JP7572050B2 - COMMUNICATION DEVICE, DEVICE, COMMUNICATION SYSTEM, AUTHENTICATION METHOD, AND PROGRAM - Google Patents

Description

This invention relates to technology for turning non-IoT (Internet of Things) devices into IoT devices.

With the recent spread of IoT, there are many services that use devices that have been commercialized as IoT devices from the start. IoT devices are devices that can connect to a network and exchange information with the outside world.

On the other hand, there are many non-IoT devices, such as machine tools, that have been in use since before IoT became widespread and are still in use today.

In order to turn such non-IoT devices into IoT devices, there are cases where data collection, etc. is achieved by connecting external devices with network functions such as mobile networks or wireless LANs to the non-IoT devices.

Some external devices with network functionality have a built-in SIM (Subscriber Identity Module), making it possible to build a more secure network.

JP 2016-201032 A

An external device with a built-in SIM is capable of authentication and communication on its own. Therefore, simply connecting an external device with a SIM to a non-IoT device will turn that device into an IoT device, and the device and its data can be managed from a server or cloud.

On the other hand, because external devices such as SIM-equipped external devices can be plugged in and removed, there is a risk that the external device will be connected to a malicious device. In other words, if authentication for connecting an external device to a server or cloud is performed using only the SIM, there is a risk that a malicious device could illegally obtain data from the server or cloud. Note that this issue is not limited to when using external devices, but can occur in all devices that use authentication information such as SIM information for authentication.

The present invention has been made in consideration of the above points, and aims to provide a technology for preventing unauthorized devices from connecting to a network.

According to the disclosed technology, there is provided a communication device connectable to a device,
a device information acquisition unit that acquires hashing target information from the device to which the communication device is connected;
a hash value control unit that generates a hash value from the hashing target information;
a communication control unit that transmits an authentication request including authentication information held by the communication device and the hash value to an authentication system that performs authentication processing for the communication device and the equipment;
The authentication information is SIM information obtained from a SIM provided in the communication device, and the SIM information includes an IMSI and an authentication key.
A communications device is provided.

The disclosed technology makes it possible to prevent unauthorized devices from connecting to the network.

FIG. 1 is a configuration diagram of a communication system according to a first embodiment. FIG. 2 is a sequence diagram according to the first embodiment. FIG. 11 is a configuration diagram of a communication system according to a second embodiment. FIG. 11 is a sequence diagram according to the second embodiment. FIG. 2 is a diagram illustrating a hardware configuration of the device.

The following describes an embodiment of the present invention (the present embodiment) with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applicable is not limited to the following embodiment.

Note that in the embodiment described below, an authentication method using SIM information is used as an authentication method other than device authentication using a hash value, but this is just one example. Authentication using authentication information other than SIM information may also be used as an authentication method other than device authentication using a hash value.

(Overview of the embodiment)
In this embodiment, for example, a communication device such as an external device with a SIM card is connected to a device to turn the device into an IoT device, i.e., to provide the device with a network connection function.

As network-side authentication for devices connected to the above-mentioned communication device, in addition to SIM authentication using the SIM installed in the communication device, device authentication will be performed using information on the device to which the communication device is connected.

The information used for device authentication is a hash value of the device's software information. In this specification, "software" is used to mean both firmware and software other than firmware. In other words, the device software that is the source of the hash value may be firmware or software other than firmware.

As described above, in this embodiment, the authentication method of "SIM authentication + device authentication using the hash value of the device software" is used, which makes it possible to prevent unauthorized acquisition of data by connecting a communication device such as an external SIM-equipped device to a malicious device.

The hash value calculated from the software information inside the device will change if the software inside the device is updated. If the hash value changes, the device authentication result will be determined to be abnormal, and it may become impossible to connect to the server or cloud.

Therefore, in this embodiment, in addition to the hash value, update management information is used to manage whether or not the software inside the device has been updated. If the update management information indicates "no update," the hash value can be used as is as authentication information. Also, if it indicates "update," the hash value is registered as a new authentication value.

The control of "SIM authentication + device authentication using the hash value of the device software", which includes the control of the hash value as described above, is executed by a program, which may be installed in the SIM as a SIM applet, or in a communication device (other than the SIM) that is an external device, or in the device itself.

