IoT platform and co-existence information providing device

Abstract

To enable the operation of a part of an IoT device by giving limited authority to a user allowed to directly touch the IoT device.SOLUTION: An IoT platform comprises a user authenticating section that authenticates a user based on account information, an on-site determining section that authenticates a user based on co-existence information, and an approval determining section that controls an access to an IoT device of a user depending upon whether it is the user authenticated by the user authenticating section or the user authenticated by the on-site determining section.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to an IoT platform and a coexisting information providing device. [Background technology]

[0002] In an IoT platform that manages IoT (Internet of Things) devices, an account authenticated by user authentication is matched with an IoT device, and if the IoT device determines that the user can operate it, the IoT device can be configured.

[0003] For example, Patent Document 1 describes a method for reducing the burden on users when registering devices within the same network, but does not make it easy to set the authority of users who handle the devices. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2021-140266 A Summary of the Invention [Problem to be solved by the invention]

[0005] Many IoT devices do not have inputs and outputs that can be operated by users, and such devices are configured via an IoT platform. In such cases, even if the camera's angle of view changes unintentionally due to an earthquake, a collision with luggage, etc., and settings need to be changed accordingly, the settings cannot be changed if the user near the camera does not have the authority to do so. Even if a user is near the camera, it is a waste of time and money to be unable to change the settings without asking an authorized user.

[0006] The objective of the present disclosure is to enable partial operation of an IoT device by granting limited authority to users who have direct access to the IoT device. [Means for solving the problem]

[0007] An IoT platform in one embodiment of the present disclosure has a user authentication unit that authenticates a user based on account information, a local judgment unit that authenticates a user based on coexistence information, and an authorization judgment unit that controls a user's access to an IoT device depending on whether the user is authenticated by the user authentication unit or the local judgment unit.

[0008] A coexistence information providing device in one embodiment of the present disclosure is installed at the same installation site as an IoT device, and has a coexistence information input / output unit that inputs and outputs coexistence information with a user, and a communication unit that transmits the coexistence information to a local determination unit that authenticates the user.

[0009] In addition, these comprehensive or specific aspects may be realized by a system, an apparatus, a method, an integrated circuit, a computer program, or a recording medium, or may be realized by any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0010] According to the present disclosure, by having the local judgment unit authenticate the user, even if the user authenticated by the local judgment unit does not have proper authority, it is possible to allow the user to operate some of the IoT devices by granting limited authority to the IoT devices at the installation site where the coexistence information providing device is installed. [Brief description of the drawings]

[0011] [Figure 1] Diagram showing the overall layout [Diagram 2] System functional block diagram [Figure 3A]A diagram showing an example of account information registered in the account database [Figure 3B] Figure showing another example of account information registered in the account DB [Figure 3C] A diagram showing yet another example of account information registered in the account DB. [Figure 4A] An example of device information registered in the device DB [Figure 4B] FIG. 13 is a diagram showing another example of device information registered in the device DB. [Diagram 5] Diagram showing the hardware configuration of the IoT platform [Figure 6] Hardware configuration of coexisting information devices [Figure 7] FIG. 13 is a flowchart showing the process performed by the processing unit when an access request is made to the IoT platform. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings as appropriate.

[0013] <System configuration> FIG. 1 shows the overall layout.

[0014] A management terminal 110 is connected to an IoT device installed at installation site 1 and an IoT device installed at installation site 2 via a network 140. In FIG. 1, a camera is shown as an example of an IoT device, but IoT devices other than a camera may be installed. The number of devices at each installation site does not have to be two, and the number of devices may differ depending on the installation site. The number of installation sites does not have to be two. The IoT devices at each installation site are connected to the management terminal via a network.

[0015] <System Functional Configuration> Fig. 2 is a diagram showing functional blocks of the system. Fig. 2 shows an example in which a user 240 without proper authority visits the installation site 2. Fig. 2 shows a functional configuration that enables the user 240 to configure the IoT device 131 installed at the installation site 2, for example. After it is verified that the user 240 is present in the same location as the IoT device 131, the user 240 accesses the IoT device 131 via the IoT platform and configures the IoT device 131.

[0016] The system includes a management terminal 110, an IoT platform 210, IoT devices 121-123 installed at an installation site 1, IoT devices 131-133 installed at an installation site 2, and a coexistence information providing device 230 installed at the installation site 2. The number of installation sites may be one, or three or more. The number of IoT devices installed at an installation site may be one, or three or more. The number of IoT devices installed at each installation site may differ. The coexistence information providing device 230 may be arranged at all installation sites, or there may be installation sites where the coexistence information providing device 230 is not arranged. The installation sites may be hierarchical.

