the authentication was successful or unsuccessful, and sends an authentication response to the management system 300. Here, the authentication system 400 determines that the authentication is successful if the authentication information held within the system matches the authentication key accompanying the authentication request.

The authentication system 400 may also use a subscriber management device in the mobile network to perform additional authentication based only on SIM information, and determine that authentication is successful only if authentication is successful for both the authentication key and the SIM information.

In S107, the management system 300, which has received an authentication response (assuming authentication was successful) from the authentication system 400, transmits the provisioning information registered in the management system 300 to the communication device 200 in response to the provisioning information request received from the communication device 200, together with the authentication response.

The provisioning information transmitted from the management system 300 to the communication device 200 includes, for example, address information indicating the upload destination of the information of the device 100, sensor information, etc. The sensor information is, for example, information that specifies one or more sensors to be uploaded from among multiple sensors connected to the device 100.

In S108, the communication control unit 202 of the communication device 200 that has received the provisioning information response from the management system 300 transmits the provisioning information to the provisioning control unit 205 on the SIM applet. The provisioning control unit 205 performs initial settings of the communication device 200 using the received provisioning information. In the initial settings, for example, the provisioning information (e.g., the address of the upload destination of the information of the device 100) is stored in the applet area of the SIM 204 (e.g., an applet area that stores an application that uploads information of the device 100). In addition, in the initial settings, provisioning on the device 100 side may be performed as shown in S109. For example, in S109, sensor information may be set in the device 100.

The provisioning control unit 205 may be provided in an application area of the communication device 200, rather than on the SIM 204. The authentication control unit 203 may be provided as an applet on the SIM 204.

In the above example, the provisioning information request and authentication request are sent simultaneously, but this is just an example. It is also possible to send the authentication request first, obtain a successful authentication result, and then send the provisioning information request.

Example 2
Next, a second embodiment will be described. Fig. 3 is a configuration diagram of a communication system in the second embodiment. As can be seen by comparing Fig. 3 with Fig. 1 (first embodiment), in the second embodiment, the communication device 200, which is an external SIM-equipped device, is not used, and instead, the functions of the communication device 200 are provided in the equipment 100. In other words, in the second embodiment, the equipment 100 itself is provided with a provisioning control function and a SIM authentication + equipment authentication function.

Specifically, as shown in FIG. 3, the device 100 of the second embodiment has a device control unit 101, a device information acquisition unit 102, a communication control unit 103, an authentication control unit 104, a SIM 105, and a device information recording unit 107. The device information recording unit 107 stores device-specific information used for authentication. In addition, the SIM 105 has a provisioning control unit 106.

The functions of the device information acquisition unit 102, the communication control unit 103, the authentication control unit 104, and the SIM 105 are the same as those of the device information acquisition unit 201, the communication control unit 202, the authentication control unit 203, and the SIM 204 in the communication device 200. However, in the second embodiment, the device-specific information is acquired from the device information recording unit 107.

Figure 4 shows a sequence in Example 2. In Example 2, the SIM authentication + device authentication process starts when the device 100 is turned on. However, this is an example, and the SIM authentication + device authentication process may start at other times.

Except for obtaining the device-specific information from the device information recording unit 107 in the device 100, the processing operations related to the sequence in the second embodiment are the same as the processing operations related to the sequence in the first embodiment (Figure 2).

In the second embodiment, similarly to the first embodiment, the communication control unit 103 of the device 100 that has received a provisioning information response from the management system 300 transmits the provisioning information to the provisioning control unit 106 on the SIM applet in S208. The provisioning control unit 106 performs initial settings of the device 100 using the received provisioning information. In the initial settings, for example, the address of the upload destination of the information of the device 100 is set for the applet of the SIM 105 (e.g., an applet that uploads information of the device 100). In addition, in the initial settings, for example, sensor information may be set in the device control unit 101 in S209.

The provisioning control unit 106 may be provided in an application area of the device 100, rather than on the SIM 205. The authentication control unit 104 may be provided as an applet on the SIM 105.

