COMMUNICATION DEVICE, DEVICE, COMMUNICATION SYSTEM, AUTHENTICATION METHOD, AND PROGRAM

Abstract

To prevent unauthorized apparatuses from connecting to a network.SOLUTION: A communication device connectable to an apparatus includes: an apparatus information acquisition unit that acquires apparatus-specific information from the apparatus connected to the communication device; an authentication control unit that generates an authentication key from authentication information held by the communication device and from the apparatus-specific information; and a communication control unit that transmits the authentication key to authentication means that performs authentication processing for the communication device and the apparatus using the authentication key.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for turning non-IoT (Internet of Things) devices into IoT devices. [Background technology]

[0002] With the recent spread of IoT, there are many services that use devices that have been commercialized as IoT devices from the beginning. IoT devices are devices that can connect to a network and exchange information with the outside world.

[0003] On the other hand, there are many non-IoT devices, such as machine tools, that have been in use since before the spread of IoT and are still in use today.

[0004] In order to turn such non-IoT devices into IoT devices, there are cases where data collection, etc. is achieved by connecting external devices with network functions such as mobile networks and wireless LAN to the non-IoT devices.

[0005] Among external devices with network functions, some have a SIM (Subscriber Identity Module) built in, making it possible to build a more secure network. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2016-201032 A Summary of the Invention [Problem to be solved by the invention]

[0007] An external device with a built-in SIM is capable of authentication and communication by itself. Therefore, simply connecting a non-IoT device to an external SIM device can turn that device into an IoT device, and the device and its data can be managed from a server or cloud.

[0008] On the other hand, because external devices such as SIM-equipped external devices can be plugged in and removed, there is a risk that the external device may be connected to a malicious device. In other words, if authentication for connecting an external device to a server or cloud is performed only by the SIM, there is a possibility that a malicious device may illegally obtain data from the server or cloud. Note that this issue is not limited to when using an external device, but can occur in all devices that use authentication information such as SIM information for authentication.

[0009] The present invention has been made in consideration of the above-mentioned points, and has an object to provide a technique for preventing unauthorized devices from connecting to a network. [Means for solving the problem]

[0010] According to the disclosed technology, there is provided a communication device connectable to a device, a device information acquisition unit that acquires device specific information from the device to which the communication device is connected; an authentication control unit that generates an authentication key from authentication information held by the communication device and the device specific information; a communication control unit that transmits the authentication key to an authentication unit that performs an authentication process for the communication device and the equipment using the authentication key; The authentication information is SIM information obtained from a SIM provided in the communication device, and the authentication control unit is provided as an applet on the SIM. A communications device is provided. Effect of the Invention

[0011] According to the disclosed technology, unauthorized devices can be prevented from connecting to a network. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram of a communication system in an embodiment 1-1. [Diagram 2] FIG. 1 is a sequence diagram in Example 1-1. [Diagram 3] FIG. 1 is a configuration diagram of a communication system in an embodiment 1-2. [Figure 4] FIG. 11 is a sequence diagram in Example 1-2. [Diagram 5] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-3. [Figure 6] FIG. 11 is a sequence diagram in accordance with an embodiment 1-3. [Figure 7] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-4. [Figure 8] FIG. 11 is a sequence diagram in accordance with an embodiment 1-4. [Figure 9] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-5. [Figure 10] FIG. 11 is a sequence diagram in accordance with an embodiment 1-5. [Figure 11] FIG. 1 is a configuration diagram of a communication system in Examples 1-6. [Figure 12] FIG. 11 is a sequence diagram in accordance with an embodiment 1-6. [Figure 13] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-7. [Figure 14] FIG. 11 is a sequence diagram in accordance with an embodiment 1-7. [Figure 15] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-8. [Figure 16] FIG. 11 is a sequence diagram in accordance with an embodiment 1-8. [Figure 17] FIG. 1 is a configuration diagram of a communication system in accordance with an embodiment 1-9. [Figure 18] FIG. 11 is a sequence diagram in accordance with an embodiment 1-9. [Figure 19] FIG. 13 is a configuration diagram of a communication system in accordance with an embodiment 1-10. [Figure 20] FIG. 11 is a sequence diagram in accordance with an embodiment 1-10. [Figure 21]FIG. 11 is a configuration diagram of a communication system in an embodiment 1-11. [Figure 22] FIG. 11 is a sequence diagram in accordance with an embodiment 1-11. [Figure 23] FIG. 11 is a configuration diagram of a communication system in an embodiment 1-12. [Figure 24] FIG. 11 is a sequence diagram in accordance with an embodiment 1-12. [Diagram 25] FIG. 2 is a configuration diagram of a communication system in Example 2-1. [Figure 26] FIG. 11 is a sequence diagram in Example 2-1. [Figure 27] FIG. 2 is a configuration diagram of a communication system in Example 2-2. [Figure 28] FIG. 11 is a sequence diagram in Example 2-2. [Figure 29] FIG. 11 is a configuration diagram of a communication system in Example 2-3. [Diagram 30] FIG. 11 is a sequence diagram in Example 2-3. [Diagram 31] FIG. 11 is a configuration diagram of a communication system in Example 2-4. [Diagram 32] FIG. 11 is a sequence diagram in Example 2-4. [Diagram 33] FIG. 11 is a configuration diagram of a communication system in Example 2-5. [Diagram 34] FIG. 11 is a sequence diagram in Example 2-5. [Diagram 35] FIG. 11 is a configuration diagram of a communication system in Example 2-6. [Diagram 36] FIG. 11 is a sequence diagram in Example 2-6. [Figure 37] FIG. 11 is a configuration diagram of a communication system in Example 2-7. [Figure 38] FIG. 11 is a sequence diagram in Example 2-7. [Figure 39] FIG. 11 is a configuration diagram of a communication system in Example 2-8. [Diagram 40] FIG. 11 is a sequence diagram in Example 2-8. [Diagram 41] FIG. 2 is a diagram illustrating a hardware configuration of the device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0014] In the embodiment described below, an authentication method using SIM information is used as an authentication method other than the authentication using device-specific information, but this is just one example. As an authentication method other than the authentication using device-specific information, authentication using authentication information other than SIM information may be performed.

