Access management device, communication device, access management system, access management method, access management program, communication method, and communication program

Abstract

It would be desirable to be able to set for each user the time during which file data can be transferred between the cloud and the server. [Solution] An access management device that executes file data communication with a target device includes a gate control unit 210. The gate control unit 210 permits the target device to communicate file data with the access management device based on cloud-side authentication information during a target time, and updates the time indicated by the cloud-side time information from the target time to an updated target time, which is the time when the target device will next be permitted to communicate file data with the access management device. In addition, the gate control unit 210 does not permit the target device to communicate file data with the access management device from the end time of the target time to the start time of the updated target time.

Description

[Technical field]

[0001] The present disclosure relates to an access management device, a communication device, an access management system, an access management method, an access management program, a communication method, and a communication program. [Background technology]

[0002] The system configuration commonly adopted in systems that offload computational processing to the cloud is to collect raw data in an on-premises environment, upload the collected raw data to the cloud, perform calculations using the raw data in the cloud, and then return the calculation results to the on-premises environment. Raw data is the data collected on-site and is data before any computational processing has been performed. In the manufacturing industry in particular, raw data can be used to infer the status of production activities, so it is important to prevent raw data from being leaked to malicious parties. Therefore, when adopting this system configuration, the key point is how to ensure security to prevent unauthorized access to the cloud. Generally, authentication information consisting of multiple character strings (for example, ID and password) is exchanged to determine whether the accessing party is a legitimate person or not. Patent Document 1 discloses a technique for registering time information as an access permission condition for a management server as a method for further strengthening security. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2015-141354 Brochure Summary of the Invention [Problem to be solved by the invention]

[0004] The technology disclosed in Patent Document 1 has a problem in that it is not possible to set the time during which file data can be communicated with the cloud for each user. An object of the present disclosure is to enable each user to set the time during which file data can be communicated with the cloud. [Means for solving the problem]

[0005] The access management device according to the present disclosure comprises: An access management device that executes file data communication with a target device, A storage unit that stores cloud-side time information indicating a time during which the target device is permitted to communicate file data, and cloud-side authentication information that is authentication information corresponding to the target device; When a time indicated by the cloud-side time information is a target time, at the target time, the target device is permitted to communicate file data with the access management device based on the cloud-side authentication information, and the time indicated by the cloud-side time information is updated from the target time to an updated target time which is the time when the target device will next be permitted to communicate file data with the access management device; a gate control unit that does not permit the target device to communicate file data with the access management device from an end time of the target time to a start time of the updated target time; Equipped with. Effect of the Invention

[0006] According to the present disclosure, the gate control unit allows the target device to communicate file data with the access management device based on the cloud-side authentication information during the target time, and updates the time indicated by the cloud-side time information from the target time to the updated target time. The gate control unit does not allow the target device to communicate file data with the access management device from the end time of the target time to the start time of the updated target time. Here, the target time and the updated target time may be set for each user. The access management device may be a device constituting a cloud. Therefore, according to the present disclosure, it is possible to set the time during which file data can be communicated with the cloud for each user. [Brief description of the drawings]

[0007] [Figure 1] 1 is a diagram showing an example of the configuration of an access management system 90 according to a first embodiment. [Diagram 2] 1 is a diagram showing an example of the configuration of an access management system 90 according to a first embodiment. [Diagram 3] 1 is a diagram showing an example of a hardware configuration of a device 100 according to a first embodiment. [Figure 4] 5 is a flowchart showing the operation of the access management system 90 during upload according to the first embodiment. [Diagram 5] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 6] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 7] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 8] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 9] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 10] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 11] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 12] 5 is a diagram for explaining the state and processing of the access management system 90 during upload according to the first embodiment. FIG. [Figure 13] 5 is a flowchart showing the operation of the access management system 90 during download according to the first embodiment. [Figure 14] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 15] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 16] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 17] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 18] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 19] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 20] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 21] FIG. 4 is a diagram for explaining the state and processing of the access management system 90 during downloading according to the first embodiment. [Figure 22] FIG. 13 is a diagram showing an example of a hardware configuration of a device 100 according to a modification of the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. Descriptions of elements given the same reference numerals are omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow. In addition, "part" may be read as "circuit," "step," "procedure," "processing," or "circuitry" as appropriate.

[0009] Embodiment 1 Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0010] ***Configuration Description*** 1 shows a configuration example of an access management system 90 according to this embodiment and an outline of the operation of the access management system 90 within a specified time. As shown in Fig. 1, the access management system 90 includes a device 100 and a cloud 200. The access management system 90 may include a plurality of devices 100. As shown in FIG. 1, the device 100 can communicate file data with the cloud 200 within a specified time period.

[0011] The device 100 is a device operated by a user, and specific examples thereof include a PC (Personal Computer), an on-premise server, and a smartphone. The device 100 corresponds to a communication device. Each device 100 corresponds to a target device. The device 100 includes an upload unit 110, a download unit 120, and a storage unit 190. The storage unit 190 stores cloud authentication information 101 and a scheduled transmission / reception time 102 .