Below, a more specific system configuration and an example of operation will be described using an embodiment. In the embodiment, as an example, it is assumed that information on a non-IoT device is uploaded to a server or cloud, and security incidents are prevented by performing the above-mentioned SIM authentication + device authentication (hash value) in the authentication step prior to that. If authentication fails, measures can be taken, such as not connecting the device to the network.

Below, examples 1 and 2 are described as examples of the specific configuration and operation of this embodiment.

Example 1
<System Configuration>
Fig. 1 is a configuration diagram of a communication system in Example 1. As shown in Fig. 1, the communication system in Example 1 includes a device 100, a communication device 200, an authentication system 300, and a subscriber management device 400. The communication device 200, the authentication system 300, and the subscriber management device 400 are capable of communicating with other devices via a network as shown in the figure.

The device 100 is a non-IoT device. As an example, a machine tool or the like is used as the device 100.

The communication device 200 is an external device containing a SIM card, and is used by connecting it to the device 100. The communication device 200 may be called a "dongle." The communication device 200 is assumed to be small, but is not limited to being small, and may be, for example, a PC.

As shown in FIG. 1, the communication device 200 has a device information acquisition unit 201, a communication control unit 202, an authentication control unit 203, a SIM 204, and a hash value control unit 205. The hash value control unit 205 is a program (applet) for performing control based on a hash value. The SIM 204 has a processor (CPU), and can execute programs by itself. The hash value control unit 205 may be provided outside the SIM 204, or may be provided within the SIM 204. The processing operations of each unit will be explained in the sequence explanation below.

The authentication system 300 is a system that performs authentication. The subscriber management device 400 is a device that manages the subscriber information of the operator of the SIM 204, and includes a function for performing SIM authentication.

<Example of operation>
An operation example of the communication system according to the first embodiment having the above configuration will be described with reference to the sequence of FIG.

When the communication device 200 is connected to the device 100 and power supply to the communication device 200 begins, or when the communication device 200 is powered on and connected to the device 100, the SIM authentication + device authentication (hash value) process begins.

After the device information acquisition unit 201 installed in the communication device 200 detects a connection between the communication device 200 and the device 100, in S101, the device information acquisition unit 201 acquires software information of the device 100 and update management information for the software from the device 100.

The software information is the information from which the hash value is calculated, and may be any information related to software. For example, the software information may be one or more of the following: program code, software ID, software version, parameters used in the software (e.g., weight parameters of a neural network), input information to the software, and output information from the software. Note that the information from which the hash value is calculated (information to be hashed) may be information other than software information.

The update management information is information that indicates whether the information to be hashed (in this embodiment, software information) has been updated or not ("no update" or "update").

For example, "no update" indicates that there was no update between the time when the device information acquisition unit 201 last acquired software information and the time when the device information acquisition unit 201 currently acquires software information. Also, "update available" indicates that there was an update between the time when the device information acquisition unit 201 last acquired software information and the time when the device information acquisition unit 201 currently acquires software information.

In this embodiment, it is assumed that the update management information is generated in the device 100, but the device information acquisition unit 201 of the communication device 200 may generate the update management information.

For example, the device information acquisition unit 201 holds the acquired software information. The device information acquisition unit 201 compares the previously acquired software information with the currently acquired software information, and if they are identical, generates "no update" as the update management information, and if there is a difference, generates "update available" as the update management information.

In S102, the device information acquisition unit 201 passes the software information (information to be hashed) and update management information to the hash value control unit 205.

The hash value control unit 205 is a program installed in the application area of the communication device 200 or on the SIM applet, but in the first embodiment, as an example, the hash value control unit 205 is installed in the application area of the communication device 200.

In S103, the hash value control unit 205 generates a hash value from the received software information and transmits the hash value and the update management information to the authentication control unit 203.

The authentication control unit 203 is a program installed in the application area of the communication device 200 or on the SIM applet, but in the first embodiment, as an example, the authentication control unit 203 is installed in the application area of the communication device 200.