[0015] (Outline of the embodiment) In this embodiment, for example, a communication device such as an external device with a SIM card is connected to a device, thereby making the device IoT-enabled, i.e., providing the device with a network connection function.

[0016] As network-side authentication of a device to which the above-mentioned communication device is connected, in addition to SIM authentication using the SIM installed in the communication device, device authentication is also performed using information on the device to which the communication device is connected.

[0017] The information used for device authentication may be any information unique to the device. In this embodiment, the "device unique ID", "hash value of device software", and "device unique behavior" are used as examples.

[0018] As described above, in this embodiment, an authentication method of SIM authentication + device authentication is used, so that it is possible to prevent unauthorized acquisition of data, etc., caused by connecting a communication device such as an external device with a SIM card to a malicious device.

[0019] In this embodiment, the information used for device authentication, namely, "device unique ID", "hash value of device software", and "device unique behavior", may be any one of them, any two of them, or all three of them. These are collectively called device unique information.

[0020] For example, one type of device authentication may be used, such as SIM authentication+device unique ID, or two types of device authentication may be used, such as SIM authentication+device unique ID+hash value of device software.

[0021] In addition, "SIM authentication + device authentication" is performed by a program, which may be installed in the SIM as a SIM applet, or may be installed in a communication device (other than the SIM) that is an external device, or may be installed in the device itself.

[0022] A more specific system configuration and an operation example will be described below using an embodiment. In the embodiment, it is assumed that information on a non-IoT device is uploaded to a server or cloud, and security incidents are prevented by performing the above-mentioned SIM authentication + device authentication function in the authentication step before that. If the authentication fails, for example, measures can be taken such as not connecting the device to the network.

[0023] In the IoT system, the system configuration is often divided into the devices that hold device data (non-IoT devices as above) and the devices that collect device data, so two patterns of authentication are explained here: one that focuses on devices, and one that focuses on device information storage devices. Note that the "device information storage device" is an example of a device, but in the following explanation, the device information storage device and the device are described as separate entities, for example.

[0024] Below, a pattern focused on devices will be explained as Example 1, and a pattern focused on device information storage devices will be explained as Example 2. Since there are various patterns depending on the configuration in each of Examples 1 and 2, they will be explained as Example 1-1, Example 1-2, ..., etc. Basically, in the later examples, differences from the contents explained in the previous examples will be explained.

[0025] (Example 1: Equipment-focused pattern) Example 1 is divided into Examples 1-1 to 1-12. Each of them will be described below. <Example 1-1: With communication device, with management system, with provisioning> Fig. 1 is a configuration diagram of a communication system in Example 1-1. As shown in Fig. 1, the communication system in Example 1-1 includes a device 100, a communication device 200, a device information storage device 300, a management system 400, an authentication system 500, and a subscriber management device 600. The communication device 200, the device information storage device 300, the management system 400, the authentication system 500, and the subscriber management device 600 are capable of communicating with other devices via a network as shown in the figure.

[0026] The device 100 is a non-IoT device. As an example, a machine tool or the like is used as the device 100.

[0027] The communication device 200 is an external device with a SIM card, and is used by connecting it to the device 100. The communication device 200 may be called a "dongle." The communication device 200 is assumed to be small, but is not limited to small devices, and may be, for example, a PC. As shown in FIG. 1, the communication device 200 has a device information acquisition unit 201, a communication control unit 202, an authentication control unit 203, and an SIM 204. The SIM 204 also has a provisioning control unit 205. The provisioning control unit 205 is a program (applet) for performing provisioning. The processing operations of each unit will be described in the sequence description below.

[0028] The device information storage device 300 is a device that stores information acquired from the device 100. As shown in FIG.

[0029] The management system 400 is a system that manages provisioning information, etc. The authentication system 500 is a system that performs authentication. The subscriber management device 600 is a device that manages the subscriber information of the operator of the SIM 204, and includes a function of performing SIM authentication.