[0012] The cloud authentication information 101 is authentication information used when the device 100 accesses the cloud 200. As the cloud authentication information 101, authentication information for the upload unit 110 and authentication information for the download unit 120 may be prepared. Each piece of information may be data in a file format. Cloud authentication information 101 corresponds to user-side authentication information. User-side authentication information is authentication information corresponding to cloud-side authentication information. Cloud-side authentication information is authentication information for authenticating communication between an access management device and a communication device. The access management device is a device constituting the cloud 200, and is a device that executes communication of file data with a target device. The communication of file data is at least one of sending file data and receiving file data. File data may also be simply referred to as a file.

[0013] The scheduled transmission / reception time 102 is information indicating the time when the device 100 will next be permitted to communicate file data with the cloud 200 . A specific example of the scheduled transmission / reception time 102 is a text file. When the scheduled transmission / reception time 102 is a text file, the time indicated by the scheduled transmission / reception time 102 is, for example, a date and time or a time range recorded in the text file for each upload and download. The scheduled transmission / reception time 102 may be data in a format other than a text file. The time indicated by the scheduled transmission / reception time 102 corresponds to a specified time. As a specific example, the scheduled transmission / reception time 102 indicates at least one of an available upload time and an available download time. The scheduled transmission / reception time 102 may be different for each device 100. Note that the time may be appropriately interpreted as a time period. The scheduled transmission / reception time 102 corresponds to user-side time information. The user-side time information indicates a time during which the communication device is permitted to communicate file data in the access management device. When the time indicated by the user-side time information is a user-side target time, the user-side target time may be either an uploadable time or a downloadable time. The upload allowed time is the time during which the target device is permitted to upload file data to the access management device, that is, the time during which the device 100 can upload a file to the cloud 200. The downloadable time is the time during which the target device is permitted to download file data from the access management device, that is, the time during which the device 100 can download the file from the cloud 200. The designated time exists for each device 100. The designated time is a general term for the time when uploading is possible and the time when downloading is possible. The time when uploading is possible and the time when downloading is possible do not have to overlap. Data is exchanged between the device 100 and the cloud 200 by the upload unit 110 and the download unit 120 accessing each shared folder provided in the cloud 200. The upload unit 110 and the download unit 120 may be configured integrally.

[0014] When the user-side target time is the upload-allowed time, the upload unit 110 uses the user-side authentication information at the user-side target time to request permission to upload file data to the access management device. When uploading of file data to the access management device is permitted, the upload unit 110 uploads the file data to the access management device and determines the next upload time as the updated target time. Thereafter, the upload unit 110 updates the time indicated by the user-side time information from the user-side target time to the determined next upload time, and notifies the access management device of the determined next upload time. The next upload time is the time when file data will be uploaded to the access management device next time. The updated target time is the time when communication of file data by a communication device to the access management device will be permitted next time. When the user-side target time is the upload-available time and the access management device notifies the upload unit 110 of updated authentication information at the user-side target time, the upload unit 110 updates the user-side authentication information to first updated authentication information based on the updated authentication information. Also, at the next upload time, the upload unit 110 uses the first updated authentication information to request permission to upload file data from the access management device. The updated authentication information is authentication information generated by updating the cloud-side authentication information. As a specific example, the upload unit 110 has an upload folder, and also has a function of uploading various files to the cloud 200. A program that realizes this function is also called an upload program. The upload folder is a folder that stores files to be uploaded to the cloud 200. A specific example of the uploaded file is a file indicating data to be processed, calculated, and the like in the cloud 200.

[0015] When the user-side target time is the downloadable time, the download unit 120 uses the user-side authentication information to request permission to download file data from the access management device at the user-side target time. When downloading file data to the access management device is permitted, the download unit 120 downloads the file data from the access management device and determines the next download time as the updated target time. Thereafter, the download unit 120 updates the time indicated by the user-side time information to the next download time determined from the user-side target time, and notifies the access management device of the determined next download time. The next download time is the time when file data will be downloaded next from the access management device. When the user side target time is the downloadable time and the download unit 120 is notified of updated authentication information from the access management device at the user side target time, the download unit 120 updates the user side authentication information to second updated authentication information based on the updated authentication information. Also, at the next download time, the download unit 120 uses the second updated authentication information to request permission to download file data from the access management device. As a specific example, the download unit 120 has a download folder, and also has a function of downloading various files from the cloud 200. A program that realizes this function is also called a download program. The download folder is a folder for storing files downloaded from the cloud 200. A specific example of the downloaded file is a file showing the result of processing raw data in the cloud 200.

[0016] The cloud 200 is a device that constitutes a cloud server or a cloud system. As a specific example, the cloud 200 is a device that constitutes AWS (registered trademark, Amazon Web Services). The cloud 200 corresponds to an access management device. The cloud 200 includes a gate control unit 210 , a data processing unit 220 , an upload shared folder unit 230 , a download shared folder unit 240 , and a storage unit 290 . The storage unit 290 stores cloud authentication information 201 and a scheduled transmission / reception time 202 .