[0017] The IoT platform 210 is an operating environment that is a base for running services by IoT devices using software and hardware, and includes a user authentication unit 211, a local determination unit 212, an account DB (DataBase) 213, an authorization determination unit 214, a device DB 215, and a device management unit 216. The IoT platform 210 may be configured on a cloud.

[0018] The user authentication unit 211 authenticates the user 220 when the user 220 requested for authentication by the management terminal 110 is registered in the account DB 213. The validity period of authentication may be different for each user, or may be the same. As the management terminal 110, a communication-enabled device such as a PC (Personal Computer), a PDA (Personal Digital Assistant), a tablet terminal, or a smartphone may be used.

[0019] The on-site determination unit 212 authenticates that the user 240 is present at the installation site of the coexistence information providing device 230, based on the coexistence information input by the user 240 using a communication-enabled device such as a smartphone owned by the user 240 and the coexistence information received from the coexistence information providing device. The on-site determination unit 212 may authenticate that the user 240 is present at the installation site of the coexistence information providing device 230 providing the authentication information only when it is received that it is proven that the coexistence information providing device 230 is present at the same installation site as the IoT devices 131 to 133.

[0020] It is desirable that the validity period authenticated by the on-site determination unit 212 is shorter than the validity period authenticated by the user authentication unit 211. Since it is expected that the process performed by the user 240 at the installation site will be completed in a short time, it is possible to reduce the risk of unauthorized access by setting the authentication by the on-site determination unit 212 to a shorter period than the authentication by the user authentication unit 211, which is regular authentication. The authenticated validity period may be presented to the user 240.

[0021] The coexistence information is information for proving that the user 240 is present in the same installation site as the IoT device.

[0022] The account DB 213 registers users and processes of the IoT devices that can be operated by the users for each IoT device. The account DB 213 may register processes that can be operated by each IoT device that can be operated by the users.

[0023] FIG. 3A is a diagram showing an example of account information registered in the account DB 213. As shown in FIG.

[0024] User S001 can process all functions for both the IoT devices at installation site 1 and the IoT devices at installation site 2.

[0025] User A001 can process all functions of the IoT device at installation site 1, but can only process settings of the IoT device at installation site 2.

[0026] User A002 can process all functions of the IoT device at installation site 1, but cannot access the IoT device at installation site 2.

[0027] User B001 can process all functions of the IoT device at installation site 2, but can only process settings of the IoT device at installation site 1.

[0028] User C001 can perform all functions of the IoT devices at both installation site 1 and installation site 2.

[0029] Information on the IoT devices installed at each installation site can be acquired from the device information stored in the device DB 215. For example, according to the device information shown in Fig. 4A, the IoT devices at installation site 1 are IoT devices 121-123, and the IoT devices at installation site 2 are IoT devices 131-133.

[0030] The account information may be registered for each IoT device, not for each installation site. By registering the account information for each IoT device, more detailed access management can be performed.

[0031] FIG. 3B is a diagram showing another example of account information registered in the account DB 213. As shown in FIG.

[0032] The user S001 can perform processing for all the functions of the IoT devices 121-123 and 131-133.

[0033] The user A001 can perform processes related to all the functions of the IoT devices 121-123, but can only perform settings processes related to the IoT devices 131-133.

[0034] The user A002 can perform all functions of the IoT devices 121 and 123, but can only perform settings for the IoT device 122 and cannot access the IoT devices 131 to 133.

[0035] The user B001 can perform processes for all the functions of the IoT devices 131 to 133, and can only perform setting processes for the IoT devices 121 and 123, but cannot access the IoT device 122.

[0036] User C001 can perform all functions of the IoT devices 121, 123, 131, and 133, but cannot access the IoT devices 122 and 132.

[0037] The account information may be registered for each device type at each installation site. By registering the account information for each device type, when there are a large number of IoT devices, it is possible to balance the granularity of access management with the complexity of the information to be registered.

[0038] FIG. 3C is a diagram showing yet another example of account information registered in account DB 213. As shown in FIG.

[0039] User S001 can perform processing for all functions for all IoT devices of types A and B at installation site 1 and all IoT devices of types A and B at installation site 2.

[0040] User A001 can perform all function processing for IoT devices of types A and B at installation site 1, but can only perform setting processing for IoT devices of types A and B at installation site 2.