In the above example, the provisioning information request and authentication request are sent simultaneously, but this is just an example. It is also possible to send the authentication request first, obtain a successful authentication result, and then send the provisioning information request.

Example 3
Next, a description will be given of a third embodiment. The third embodiment may be applied to either the first embodiment or the second embodiment. In the following, as an example, a case in which the technology of the third embodiment is applied to the SIM 204 in the communication device 200 of the first embodiment will be described.

＜Overview＞
In recent years, it has become possible to remotely write a profile to a SIM or change the profile via a network. A mechanism for writing a profile from a network is called RSP (Remote SIM Provisioning). A SIM that can write a profile via a network using RSP is called an eSIM, and in this specification, "SIM" includes eSIMs.

However, in conventional technology, applets are stored in the SIM in a manner linked to a profile, so when an enabled profile is switched from one profile to another, the applets linked to the previous profile become unusable.

Therefore, when using a conventional SIM and provisioning the SIM applet, if the profile is switched, the applet that was being used previously will no longer be usable and re-provisioning will be required.

On the other hand, in the third embodiment, as described below, the profile area and the applet area are separated in the SIM, so that the information registered by automatic provisioning can be maintained even if the profile is changed.

<General configuration of SIM 204>
Fig. 5 is a diagram showing a schematic configuration of the SIM 204 in the embodiment 3. As shown in Fig. 5, the SIM 204 has an applet area 214 for storing applets and a profile area 224 for storing profiles. In addition, the applet area 214 and the profile area 224 are separated from each other.

For example, only a mobile network operator with SIM issuing rights can access the profile area 224. The mobile network operator has a key for accessing the profile area 224, and can use that key to access the profile area and write a profile, etc.

The key for accessing the applet area 214 is a different key from the key for accessing the profile area 224, and can be provided to a party other than the person with SIM issuing rights (e.g., a third party developing applets).

Hereafter, the key for accessing the profile area will be called the profile area key, and the key for accessing the applet area will be called the applet area key.

The applet area key is different for each SIM. This means that the applet area key of one SIM cannot be used to access the applet area of another SIM.

Furthermore, SIM204 may have multiple applet areas, and each of the multiple applet areas in SIM204 may be provided with a separate, different applet area key, or an applet area key that can be commonly used for the multiple applet areas may be provided.

In the third embodiment, a third party developing an applet can have an applet area key that is different from the profile area key, so that the third party developing an applet can freely develop the applet, install it in the SIM 204, test it, and implement it commercially.

<About switching profiles>
The profile stored in the SIM 204 consists of information for connecting to the network of a mobile network operator (e.g., MSISDN, IMSI), and a different profile is used for each connected mobile network operator. When multiple profiles are stored in the SIM 204, one of the profiles becomes an enabled profile, and the other profiles become disabled profiles.

A profile in the enabled state is recognized by the communication device 200 and communication is performed using it. A profile in the disabled state is not recognized by the communication device 200.

As shown in FIG. 6, for example, if profile 1 of mobile network operator 1 and profile 2 of mobile network operator 2 are stored in SIM 204, profile 1 is enabled when communication device 200 communicates on the network of mobile network operator 1, and profile 2 is enabled when communication device 200 communicates on the network of mobile network operator 2.

In the SIM 204 of the third embodiment, as shown in FIG. 5, the applet area 110 and the profile area 120 are separated, and the applets are made independent of the profile. Therefore, for example, even if communication using applet 1 is switched to communication using applet 2, applet A can continue to be used.

<Example of hardware configuration of SIM 204>
7 shows an example of a hardware configuration of the SIM 204. As shown in FIG. 7, the SIM 204 includes a CPU 254, a memory 274, and an input/output unit 264.

The CPU 254 is a processor that reads the programs stored in the memory 274 and performs processing according to the instructions. The programs include an OS, an applet execution environment, applets, a program for authentication processing, a program for communication processing, a profile enabler, etc. The input/output unit 264 is an interface with the communication device 200.

Memory 274 stores data such as profiles, applets, and programs other than applets.