[0017] The cloud authentication information 201 is authentication information corresponding to the cloud authentication information 101, and is authentication information used to determine whether or not to permit each device 100 to access the cloud 200. The cloud authentication information 201 may be prepared for each device 100. As the cloud authentication information 201, authentication information for uploading files and authentication information for downloading files may be prepared. Cloud authentication information 201 corresponds to cloud-side authentication information. Cloud-side authentication information is authentication information corresponding to a target device.

[0018] The scheduled transmission / reception time 202 is information corresponding to the scheduled transmission / reception time 102, and is information indicating, for each device 100, the next time when the device 100 is permitted to communicate file data with the cloud 200. The time indicated by the scheduled transmission / reception time 202 corresponds to the specified time. The scheduled transmission / reception time 202 corresponds to cloud-side time information. The cloud-side time information indicates the time during which the communication of file data by the target device is permitted.

[0019] When the time indicated by the cloud-side time information is the target time, the gate control unit 210 permits the target device to communicate file data to the access management device based on the cloud-side authentication information at the target time, and updates the time indicated by the cloud-side time information from the target time to the updated target time. The updated target time is the time when the target device will next be permitted to communicate file data to the access management device. The updated target time may be a time randomly determined within the target time range. The target time range may be any time range. The target time may be either the upload-available time or the download-available time. The gate control unit 210 does not permit the target device to communicate file data to the access management device from the end time of the target time to the start time of the updated target time. The updated target time may be a time notified from the target device. When the target time is an upload-allowed time, the gate control unit 210 permits the target device to upload file data to the access management device based on the cloud-side authentication information during the target time, and sets the updated target time as the next time when the target device is permitted to upload file data to the access management device. Also, the gate control unit 210 does not permit the target device to upload file data to the access management device from the end time of the target time to the start time of the updated target time. When the target time is a downloadable time, the gate control unit 210 permits the target device to download file data from the access management device based on the cloud-side authentication information during the target time, and sets the updated target time as the time when the target device will next be permitted to download file data from the access management device. Also, the gate control unit 210 does not permit the target device to download file data from the access management device from the end time of the target time to the start time of the updated target time. The gate control unit 210 updates the authentication information indicated by the cloud-side authentication information to the updated authentication information at the target time, and notifies the target device of the updated authentication information. Also, the gate control unit 210 permits the target device to communicate file data with the access management device based on the updated authentication information at the post-update target time. As a specific example, the gate control unit 210 controls external access based on the cloud authentication information 201 . Furthermore, the gate control unit 210 has a function of controlling the time during which each shared folder in the cloud 200 can be accessed from outside, based on the scheduled transmission / reception time 202. The gate control unit 210 denies access to the cloud 200 by a user or a device 100 even if the user or the device 100 has access authority to the cloud 200 outside of the time. As a specific example, the function of the gate control unit 210 is realized by a gate control program.

[0020] The data processing unit 220 executes data processing using the data uploaded to the upload shared folder unit 230, and stores data indicating the results of the data processing in the download shared folder unit 240. The data processing unit 220 may execute data processing on a company basis or a product basis.

[0021] The upload shared folder section 230 is made up of an upload shared folder for storing files uploaded by the upload section 110 .

[0022] The download shared folder section 240 is made up of a download shared folder for storing files requested by the download section 120 .

[0023] FIG. 2 shows an example of the configuration of the access management system 90 and an overview of the operation of the access management system 90 outside of the designated hours. Outside the designated time is a time that is not within the designated time. A specific example of outside the designated time is a time that is neither an uploadable time nor a downloadable time. Outside the designated time, the gate control unit 210 does not permit access from the device 100. Outside the designated time, the gate control unit 210 does not have to permit only one of the device 100 uploading file data and the device 100 downloading file data.

[0024] 3 shows an example of a hardware configuration of the device 100 according to this embodiment. The device 100 is made up of a computer. The device 100 may be made up of multiple computers.

[0025] As shown in the figure, the device 100 is a computer including hardware such as a processor 11, a memory 12, an auxiliary storage device 13, an input / output IF (Interface) 14, and a communication device 15. These pieces of hardware are appropriately connected via signal lines 19.

[0026] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), and a graphics processing unit (GPU). The device 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0027] The memory 12 is typically a volatile storage device, and a specific example is a RAM (Random Access Memory). The memory 12 is also called a primary storage device or a main memory. Data stored in the memory 12 is saved in the secondary storage device 13 as necessary.

[0028] The auxiliary storage device 13 is typically a non-volatile storage device, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 13 is loaded into the memory 12 as necessary. The memory 12 and the auxiliary storage device 13 may be integrated into one unit.

[0029] The input / output IF 14 is a port to which an input device and an output device are connected. A specific example of the input / output IF 14 is a Universal Serial Bus (USB) terminal. Specific examples of the input device are a keyboard and a mouse. A specific example of the output device is a display.

[0030] The communication device 15 is a receiver and a transmitter, and is, for example, a communication chip or a network interface card (NIC).