[0041] User A002 can perform all functions for IoT devices of type A at installation site 1, but can only perform setting processes for IoT devices of type B at installation site 1, and cannot access IoT devices of types A and B at installation site 2.

[0042] User B001 can perform all functions for IoT devices of types A and B at installation site 2, but can only perform setting processes for IoT devices of type A at installation site 1 and cannot access IoT devices of type B at installation site 1.

[0043] User C001 can process all functions of the IoT devices of type A at installation site 1 and the IoT devices of type A at installation site 2, but cannot access the IoT devices of type B at installation site 1 and the IoT devices of type B at installation site 2.

[0044] Information on the IoT devices installed at each installation site can be acquired from the device information stored in the device DB 215. According to the device information, type A at installation site 1 is IoT devices 121 and 123, type B at installation site 1 is IoT device 122, type A at installation site 2 is IoT devices 131 and 133, and type B at installation site 2 is IoT device 132.

[0045] The number of users of the account information may be other than 5, and the number of IoT devices may be other than 6. The functions that can process the account information do not have to be limited to three types: "all functions," "settings," and "not allowed."

[0046] The authorization decision unit 214 refers to the device DB 215 and the account DB 213, and authorizes the user to communicate with the agent of the IoT device via the device management unit 216 for the IoT device that is determined to be operable by the user.

[0047] The authorization decision unit 214 may grant unrestricted access to the user 220 authenticated by the user authentication unit 211. For example, the authorization decision unit 214 may grant the user 220 authenticated by the user authentication unit 211 the right to perform all operations related to all IoT devices, or may grant authorization that limits the IoT devices that can be operated and the processes that can be performed on the IoT devices depending on the user 220.

[0048] The authorization determination unit 214 grants limited access to the user authenticated by the local determination unit 212. The authorization determination unit 214 may grant the user 240 authenticated by the local determination unit 212 permission to make settings such as adjustments to IoT devices at the installation site where the user 240 is present. The authorization determination unit 214 may grant the user 240 permission to access IoT devices with which the coexistence information providing device 230 has directly communicated. The authorization determination unit 214 may grant the user 240 permission to access IoT devices at the installation site where the user 240 is present and that require settings.

[0049] For example, if the IoT device 131 at the installation site 2 is a camera and the angle of view of the camera has changed and the settings of the camera need to be adjusted, a user 240 present at the location of the IoT device 131 at the installation site 2 may be granted access to the settings of the camera angle of view.

[0050] The device DB 215 stores device information in which IoT devices are hierarchically registered according to the installation site, organization, IoT device type, and the like.

[0051] Fig. 4A is a diagram showing an example of device information registered in the device DB. The device information includes coexistence information providing devices present at each installation site. Fig. 4A shows the device information in which the device type of each IoT device is registered, but the device type does not need to be registered if it is not necessary.

[0052] As long as the IoT devices installed at each installation site can be recognized, the management format is arbitrary. Fig. 4B is a diagram showing another example of device information registered in the device DB. By making it possible to extract the IoT devices installed at each installation site based on the device information, it is possible to recognize the IoT devices installed at each installation site.

[0053] The device management unit 216 communicates with the IoT devices. The device management unit 216 restricts the IoT devices that the user can connect to based on the IoT devices that the user 220 who has the proper authority and is authenticated by the user authentication unit 211 can operate and the installation site where the user 240 authenticated by the site determination unit 212 is present.

[0054] At the installation site 1, IoT devices 121 to 123 exist, and at the installation site 2, IoT devices 131 to 133 and a coexistence information providing device 230 exist.

[0055] Each of the IoT devices 121 to 123, 131 to 133 has an agent, an IoT coordination, and an IoT management.

[0056] The agent calls IoT coordination or IoT management and coordinates the IoT device or manages the IoT device based on the information received from the IoT platform 210, particularly based on whether the user is a user with proper authority authenticated by the user authentication unit 211 or a user authenticated by the local determination unit 212. The agent may transfer access to an IoT coordination unit that coordinates the IoT device or an IoT management unit that manages the IoT device.

[0057] IoT Coordination adjusts IoT devices, such as setting them up, and can perform some of the IoT management processes.

[0058] The IoT management is management related to the IoT device, that is, operations such as outputting, deleting, changing information of the IoT device, etc. The IoT management may be all management related to the IoT device.