In S104, the authentication control unit 203 requests SIM information from the SIM 204 and acquires the SIM information. The SIM information is information consisting of an IMSI (International Mobile Subscriber Identity) and an authentication key. The SIM information may also be called authentication information.

After acquiring the SIM information (IMSI and authentication key), the authentication control unit 203 transmits the SIM information, hash value, update management information, and hash value registration information (collectively referred to as "authentication-related information") to the communication control unit 202 in S105. The hash value registration information is information indicating whether or not a hash value has been registered in the authentication system 300.

When the communication control unit 202 receives the authentication-related information and detects that the update management information indicates "update available," or when it detects that the hash value registration information indicates "hash value not registered," it executes S106, S107, and S108.

In addition, when the communication control unit 202 receives information regarding authentication and detects that the update management information is "no update" and the hash value registration information is "hash value registered," it proceeds to S109 without executing S106, S107, and S108.

In S106, the communication control unit 202 transmits a hash value registration request to the authentication system 300. The hash value registration request includes the hash value and SIM information.

The authentication system 300 stores a hash value associated with each SIM information. Note that the processing for a communication device 200 for which an initial authentication request has not been executed will be described later.

When the authentication system 300 detects that the request received from the communication device 200 is a hash value registration request, it overwrites the hash value linked to the SIM information held within the authentication system 300 based on the SIM information and hash value accompanying the request, and in S107, it transmits a response indicating that the hash value registration has been completed to the communication device 200 as a hash value registration response.

In S108, the communication control unit 202 notifies the authentication control unit 203 that the hash value has been registered. By receiving the information that the hash value has been registered, the authentication control unit 203 sets the subsequent hash value registration information to "hash value registered."

In S109, the communication control unit 202 transmits an authentication request to the authentication system 300. The authentication request includes the hash value and SIM information.

When the authentication system 300 detects that the request received from the communication device 200 is an authentication request, it compares the information accompanying the authentication request with the data in the authentication system 300, and if the information is normal, it requests the subscriber management device 400 to authenticate the SIM information (S110). Note that, for example, the data comparison is performed by checking whether or not the hash value registered in association with the SIM information accompanying the authentication request matches the hash value accompanying the authentication request.

The authentication system 300 receives a SIM authentication request response (information indicating whether authentication is OK or not) from the subscriber management device 400.

The authentication system 300 determines that authentication of the communication device 200 and the equipment 100 has been successful if the comparison result between the information accompanying the authentication request and the data in the authentication system 300 is OK, and if the authentication based on the SIM information by the subscriber management device 400 is OK.

However, this is just an example, and it may be possible to determine that authentication of the communication device 200 and the equipment 100 has been successful if the information accompanying the authentication request matches the data in the authentication system 300 and the authentication is successful without performing authentication by the subscriber management device 400.

In S111, the authentication system 300 transmits an authentication response to the communication device 200. In S112, the communication control unit 202 transmits the authentication result to the authentication control unit 203. For example, if the authentication result is OK, the authentication control unit 203 notifies the communication control unit 202 that the authentication is OK, and the communication control unit 202 accesses, for example, a management system or the like to obtain provisioning information.

When the communication control unit 202 of the communication device 200 accesses the authentication device 300 for the first time, it first executes an authentication request in S109. The initial authentication request includes SIM information.

When the authentication system 300 receives an initial authentication request from the communication device 200, it performs authentication using only the SIM information. After the authentication is successful, the hash value is registered in the authentication system 300 as information linked to the SIM information through the processes of S106 to S108.

Note that for the first time, the authentication system 300 that receives the authentication request (including SIM information and hash value) in S109 may perform authentication using only the SIM information and register the hash value.

Example 2
Next, a second embodiment will be described. Fig. 3 is a configuration diagram of a communication system in the second embodiment. As can be seen by comparing Fig. 3 with Fig. 1 (first embodiment), in the second embodiment, the communication device 200, which is an external SIM-equipped device, is not used, and instead, the functions of the communication device 200 are provided in the equipment 100. In other words, in the second embodiment, the equipment 100 itself is provided with the functions of SIM authentication + equipment authentication (hash value).