[0031] Each unit of the device 100 may use the input / output IF 14 and the communication unit 15 as appropriate when communicating with other devices.

[0032] The auxiliary storage device 13 stores a communication program. The communication program is a program that causes a computer to realize the functions of each unit of the device 100. The communication program is loaded into the memory 12 and executed by the processor 11. The functions of each unit of the device 100 are realized by software.

[0033] Data used when executing the communication program and data obtained by executing the communication program are appropriately stored in the storage device. Each part of the device 100 uses the storage device as appropriate. As a specific example, the storage device is composed of at least one of the memory 12, the auxiliary storage device 13, a register in the processor 11, and a cache memory in the processor 11. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 12 and the auxiliary storage device 13 may be realized by other storage devices.

[0034] The communication program may be recorded in a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The communication program may be provided as a program product. The hardware configuration of the cloud 200 is similar to that of the device 100. Each of the storage unit 190 and the storage unit 290 is realized by a storage device. The above explanation regarding the "communication program" also applies to the "access management program".

[0035] ***Explanation of Operation*** The operating procedures of the devices included in the access management system 90 are collectively called an access management method. The programs that realize the operations of the devices included in the access management system 90 are collectively called an access management program. Moreover, the operation procedure of the device 100 is called a communication method. Each program that realizes the operation of the device 100 is collectively called a communication program.

[0036] Fig. 4 is a flowchart showing an example of the operation of the access management system 90 at the time of uploading. The operation will be described with reference to Fig. 4. In the explanation of this flowchart, the operation of the device 100 will be described as the operation of the target device, which is the device 100.

[0037] (Step S101) FIG. 5 is a diagram for explaining the state and processing of the access management system 90 in this step. The target device stores an “upload program” for uploading a target file to the cloud 200, as well as preset cloud authentication information 101 and scheduled transmission / reception time 102. The cloud 200 stores cloud authentication information 201 corresponding to the cloud authentication information 101 and a scheduled transmission / reception time 202 corresponding to the scheduled transmission / reception time 102. As a specific example, the "cloud authentication information" describes two types of character strings required for accessing the cloud 200. In this example, only when both of the two types of character strings indicated by the "cloud authentication information" match between the target device and the cloud 200, it is determined that "the upload unit 110 has the right to access the upload shared folder." The "scheduled transmission / reception time" indicates the next available time for uploading. In this step, the scheduled transmission / reception time 102 indicates the target time on the user side. The scheduled transmission / reception time 202 indicates the target time.

[0038] (Step S102) FIG. 6 is a diagram for explaining the state and processing of the access management system 90 in this step. The user stores the files to be uploaded to the cloud 200 in the upload folder of the target device. The upload unit 110 and the gate control unit 210 each operate periodically, and execute the process of step S103 when the time on each system reaches the start time of the upload-available time indicated by the "scheduled transmission / reception time".

[0039] (Step S103) FIG. 7 is a diagram for explaining the state and processing of the access management system 90 in this step. The upload unit 110 reads the cloud authentication information 101 . The gate control unit 210 removes the access restriction on the upload shared folder unit 230, which is based on the upload allowable time.

[0040] (Step S104) FIG. 8 is a diagram for explaining the state and processing of the access management system 90 in this step. The upload unit 110 accesses the upload shared folder unit 230 based on the read cloud authentication information 101 . If the cloud authentication information 101 and the cloud authentication information 201 match, the gate control unit 210 permits the upload unit 110 to access the upload shared folder unit 230. After that, the process of step S105 is executed. If the cloud authentication information 101 and the cloud authentication information 201 do not match, the gate control unit 210 denies access by the upload unit 110 .

[0041] (Step S105) FIG. 9 is a diagram for explaining the state and processing of the access management system 90 in this step. The upload section 110 uploads each file in an upload folder provided in the upload section 110 to the upload shared folder section 230.

[0042] (Step S106) FIG. 10 is a diagram for explaining the state and processing of the access management system 90 in this step. The upload unit 110 updates the available upload time indicated by the scheduled transmission / reception time 102, and transmits data indicating the updated available upload time to the cloud 200. At this time, the upload unit 110 may automatically update the available upload time, or may update the start time and duration of the available upload time. The updated available upload time corresponds to the next upload time and the target time after update. The gate control unit 210 receives the data indicating the updated available upload time, and updates the scheduled transmission / reception time 202 based on the received data. Here, the uploading unit 110 may set the uploading time to a random time within a certain time range in order to prevent a malicious third party from identifying the uploading time. As a specific example, the uploading unit 110 sets the period from 13:00 to 17:00, and sets the start time of the uploading time to a random time in 10-minute increments. As a specific example, the uploading unit 110 may set the start time of the uploading time to 14:20 at one time and 16:40 at another time.