[0059] The coexistence information providing device 230 is placed at the installation site. The coexistence information providing device 230 provides the user 240 with coexistence information that cannot be known unless the user is at the installation site. The coexistence information providing device 230 transmits the coexistence information to the site determination unit 212. The coexistence information providing device 230 may be proven to be present at the same installation site as an IoT device that is managed in a device DB as being present at the same installation site by directly communicating with the IoT device by Bluetooth, RFID (Radio Frequency Identification), or the like. The coexistence information providing device 230 may operate when it is proven that it is present at the same installation site, and may stop operating when it is not proven. It may be proven that it is present at the same installation site to the site determination unit 212.

[0060] <Hardware configuration> FIG. 5 is a diagram showing a hardware configuration of the IoT platform 210. As shown in FIG.

[0061] The IoT platform includes a communication unit 510, a storage unit 520, and a processing unit 530.

[0062] The communication unit 510 communicates with the management terminal 110, the IoT devices 121 to 123 and 131 to 133, and the coexistence information providing device 230, as well as with communication-enabled devices owned by the users 220 and 240.

[0063] The storage unit 520 stores account information and device information.

[0064] The processing unit 530 authenticates a user who has proper authority based on the account information, and authenticates that the user is present at the installation site of the coexistence information providing device 230 based on the coexistence information. A method for authenticating that the user is present at the installation site of the coexistence information providing device 230 will be described later. Furthermore, the processing unit 530 determines what processing is to be authorized for which IoT device based on whether the user is an authenticated user or not, and controls access to the IoT device.

[0065] FIG. 6 is a diagram showing the hardware configuration of the coexistence information providing device 230. As shown in FIG.

[0066] The coexistence information providing device 230 may include a communication unit 610, a direct communication unit 620, and a control unit 650. It may also include a display unit 630 and an input unit 640 as necessary.

[0067] The communication unit 610 communicates with the local determination unit 212 of the IoT platform 210 and transmits coexistence information to the local determination unit 212. The communication unit 610 can also receive coexistence information from the local determination unit 212. For communication, any communication means such as a LAN, a mobile phone network, or the Internet can be used.

[0068] The direct communication unit 620 directly communicates with the IoT device by communication only within a limited area, such as Bluetooth, NFC (Near Field Communications), RFID, etc. By directly communicating with the IoT device, the direct communication unit 620 can prove that the coexistence information providing device 230 is installed in the same installation site as the IoT device with which it has directly communicated.

[0069] Furthermore, the direct communication unit 620 may authenticate that the user 240 is present in the same location as the coexistence information providing device 230 by directly communicating with a communication-enabled device owned by the user 240 .

[0070] The display unit 630 may present the coexistence information to the user 240. The display unit 630 may present the coexistence information to the user 240 by the user 240 performing an action such as pressing a button (not shown) on the coexistence information providing device. The user 240 transmits the coexistence information presented to the user 240 by the display unit 630 to the local determination unit 212 via a communication-enabled device held by the user 240, thereby authenticating that the user 240 is present in the same location as the coexistence information providing device 230.

[0071] Coexistence information is input by a user to the input unit 640. By transmitting the coexistence information input by the user to the local determination unit 212 via the communication unit 610, it is possible to authenticate that the user 240 is present in the same place as the coexistence information providing device 230.

[0072] The control unit 650 is connected to the communication unit 610, the direct communication unit 620, the display unit 630, and the input unit 640, and controls the entire coexistence information providing device.

[0073] <User authentication> Authentication of a user 220 who has proper authority is performed by a user authentication unit 211. The contents of the authentication, such as what processing of which IoT device the user 220 who has proper authority can perform, may be determined by the user authentication unit 211 and notified to the authorization decision unit 214, or may be determined by the authorization decision unit 214.

[0074] <Certification by local decision-making department> The user transmits the coexistence information output by the coexistence information providing device 230 to the on-site determination unit 212. The on-site determination unit 212 compares the coexistence information received from the coexistence information providing device 230 with the coexistence information received from the user, and can authenticate that the user is present at the installation site.

[0075] The coexistence information is information that cannot be known unless the coexistence information providing device is present at the installation site, and is, for example, information that the coexistence information providing device 230 displays on a screen. The coexistence information providing device 230 may, for example, change the coexistence information displayed on the screen periodically or as needed. When the coexistence information providing device 230 changes the coexistence information, it may transmit the changed coexistence information to the local determination unit 212.

[0076] When receiving the coexistence information from the user, the on-site determination unit 212 may request transmission of coexistence information from the coexistence information providing device 230. The on-site determination unit 212 can compare the coexistence information transmitted in response to the request by the coexistence information providing device 230 with the coexistence information received from the user, and authenticate that the user is present at the installation site.