Specifically, as shown in FIG. 3, the device 100 of the second embodiment has a device information acquisition unit 101, a communication control unit 102, an authentication control unit 103, a SIM 104, a hash value control unit 105, and a device information recording unit 106. The device information recording unit 106 stores information to be hashed (such as software information) and update management information.

The functions of the device information acquisition unit 101, communication control unit 102, authentication control unit 103, SIM 104, and hash value control unit 105 are the same as those of the device information acquisition unit 201, communication control unit 202, authentication control unit 203, SIM 204, and hash value control unit 205 in the communication device 200 described in the first embodiment. However, in the second embodiment, information to be hashed (such as software information) and update management information are acquired from the device information recording unit 106.

Figure 4 shows a sequence in Example 2. In Example 2, the SIM authentication + device authentication (hash value) process starts when the device 100 is powered on. However, this is an example, and the SIM authentication + device authentication (hash value) process may start at other times.

Except for obtaining the information to be hashed (such as software information) and the update management information from the device information recording unit 106 in the device 100, the processing operations related to the sequence in the second embodiment are the same as the processing operations related to the sequence in the first embodiment (Figure 2).

(Example of device hardware configuration)
The device 100, communication device 200, authentication system 300, and subscriber management device 400 (collectively referred to as "devices") in this embodiment described in Examples 1 and 2 can all be realized, for example, by having a computer execute a program describing the processing contents described in this embodiment. Note that with respect to the device 100, it is assumed that the part that executes the processing related to this embodiment can be realized by a computer and a program.

This "computer" can be a physical machine or a virtual machine on the cloud. If a virtual machine is used, the "hardware" described here is virtual hardware.

The above program can be recorded on a computer-readable recording medium (such as a portable memory) and can be stored or distributed. The above program can also be provided via a network such as the Internet or e-mail.

Figure 5 is a diagram showing an example of the hardware configuration of the computer. The computer in Figure 5 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are connected to each other via a bus B. The device may also be equipped with a SIM 1009.

Depending on the device, one or more or all of the drive device 1000, display device 1006, input device 1007, and output device 1008 may not be included.

The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 via the drive device 1000 into the auxiliary storage device 1002. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

When an instruction to start a program is received, the memory device 1003 reads out the program from the auxiliary storage device 1002 and stores it. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. Note that when an applet (program) of the SIM 1009 is used, the CPU built into the SIM 1009 may execute the program.

The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the results of calculations.

(Effects of the embodiment)
According to the technique according to the present embodiment described above, unauthorized devices can be prevented from connecting to the network.

(Summary of the embodiment)
This specification describes at least the communication device, equipment, communication system, authentication method, and program described in the following sections.
(Section 1)
A communication device connectable to a device,
a device information acquisition unit that acquires hashing target information from the device to which the communication device is connected;
a hash value control unit that generates a hash value from the hashing target information;
a communication control unit that transmits an authentication request, including authentication information held by the communication device and the hash value, to an authentication system that performs authentication processing for the communication device and the equipment.
(Section 2)
The communication device according to claim 1, wherein the authentication information is SIM information obtained from a SIM provided in the communication device.
(Section 3)
3. The communication device according to claim 1, wherein when the hashing target information is updated, the communication control unit transmits a hash value registration request including the authentication information and the hash value to the authentication system.
(Section 4)
A device for storing authentication information,
a device information acquisition unit that acquires hashing target information of the device;
a hash value control unit that generates a hash value from the hashing target information;
a communication control unit that transmits an authentication request, including the authentication information and the hash value, to an authentication system that performs an authentication process for the device.
(Section 5)
A communication system including a device, a communication device connected to the device, and an authentication system,
The communication device acquires hashing target information from the device,
the communication device generates a hash value from the hashing target information;
the communication device transmits an authentication request to the authentication system, the request including authentication information held by the communication device and the hash value;
A communication system, wherein the authentication system performs authentication processing for the communication device and the equipment using the authentication information and the hash value.
(Section 6)
A communication system including a device that holds authentication information and an authentication system,
The device acquires information to be hashed of the device,
The device generates a hash value from the hashing target information,
The device transmits an authentication request to the authentication system, the request including the authentication information and the hash value;
A communication system, wherein the authentication system performs authentication processing for the device using the authentication information and the hash value.
(Section 7)
1. An authentication method performed by a communication device connectable to a device, comprising:
acquiring information to be hashed from the device to which the communication device is connected;
generating a hash value from the hashing target information;
and transmitting an authentication request including authentication information held by the communication device and the hash value to an authentication system that performs authentication processing for the communication device and the equipment.
(Section 8)
An authentication method executed by a device that holds authentication information, comprising:
acquiring information to be hashed of the device;
generating a hash value from the hashing target information;
and transmitting an authentication request including the authentication information and the hash value to an authentication system that performs authentication processing for the device.
(Section 9)
A program for causing a computer to function as each unit in the communication device according to any one of claims 1 to 3.
(Article 10)
A program for causing a computer to function as each unit in the device described in claim 4.