[0043] (Step S107) FIG. 11 is a diagram for explaining the state and processing of the access management system 90 in this step. The gate control unit 210 operates periodically, and when it detects that the available upload time indicated by the scheduled transmission / reception time 202 has been updated, it updates the cloud authentication information 201 and places a "cloud authentication information" file, which is file format data indicating the updated cloud authentication information 201, in the upload shared folder unit 230. Note that placing the "cloud authentication information" file in the upload shared folder unit 230 corresponds to notifying the target device of the updated authentication information. The "cloud authentication information" corresponds to the updated authentication information and also corresponds to the first updated authentication information. The upload unit 110 operates periodically, and when it detects that a "cloud authentication information" file has been placed in the upload shared folder unit 230, it overwrites and updates the cloud authentication information 101 based on the "cloud authentication information" file.

[0044] (Step S108) FIG. 12 is a diagram for explaining the state and processing of the access management system 90 in this step. The gate control unit 210 restricts access to the upload shared folder unit 230 at the end time of the upload permitted time. Then, the process proceeds to step S101. In step S101 after the transition, the "cloud authentication information" and the "scheduled transmission / reception time" have been updated.

[0045] Fig. 13 is a flowchart showing an example of the operation of the access management system 90 at the time of downloading. The operation will be described with reference to Fig. 13. In the explanation of this flowchart, the operation of the device 100 will be described as the operation of the target device, which is the device 100.

[0046] (Step S201) 14 is a diagram for explaining the state and processing of the access management system 90 in this step. This step is similar to step S101. The target device stores a “download program” for downloading a target file from the cloud 200, as well as preset cloud authentication information 101 and scheduled transmission / reception time 102. The cloud 200 stores cloud authentication information 201 corresponding to the cloud authentication information 101 and a scheduled transmission / reception time 202 corresponding to the scheduled transmission / reception time 102. The "cloud authentication information" is as described above, and is used to determine whether the download unit 120 has the access right to the download shared folder. The "Scheduled transmission / reception time" field indicates the next available time for downloading.

[0047] (Step S202) FIG. 15 is a diagram for explaining the state and processing of the access management system 90 in this step. The download unit 120 and the gate control unit 210 each operate periodically, and execute the process of step S203 when the time on each system reaches the start time of the downloadable time indicated by the "scheduled transmission / reception time". The data processing unit 220 stores each download file in the download shared folder unit 240 by the start time of the downloadable time. Each download file may be a file corresponding to each uploaded file, or may be a file specified by the user. Note that the data processing unit 220 can operate the file in the cloud 200 even if the access is restricted.

[0048] (Step S203) FIG. 16 is a diagram for explaining the state and processing of the access management system 90 in this step. The download unit 120 reads the cloud authentication information 101 . The gate control unit 210 removes the access restriction on the download shared folder unit 240, which is based on the downloadable time.

[0049] (Step S204) FIG. 17 is a diagram for explaining the state and processing of the access management system 90 in this step. If the cloud authentication information 101 and the cloud authentication information 201 match, the gate control unit 210 permits the download unit 120 to access the download shared folder unit 240. After that, the process of step S205 is executed. If the cloud authentication information 101 and the cloud authentication information 201 do not match, the gate control unit 210 denies the access by the download unit 120 .

[0050] (Step S205) FIG. 18 is a diagram for explaining the state and processing of the access management system 90 in this step. The download section 120 downloads each file in the download shared folder section 240 to a download folder provided in the download section 120 .

[0051] (Step S206) 19 is a diagram for explaining the state and processing of the access management system 90 in this step. This step is similar to step S106. The download unit 120 updates the available download time indicated by the scheduled transmission / reception time 102, and transmits data indicating the updated available download time to the cloud 200. The updated available download time corresponds to the next download time and also corresponds to the post-update target time. The gate control unit 210 receives the data indicating the updated downloadable time, and updates the scheduled transmission / reception time 202 based on the received data.

[0052] (Step S207) 20 is a diagram for explaining the state and processing of the access management system 90 in this step. This step is similar to step S107. Gate control unit 210 operates periodically, and when it detects that the downloadable time indicated by scheduled transmission / reception time 202 has been updated, it updates cloud authentication information 201 and places a "cloud authentication information" file, which is file format data indicating the updated cloud authentication information 201, in download shared folder unit 240. Note that placing the "cloud authentication information" file in download shared folder unit 240 corresponds to notifying the target device of the updated authentication information. This "cloud authentication information" corresponds to the updated authentication information and also corresponds to the second updated authentication information. The download unit 120 operates periodically, and when it detects that a "cloud authentication information" file has been placed in the download shared folder unit 240, it overwrites and updates the cloud authentication information 101 based on the "cloud authentication information" file.

[0053] (Step S208) FIG. 21 is a diagram for explaining the state and processing of the access management system 90 in this step. The gate control unit 210 restricts access to the download shared folder unit 240 at the end time of the download permitted time. Then, the process proceeds to step S201. In step S201 after the transition, the "cloud authentication information" and the "scheduled transmission / reception time" have been updated.