[0077] When the local determination unit 212 receives the coexistence information from the user, the local determination unit 212 may transmit the coexistence information received from the user to the coexistence information providing device 230. The coexistence information providing device 230 may compare the coexistence information received from the local determination unit 212 with the coexistence information received from the user to authenticate that the user is present at the installation site. The coexistence information providing device 230 may transmit the authentication to the local determination unit. The local determination unit 212 can authenticate that the user is present at the installation site based on the authentication by the coexistence information providing device 230.

[0078] The local determination unit 212 may authenticate that the user is present at the installation site based on a hash of the coexistence information, rather than the coexistence information itself. For example, the coexistence information providing device 230 transmits the hash of the coexistence information to the local determination unit 212, and the local determination unit 212 calculates the hash of the coexistence information received from the user, and compares the hash of the coexistence information received from the coexistence information providing device 230 with the calculated hash, thereby authenticating that the user is present at the installation site.

[0079] The user may input coexistence information to the coexistence information providing device 230, and the coexistence information providing device 230 may transmit the coexistence information input by the user to the on-site determination unit 212. The on-site determination unit 212 may compare the coexistence information input by the user with the coexistence information input from the coexistence information providing device 230, and authenticate that the user is present at the installation site.

[0080] As the coexistence information input by the user, information held by the user, such as an employee ID card or an entrance pass, can be used. The coexistence information providing device 230 may communicate the information of the employee ID card, etc. obtained by NFC to the on-site determination unit 212. The on-site determination unit 212 can compare the information of the employee ID card, etc. received from the user with the information of the employee ID card, etc. received from the coexistence information providing device 230, and authenticate that the user holding the employee ID card, etc., is present at the installation site.

[0081] The coexistence information providing device 230 can communicate with unique information held by a user such as an employee ID card via NFC, and authenticate that the user holding the employee ID card or the like is present at the installation site. The coexistence information providing device 230 may communicate to the local determination unit 212 the authentication that the user holding the employee ID card or the like is present at the installation site. In this case, the local determination unit 212 does not need to receive information from the user. The local determination unit 212 can authenticate that the user is present at the installation site based on the authentication by the coexistence information providing device 230.

[0082] The local determination unit 212 may transmit coexistence information to the coexistence information providing device 230, and the coexistence information providing device 230 may provide the user with the coexistence information received from the local determination unit 212. The local determination unit 212 may compare the coexistence information transmitted to the coexistence information providing device 230 with the coexistence information received from the user, and authenticate that the user is present at the installation site.

[0083] The on-site determination unit 212 authenticates the user when it receives from the coexistence information providing device 230 that the coexistence information providing device 230 is proven to exist in the same installation site as the IoT device, and does not have to authenticate the user when it does not receive the authentication. The coexistence information providing device 230 and the IoT devices 131 to 133 can prove that the coexistence information providing device exists in the same installation site as the IoT device by directly communicating with the IoT device through communication only within a limited area such as Bluetooth or RFID. The coexistence information providing device 230 may prove that the coexistence information providing device exists in the same installation site as the IoT device by receiving a beacon transmitted by the IoT devices 131 to 133.

[0084] After proving that the user 240 is present at the same installation site as the IoT device, the user 240 accesses the IoT platform to configure the IoT device and configures the IoT device. After the user 240 accesses the IoT platform to configure the IoT device, the user 240 may provide proof that he or she is present at the same installation site as the IoT device in response to a request from the IoT platform.

[0085] <Flowchart> FIG. 7 is a flowchart showing the process performed by the processing unit 530 when an access request is made to the IoT platform 210. As shown in FIG.

[0086] It is determined whether the accessing user is a user authenticated by the user authentication unit 211 (step S701).

[0087] If the accessing user is a user authenticated by the user authentication unit 211, the access of the accessing user is authorized. This access authorization is not limited.

[0088] If the accessed user is a user who has not been authenticated by the user authentication unit 211, the local determination unit 212 determines whether or not the user has been authenticated (step S702).

[0089] If the accessing user is a user authenticated by the local determination unit 212, limited access is permitted to the accessing user.

[0090] If the accessing user is not authenticated by the local determination unit 212, the access is not permitted to the accessing user.

[0091] <Risks and Benefits> If a user at the installation site is a malicious user intending to shut down or disable the system, the malicious user has already entered the installation site, so there is a high possibility that he or she will physically destroy the sensor, and the risk of changing the settings of the IoT device is not great.