Although the present embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims.

100 Device 101 Device information acquisition unit 102 Communication control unit 103 Authentication control unit 104 SIM
105 Hash value control unit 106 Device information recording unit 200 Communication device 201 Device information acquisition unit 202 Communication control unit 203 Authentication control unit 204 SIM
205 Hash value control unit 300 Authentication system 400 Subscriber management device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 Interface device 1006 Display device 1007 Input device 1008 Output device 1009 SIM

Claims (9)

A communication device connectable to a device,
a device information acquisition unit that acquires hashing target information from the device to which the communication device is connected;
a hash value control unit that generates a hash value from the hashing target information;
a communication control unit that transmits an authentication request including authentication information held by the communication device and the hash value to an authentication system that performs authentication processing for the communication device and the equipment;
The authentication information is SIM information obtained from a SIM provided in the communication device, and the SIM information includes an IMSI and an authentication key.
Communications equipment. The communication device according to claim 1 , wherein when the hashing target information is updated, the communication control unit transmits a hash value registration request including the authentication information and the hash value to the authentication system. A device for storing authentication information,
a device information acquisition unit that acquires hashing target information of the device;
a hash value control unit that generates a hash value from the hashing target information;
a communication control unit that transmits an authentication request including the authentication information and the hash value to an authentication system that performs an authentication process for the device;
The authentication information is SIM information obtained from a SIM provided in the device, and the SIM information includes an IMSI and an authentication key.
device. A communication system including a device, a communication device connected to the device, and an authentication system,
The communication device acquires hashing target information from the device,
the communication device generates a hash value from the hashing target information;
the communication device transmits an authentication request to the authentication system, the request including authentication information held by the communication device and the hash value;
the authentication system is a communication system that performs authentication processing for the communication device and the equipment by using the authentication information and the hash value,
The authentication information is SIM information obtained from a SIM provided in the communication device, and the SIM information includes an IMSI and an authentication key.
Communication systems. A communication system including a device that holds authentication information and an authentication system,
The device acquires information to be hashed of the device,
The device generates a hash value from the hashing target information,
The device transmits an authentication request to the authentication system, the request including the authentication information and the hash value;
the authentication system is a communication system that performs an authentication process for the device by using the authentication information and the hash value,
The authentication information is SIM information obtained from a SIM provided in the device, and the SIM information includes an IMSI and an authentication key.
Communication systems. 1. An authentication method performed by a communication device connectable to a device, comprising:
acquiring information to be hashed from the device to which the communication device is connected;
generating a hash value from the hashing target information;
transmitting an authentication request including authentication information held by the communication device and the hash value to an authentication system that performs authentication processing for the communication device and the equipment;
The authentication information is SIM information obtained from a SIM provided in the communication device, and the SIM information includes an IMSI and an authentication key.
Authentication method. An authentication method executed by a device that holds authentication information, comprising:
acquiring information to be hashed of the device;
generating a hash value from the hashing target information;
transmitting an authentication request including the authentication information and the hash value to an authentication system that performs an authentication process for the device;
The authentication information is SIM information obtained from a SIM provided in the device, and the SIM information includes an IMSI and an authentication key.
Authentication method. A program for causing a computer to function as each unit in the communication device according to claim 1 or 2 . A program for causing a computer to function as each unit in the device according to claim 3 .

Images