[0054] ***Explanation of the Effects of the First Embodiment*** As described above, according to this embodiment, the gate control unit 210 determines whether the device 100 has the authority to access each shared folder at the time indicated by the "scheduled transmission / reception time" based on the information held by the device 100 as "cloud authentication information". In addition, each time file data communication is executed between the device 100 and the cloud 200, the "cloud authentication information" and the "scheduled transmission / reception time" are each updated. Each piece of updated information is shared between the device 100 and the cloud 200. Here, it is possible to identify authentication information consisting of multiple character strings by using a brute force method (a method of exhaustively extracting all possible combinations of character strings and using the extracted combinations for access), disregarding time and computer resources. On the other hand, in this embodiment, in addition to controlling access to the shared area of ​​the cloud 200 using "authentication information consisting of multiple character strings," the "accessible time" is limited to a very limited time, thereby further enhancing the strength of security. The "accessible time" and the "authentication information consisting of multiple character strings" are each changed every time the device 100 accesses the cloud 200. Therefore, according to this embodiment, even if a malicious user obtains information required to access cloud 200 using a brute force method or another method, he or she cannot access cloud 200 outside of the specific time period. Furthermore, since the authentication information and the time during which cloud 200 can be accessed are continuously updated, the possibility of rejecting unauthorized access is further increased.

[0055] Furthermore, according to this embodiment, the "cloud authentication information" and the "scheduled transmission / reception time" can be set and updated for each device 100. Therefore, according to this embodiment, security can be further strengthened in the cloud 200 that provides services to a large number of different users.

[0056] ***Other configurations*** <Variation 1> FIG. 22 shows an example of the hardware configuration of the device 100 according to this modification. The device 100 includes a processing circuit 18 in place of the processor 11 , the processor 11 and the memory 12 , the processor 11 and the auxiliary storage device 13 , or the processor 11 , the memory 12 , and the auxiliary storage device 13 . The processing circuitry 18 is hardware that realizes at least a portion of each unit included in the device 100. The processing circuitry 18 may be dedicated hardware, or may be a processor that executes programs stored in the memory 12 .

[0057] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The device 100 may include multiple processing circuits that replace the processing circuit 18. The multiple processing circuits share the role of the processing circuit 18.

[0058] In the device 100, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0059] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, memory 12, secondary storage device 13, and processing circuit 18 are collectively referred to as “processing circuitry.” In other words, the functions of each functional component of device 100 are realized by the processing circuitry. The cloud 200 may also have a configuration similar to that of this modified example. ***Other embodiments*** Although the first embodiment has been described, it is possible to combine a plurality of parts of the present embodiment. Alternatively, it is possible to partially implement the present embodiment. In addition, the present embodiment may be modified in various ways as necessary, and may be implemented in any combination, either as a whole or in part. The above-described embodiment is essentially a preferred example, and is not intended to limit the scope of the present disclosure, its applications, and uses. The procedures described using the flowcharts and the like may be modified as appropriate.

[0060] Various aspects of the present disclosure are summarized below as appendices.

[0061] (Appendix 1) An access management device that executes file data communication with a target device, A storage unit that stores cloud-side time information indicating a time during which the target device is permitted to communicate file data, and cloud-side authentication information that is authentication information corresponding to the target device; When a time indicated by the cloud-side time information is a target time, at the target time, the target device is permitted to communicate file data with the access management device based on the cloud-side authentication information, and the time indicated by the cloud-side time information is updated from the target time to an updated target time which is the time when the target device will next be permitted to communicate file data with the access management device; a gate control unit that does not permit the target device to communicate file data with the access management device from an end time of the target time to a start time of the updated target time; An access management device comprising:

[0062] (Appendix 2) 2. The access management device according to claim 1, wherein the post-update target time is a time notified from the target device.

[0063] (Appendix 3) 3. The access management device according to claim 1, wherein the post-update target time is a time randomly determined within a target time range.

[0064] (Appendix 4) the target time is either an uploadable time during which the target device is permitted to upload file data to the access management device, or a downloadable time during which the target device is permitted to download file data from the access management device, When the target time is the uploadable time, the gate control unit During the target time, the target device is permitted to upload file data to the access management device based on the cloud-side authentication information, and the post-update target time is set as a time when the target device is next permitted to upload file data to the access management device; not permitting the target device to upload file data to the access management device from the end time of the target time to the start time of the updated target time; When the target time is the downloadable time, the gate control unit During the target time, the target device is permitted to download file data from the access management device based on the cloud-side authentication information, and the post-update target time is set as a time when the target device is next permitted to download file data from the access management device; 4. The access management device of claim 1, wherein the target device is not permitted to download file data from the access management device from the end time of the target time to the start time of the updated target time.

[0065] (Appendix 5) The gate control unit includes: At the target time, updating authentication information indicated by the cloud-side authentication information to updated authentication information, and notifying the target device of the updated authentication information; 5. The access management device according to claim 1, wherein the target device is permitted to communicate file data with the access management device based on the updated authentication information during the post-update target time.

[0066] (Appendix 6) The access management device according to any one of Supplementary Note 1 to 5, wherein the access management device is a device constituting a cloud system.