In this embodiment, the applet area for storing applets and the profile area for storing profiles are realized, for example, by memory 274 (storage unit). The separation of the applet area and the profile area may be realized by physically dividing the areas in memory 274, or may be realized by using multiple memories (memory for the applet area and memory for the profile area). The separation of the applet area and the profile area may also be realized by methods other than these.

(Example of device hardware configuration)
The device 100, communication device 200, management system 300, and authentication system 400 (collectively referred to as "devices") in this embodiment described in Examples 1 to 3 can all be realized, for example, by having a computer execute a program describing the processing contents described in this embodiment. Note that with respect to the device 100, it is assumed that the part that executes the processing according to this embodiment can be realized by a computer and a program.

This "computer" can be a physical machine or a virtual machine on the cloud. If a virtual machine is used, the "hardware" described here is virtual hardware.

The above program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The above program can also be provided via a network such as the Internet or e-mail.

Figure 8 is a diagram showing an example of the hardware configuration of the computer. The computer in Figure 8 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by a bus B. The SIM 1009 shown in Figure 8 is provided in the communication device 200. There are also cases where the SIM 1009 is provided in the device.

Depending on the device, one or more or all of the drive device 1000, display device 1006, input device 1007, and output device 1008 may not be included.

The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 via the drive device 1000 into the auxiliary storage device 1002. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

When an instruction to start a program is received, the memory device 1003 reads out the program from the auxiliary storage device 1002 and stores it. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. Note that when an applet (program) of the SIM 1009 is used, the CPU built into the SIM 1009 may execute the program.

The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the results of calculations.

(Effects of the embodiment)
The technology according to the present embodiment described above enables secure communication with a server or cloud, and allows appropriate provisioning to be registered for each IoT device.

In other words, provisioning information that has been registered in advance on the server can be sent from the server or cloud to the IoT device, and the IoT device can then register the received provisioning information, achieving automatic provisioning. Automatic provisioning eliminates the need to perform provisioning work on each IoT device one by one.

In addition, by adopting SIM authentication + device authentication, in addition to registering provisioning information specific to communications, it is also possible to automatically register provisioning information specific to the device.

(Summary of the embodiment)
This specification describes at least the communication device, equipment, communication system, provisioning method, and program described in the following sections.
(Section 1)
A communication device including a SIM,
a device information acquisition unit that detects a connection between the communication device and a device;
a communication control unit that transmits a provisioning information request to a management system after detecting the connection and receives provisioning information from the management system;
a provisioning control unit on the SIM that executes provisioning using the provisioning information.
(Section 2)
The communication control unit requests authentication of the device and the communication device by sending an authentication key generated from authentication information acquired from the SIM and device-specific information acquired from the device by the device information acquisition unit to the management system.
(Section 3)
The SIM is
a profile area for storing a profile used to utilize a line of a mobile network operator;
an application area for storing the provisioning information;
3. The communication device according to claim 1, wherein the profile area and the application area are separated.
(Section 4)
A device equipped with a SIM,
a communication control unit that transmits a provisioning information request to a management system and receives provisioning information from the management system;
and a provisioning control unit on the SIM that executes provisioning using the provisioning information.
(Section 5)
A communication system comprising a device, a communication device having a SIM, and a management system,
After the communication device detects a connection with a device, the communication device transmits a provisioning information request to a management system;
The management system that receives the provisioning information request transmits provisioning information to the communication device;
A communication system, wherein in the communication device that has received provisioning information from the management system, a provisioning control unit on the SIM executes provisioning using the provisioning information.
(Section 6)
A communication system comprising a device having a SIM and a management system,
The device sends a provisioning information request to a management system;
The management system that receives the provisioning information request transmits provisioning information to the device;
A communication system, wherein in the device that has received provisioning information from the management system, a provisioning control unit on the SIM executes provisioning using the provisioning information.
(Section 7)
A provisioning method performed by a communication device having a SIM, comprising:
sending a provisioning information request to a management system after the communication device detects a connection with a device, and receiving provisioning information from the management system;
a provisioning control unit on the SIM performing provisioning using the provisioning information.
(Section 8)
A provisioning method performed by a device equipped with a SIM, comprising:
sending a provisioning information request to a management system and receiving provisioning information from the management system;
a provisioning control unit on the SIM performing provisioning using the provisioning information.
(Section 9)
A program for causing a computer to function as each unit in the communication device according to any one of claims 1 to 3.
(Article 10)
A program for causing a computer to function as each unit in the device described in claim 4.