[0092] On the other hand, if the user at the installation site is a malicious user who intends to extract or delete data from within the system, allowing such a user to intrude into the system poses an extremely high risk.

[0093] In other words, the risk of allowing limited access to authorize the configuration of an IoT device based on the coexistence information provided by the coexistence information providing device 230 is not large even if a malicious user infiltrates the installation site.

[0094] On the other hand, if the user at the installation site is a bona fide user, authorizing the bona fide user to configure the IoT device can be very effective.

[0095] Therefore, it is effective to leave the processing of the user authentication unit unchanged, but provide a local determination unit 212 separate from the user authentication unit 211, and grant limited authority to users who directly touch the IoT device through authentication by the local determination unit 212, thereby enabling them to operate some of the IoT device.

[0096] (1) An IoT platform in one embodiment of the present disclosure has a user authentication unit that authenticates a user based on account information, a local judgment unit that authenticates a user based on coexistence information, and an authorization judgment unit that controls access to a user's IoT device depending on whether the user is authenticated by the user authentication unit or the local judgment unit.

[0097] (2) In one embodiment of the present disclosure, in the IoT platform of (1), it is determined whether the access control for the IoT device is unrestricted access authorization or restricted access authorization.

[0098] (3) In one embodiment of the present disclosure, in the IoT platform of (2), the non-restrictive access authorization is authorization for access to system management of IoT devices, and the limited access authorization is authorization for access to coordination of IoT devices in the same installation site as the device providing coexistence information.

[0099] (4) In one embodiment of the present disclosure, an IoT platform is the IoT platform of (1), wherein the validity period of authentication by the local determination unit is shorter than the validity period of authentication by the user authentication unit.

[0100] (5) An IoT platform according to one embodiment of the present disclosure is the IoT platform of (1), wherein the IoT platform is configured on a cloud.

[0101] (6) In one embodiment of the present disclosure, in the IoT platform of (1), access to the IoT devices is limited to the IoT devices that can be operated and the processes that can be operated on the IoT devices based on the account information of the authenticated user.

[0102] (7) A coexistence information providing device in one embodiment of the present disclosure is installed at the same installation site as an IoT device, and has a coexistence information input / output unit that inputs and outputs coexistence information with a user, and a communication unit that transmits the coexistence information to a local determination unit that authenticates the user.

[0103] (8) According to an embodiment of the present disclosure, the coexistence information providing device of (7) further includes a direct communication unit that directly communicates with the IoT device installed at the same installation site. [Industrial Applicability]

[0104] The present disclosure is useful for an IoT platform that manages IoT devices. [Explanation of symbols]

[0105] 110 Management terminal 120 Installation site 1 121, 122, 123, 131, 132, 133 IoT devices 130 Installation site 2 140 Network 210 IoT Platform 211 User authentication section 212 Local Judgment Department 213 Account DB 214 Authorization Judgment Department 215 Equipment DB 216 Equipment Management Department 220 Authorized Users 230 Coexistence Information Providing Device 240 Unauthorized User 510, 610 Communications Department 520 Storage section 530 Processing section 620 Direct Communication Department 630 Display section 640 Input section 650 Control Unit

Claims

1. a user authentication unit that authenticates a user based on account information; a local determination unit that performs user authentication based on the coexistence information; an authorization determination unit that controls access to an IoT device of a user depending on whether the user is authenticated by the user authentication unit or the on-site determination unit; An IoT platform with the above features.

2. determining whether the control of access to the IoT device is open access or limited access; The IoT platform of claim 1 .

3. The non-restrictive access authorization is authorization for access to system management of the IoT device; The limited access authorization is an authorization for access to coordination of IoT devices in the same installation site as the device providing the coexistence information. The IoT platform of claim 2.

4. A validity period of the authentication by the on-site determination unit is shorter than a validity period of the authentication by the user authentication unit. The IoT platform of claim 1 .

5. The IoT platform is configured on the cloud. The IoT platform of claim 1 .

6. Access to the IoT device is limited to the IoT devices that can be operated and the processes that can be operated on the IoT devices according to the account information of the authenticated user. The IoT platform of claim 1 .

7. It will be installed at the same installation site as the IoT device, a coexistence information input / output unit for inputting and outputting coexistence information with a user; a communication unit that transmits the coexistence information to a local determination unit that performs user authentication; A coexisting information providing device having the same.

8. Further comprising a direct communication unit that directly communicates with the IoT device installed at the same installation site; The coexistence information providing device according to claim 7 .

Images