[0067] (Appendix 7) A storage unit for storing user-side time information and user-side authentication information. A communication device comprising: the user-side time information indicates a time during which communication of file data by the communication device is permitted in an access management device that executes communication of file data with the communication device, the user-side authentication information is authentication information corresponding to cloud-side authentication information which is authentication information for authenticating communication between the access management device and the communication device, When the time indicated by the user-side time information is taken as a user-side target time, the user-side target time is either an uploadable time, which is a time during which the communication device is permitted to upload file data to the access management device, or a downloadable time, which is a time during which the communication device is permitted to download file data from the access management device, The communication device further comprises: an upload unit that, when the user-side target time is the upload possible time, requests permission to upload file data to the access management device using the user-side authentication information during the user-side target time, and when uploading of the file data to the access management device is permitted, uploads the file data to the access management device, determines a next upload time that is the time when the file data will next be uploaded to the access management device as an updated target time that is the time when the communication device will next be permitted to communicate file data to the access management device, updates the time indicated by the user-side time information to the next upload time determined from the user-side target time, and notifies the access management device of the determined next upload time; a download unit that, when the user-side target time is the downloadable time, requests permission to download file data from the access management device using the user-side authentication information during the user-side target time, and when downloading of the file data to the access management device is permitted, downloads the file data from the access management device, determines a next download time that is the time when the file data will be downloaded next from the access management device as the updated target time, updates the time indicated by the user-side time information to the next download time determined from the user-side target time, and notifies the access management device of the determined next download time; A communication device comprising:

[0068] (Appendix 8) When the user side target time is the uploadable time, the upload unit: when updated authentication information generated by updating the cloud-side authentication information is notified from the access management device during the user-side target time, updating the user-side authentication information to first updated authentication information based on the updated authentication information; requesting permission to upload file data to the access management device using the first updated authentication information at the next upload time; When the user side target time is the downloadable time, the download unit: When the updated authentication information is notified from the access management device during the user-side target time, the user-side authentication information is updated to second updated authentication information based on the updated authentication information; The communication device according to claim 7, which requests permission to download file data from the access management device using the second updated authentication information at the next download time.

[0069] (Appendix 9) 7. The access management device according to claim 1, An access control system comprising: The target device is a communication device according to appendix 7 or 8. An access control system comprising: [Explanation of symbols]

[0070] 11 processor, 12 memory, 13 auxiliary storage device, 14 input / output IF, 15 communication device, 18 processing circuit, 19 signal line, 90 access control system, 100 device, 101, 201 cloud authentication information, 102, 202 scheduled transmission / reception time, 110 upload unit, 120 download unit, 190 storage unit, 200 cloud, 210 gate control unit, 220 data processing unit, 230 upload shared folder unit, 240 download shared folder unit, 290 storage unit.

Claims

1. An access management device that executes file data communication with a target device, A storage unit that stores cloud-side time information indicating a time during which the target device is permitted to communicate file data, and cloud-side authentication information that is authentication information corresponding to the target device; permitting the target device to upload file data to the access management device based on the cloud-side authentication information at an upload allowed time, which is a time indicated by the cloud-side time information and is a time during which the target device is permitted to upload file data to the access management device, and updating the time indicated by the cloud-side time information to the time during which the target device will next be permitted to upload file data to the access management device; a gate control unit that does not permit the target device to upload file data to the access management device from the end time of the upload-enabled time to the start time of the time when the next upload of the file data is permitted; An access management device comprising:

2. The gate control unit permitting the target device to download file data from the access management device based on the cloud-side authentication information at a download-allowed time, which is a time indicated by the cloud-side time information and is a time during which the target device is permitted to download file data from the access management device, and updating the time indicated by the cloud-side time information to the time during which the target device will next be permitted to download file data from the access management device; 2 . The access management device according to claim 1 , wherein the target device is not permitted to download file data from the access management device from the end time of the downloadable time to the start time of the next permitted time for downloading the file data.

3. An access management device as described in Claim 2, wherein each of the time when uploading of the file data will next be permitted and the time when downloading of the file data will next be permitted is a time notified by the target device.

4. An access management device as described in claim 2 or 3, wherein each of the time when uploading of the file data will next be permitted and the time when downloading of the file data will next be permitted is a time randomly determined within a target time range.

5. The gate control unit includes: updating the authentication information indicated by the cloud-side authentication information to first updated authentication information during the upload possible time, and notifying the target device of the first updated authentication information; permitting the target device to upload file data to the access management device based on the first updated authentication information at a time when the file data upload is next permitted; During the downloadable time, updating the authentication information indicated by the cloud-side authentication information to second updated authentication information, and notifying the target device of the second updated authentication information; The access management device according to claim 2 or 3, wherein at a time when the download of the file data is next permitted, the target device is permitted to download the file data from the access management device based on the second updated authentication information.

6. The access management device according to claim 1 , wherein the access management device is a device constituting a cloud system.