Although the present embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

100 Device 101 Device control unit 102 Device information acquisition unit 103 Communication control unit 104 Authentication control unit 105 SIM
106 Provisioning control unit 107 Device information recording unit 200 Communication device 201 Device information acquisition unit 202 Communication control unit 203 Authentication control unit 204 SIM
214 Applet area 224 Profile area 254 CPU
264 Input/Output unit 274 Memory 205 Provisioning control unit 300 Management system 400 Authentication system 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 Interface device 1006 Display device 1007 Input device 1008 Output device 1009 SIM

Claims (9)

A communication device including a SIM,
a device information acquisition unit that detects a connection between the communication device and a device;
a communication control unit that transmits a provisioning information request to a management system after detecting the connection and receives provisioning information from the management system;
a provisioning control unit on the SIM that executes provisioning using the provisioning information;
The communication control unit transmits an authentication key generated from the authentication information acquired from the SIM and the device specific information acquired from the device by the device information acquisition unit to the management system, thereby requesting authentication of the device and the communication device.
Communications equipment. The SIM is
a profile area for storing a profile used to utilize a line of a mobile network operator;
an application area for storing the provisioning information;
The communication device of claim 1 , wherein the profile area and the application area are separate. A device equipped with a SIM,
a communication control unit that transmits a provisioning information request to a management system and receives provisioning information from the management system;
a provisioning control unit on the SIM that executes provisioning using the provisioning information;
The communication control unit transmits an authentication key generated from authentication information acquired from the SIM and device specific information acquired from the device to the management system, thereby requesting authentication of the device.
device. A communication system comprising a device, a communication device having a SIM, and a management system,
After the communication device detects a connection with a device, the communication device transmits a provisioning information request to a management system;
The management system that receives the provisioning information request transmits provisioning information to the communication device;
a communication system in which, in the communication device that receives provisioning information from the management system, a provisioning control unit on the SIM executes provisioning using the provisioning information,
The communication device transmits to the management system an authentication key generated from authentication information acquired from the SIM and device-specific information acquired from the device, thereby requesting authentication of the device and the communication device.
Communication systems . A communication system comprising a device having a SIM and a management system,
The device sends a provisioning information request to a management system;
The management system that receives the provisioning information request transmits provisioning information to the device;
a communication system in which, in the device that has received provisioning information from the management system, a provisioning control unit on the SIM executes provisioning using the provisioning information;
The device transmits an authentication key generated from authentication information acquired from the SIM and device-specific information acquired from the device to the management system, thereby requesting authentication of the device.
Communication systems . A provisioning method performed by a communication device having a SIM, comprising:
sending a provisioning information request to a management system after the communication device detects a connection with a device, and receiving provisioning information from the management system;
a provisioning control unit on the SIM performing provisioning using the provisioning information;
The communication device transmits to the management system an authentication key generated from authentication information acquired from the SIM and device-specific information acquired from the device, thereby requesting authentication of the device and the communication device.
Provisioning method. A provisioning method performed by a device equipped with a SIM, comprising:
sending a provisioning information request to a management system and receiving provisioning information from the management system;
a provisioning control unit on the SIM performing provisioning using the provisioning information;
The device transmits an authentication key generated from authentication information acquired from the SIM and device-specific information acquired from the device to the management system, thereby requesting authentication of the device.
Provisioning method. A program for causing a computer to function as each unit in the communication device according to claim 1 or 2 . A program for causing a computer to function as each unit in the device according to claim 3 .

Images