7. A storage unit for storing user-side time information and user-side authentication information. A communication device comprising: the user-side time information indicates an upload-allowed time, which is a time during which an access management device that executes communication of file data with the communication device is permitted to upload file data to the access management device, the user-side authentication information is authentication information corresponding to cloud-side authentication information which is authentication information for authenticating communication between the access management device and the communication device, The communication device further comprises: an upload unit that requests permission to upload file data to the access management device using the user-side authentication information during the upload allowed time, uploads the file data to the access management device when uploading of the file data to the access management device is permitted, determines a next upload time that is the time when the file data will next be uploaded to the access management device as a post-update target time that is the time when communication of the file data by the communication device to the access management device will next be permitted, updates the time indicated by the user-side time information from the upload allowed time to the determined next upload time, and notifies the access management device of the determined next upload time. A communication device comprising:

8. The user-side time information indicates a downloadable time, which is a time during which the access management device is permitted to download file data from the access management device by the communication device, The communication device further comprises: a download unit that uses the user-side authentication information during the downloadable time to request permission to download file data from the access management device, and when downloading of the file data from the access management device is permitted, downloads the file data from the access management device, determines a next download time that is the time when the file data will next be downloaded from the access management device as an updated target time that is the time when communication of the file data by the communication device to the access management device will next be permitted, updates the time indicated by the user-side time information to the determined next download time from the downloadable time, and notifies the access management device of the determined next download time. The communication device according to claim 7 , comprising:

9. The upload unit is during the upload possible time, when updated authentication information generated by updating the cloud-side authentication information is notified from the access management device, the user-side authentication information is updated to first updated authentication information based on the updated authentication information; requesting permission to upload file data to the access management device using the first updated authentication information at the next upload time; The download unit is when the updated authentication information is notified from the access management device during the downloadable time, the user-side authentication information is updated to second updated authentication information based on the updated authentication information; The communication device according to claim 8 , wherein at the next download time, the communication device requests permission to download file data from the access management device using the second updated authentication information.

10. The access management device according to claim 2 or 3. An access control system comprising: The target device is a communication device according to claim 8 or 9. An access control system comprising:

11. An access management method executed by an access management device which is a computer that executes file data communication with a target device and stores cloud-side time information indicating a time during which the target device is permitted to communicate the file data, and cloud-side authentication information which is authentication information corresponding to the target device, comprising: The access management device includes: permitting the target device to upload file data to the access management device based on the cloud-side authentication information at an upload allowed time, which is a time indicated by the cloud-side time information and is a time during which the target device is permitted to upload file data to the access management device, and updating the time indicated by the cloud-side time information to the time during which the target device will next be permitted to upload file data to the access management device; The access management method does not permit the target device to upload file data to the access management device from the end time of the upload-enabled time to the start time of the next time uploading of the file data is permitted.

12. An access management program executed by an access management device which is a computer that executes file data communication with a target device and stores cloud-side time information indicating a time during which the target device is permitted to communicate the file data, and cloud-side authentication information which is authentication information corresponding to the target device, permitting the target device to upload file data to the access management device based on the cloud-side authentication information at an upload allowed time, which is a time indicated by the cloud-side time information and is a time during which the target device is permitted to upload file data to the access management device, and updating the time indicated by the cloud-side time information to the time during which the target device will next be permitted to upload file data to the access management device; A gate control process for not permitting the target device to upload file data to the access management device from the end time of the upload-enabled time to the start time of the time when the file data upload is next permitted. an access management program for causing the access management device to execute the above.

13. A communication method executed by a communication device that is a computer storing user-side time information and user-side authentication information, comprising: the user-side time information indicates an upload-allowed time, which is a time during which an access management device that executes communication of file data with the communication device is permitted to upload file data to the access management device, the user-side authentication information is authentication information corresponding to cloud-side authentication information which is authentication information for authenticating communication between the access management device and the communication device, the communication device uses the user-side authentication information to request permission to upload file data to the access management device during the upload possible time, and if uploading of the file data to the access management device is permitted, uploads the file data to the access management device, determines a next upload time, which is the time when the file data will next be uploaded to the access management device, as a post-update target time, which is the time when the communication device will next be permitted to communicate file data to the access management device, updates the time indicated by the user-side time information to the next upload time determined from the upload possible time, and notifies the access management device of the determined next upload time.

14. A communication program executed by a communication device that is a computer storing user-side time information and user-side authentication information, the user-side time information indicates an upload-allowed time, which is a time during which an access management device that executes communication of file data with the communication device is permitted to upload file data to the access management device, the user-side authentication information is authentication information corresponding to cloud-side authentication information which is authentication information for authenticating communication between the access management device and the communication device, an upload process that requests permission to upload file data to the access management device using the user-side authentication information during the upload allowed time, uploads the file data to the access management device when uploading of the file data to the access management device is permitted, determines a next upload time that is the time when the file data will next be uploaded to the access management device as an updated target time that is the time when communication of the file data by the communication device to the access management device will next be permitted, updates the time indicated by the user-side time information to the determined next upload time from the upload allowed time, and notifies the access management device of the determined next upload time. A communication program that causes the communication device to execute the above.

Images