[0030] In this specification, the "device information storage device," "management system," "authentication system," "subscriber management device," "device information storage device + management system + authentication system," "device information storage device + authentication system," and "management system + authentication system" may all be referred to as authentication means. The "device information acquisition unit" may also be referred to as acquisition means. The "authentication control unit" may also be referred to as generation means. The "communication control unit" may also be referred to as transmission means.

[0031] An operation example of the communication system according to the embodiment 1-1 having the above configuration will be described with reference to the sequence of FIG.

[0032] The SIM authentication + device authentication process begins when communication device 200 is connected to device 100 and power supply to communication device 200 begins, or when communication device 200 is turned on and connected to device 100.

[0033] In S101, the device information acquisition unit 201 mounted on the communication device 200 acquires device-specific information of the device 100, and in S103, passes the acquisition result based on a request from the authentication control unit 203. The device-specific information is any one or more of a "device-specific ID," a "hash value of device software," and a "device-specific behavior."

[0034] Note that the "device-specific behavior" may be any information that represents device-specific behavior, and is not limited to specific information. For example, the "device-specific behavior" may be fluctuation information (cycle, magnitude, etc.) of power usage, statistics (average, median, etc.) of values ​​obtained from a sensor connected to the device 100, or other information.

[0035] The authentication control unit 203 is a program installed in the application area of ​​the communication device 200 or on the SIM applet, but in the embodiment 1-1, the authentication control unit 203 is installed in the application area of ​​the communication device 200.

[0036] In S102, the authentication control unit 203 requests SIM information from the SIM 204 and acquires the SIM information. The SIM information is information consisting of an IMSI (International Mobile Subscriber Identity) and an authentication key. The SIM information may also be called authentication information.

[0037] After acquiring the SIM information (IMSI and authentication key), authentication control unit 203 generates an authentication key from the SIM information and device-specific information. Authentication control unit 203 may use the device-specific information and SIM information as the authentication key as they are, or may generate new information from the device-specific information and SIM information and use it as the authentication key. In the following description, it is assumed that the device-specific information and SIM information are used as the authentication key as they are.

[0038] After generating the authentication key, the authentication control unit 203 transmits the authentication key to the communication control unit 202 in S104.

[0039] Upon receiving the authentication key, the communication control unit 202 performs either the following process a or process b, depending on the state of the communication device 200. Specifically, if provisioning is required, the communication control unit 202 performs process a, and if provisioning has already been performed or provisioning is not required, the communication control unit 202 performs process b.

[0040] Process a: The communication control unit 202 transmits a provisioning information request to the device information storage device 300 or the management system 400 .

[0041] Process b: The communication control unit 202 requests the device information storage device 300 for authentication.

[0042] In the embodiment 1-1, the process a is executed. Specifically, in S105, the communication control unit 202 transmits a provisioning information request to the management system 400. The provisioning information request includes the above-mentioned authentication key.

[0043] In S106, the management system 400 that has received the provisioning information request makes an authentication request for the communication device 200 to the authentication system 500 using the authentication key accompanying the provisioning information request.

[0044] The authentication system 500 that has received the authentication request checks the authentication information held within the system and the authentication key accompanying the authentication request to determine whether the authentication has succeeded or failed. If the authentication within the authentication system is successful, in S107, it requests the subscriber management device 600 to authenticate the SIM information. Note that if authentication using the authentication key is successful, authentication using only the SIM information need not be performed.

[0045] In cases where the device specific information has not been registered in the authentication system 500, the authentication system 500 may determine the success / failure of authentication based only on the SIM information in the authentication key received from the management system 400. In this case, the authentication system 500 registers the device specific information received from the management system 400 by linking it to the SIM information in the authentication system.

[0046] Upon receiving the authentication response from the subscriber management device 600, the authentication system 500 transmits the authentication response to the management system 400 in S108.

[0047] If the result of the authentication request to the subscriber management device 600 is a failure, even if the result of the authentication within the authentication system 500 is a success, the authentication is determined to have failed.

[0048] In S109, the management system 400, which has received the authentication response (assuming here that the authentication was successful) from the authentication system 500, transmits a provisioning information response to the communication device 200. The provisioning information response includes, as the provisioning information, information indicating, for example, the upload destination of the information of the device 100. The provisioning information response also includes the result of the authentication response.

[0049] The management system 400 may hold the authentication key received from the communication device 200. Then, in S105, if the authentication key accompanying the provisioning information request received from the communication device 200 is known (if it matches the held authentication key), the management system 400 may send a provisioning information response to the communication device 200 without making an authentication request to the authentication system 500.

[0050] In S110, the communication control unit 202 of the communication device 200 that has received the provisioning information response from the management system 400 passes the provisioning information to the provisioning control unit 205 on the SIM applet, and completes the provisioning.

[0051] After completing provisioning, the communication control unit 202 of the communication device 200 transmits the result of the authentication response to the authentication control unit 203 in S111, and transmits a device information acquisition request to the device information acquisition unit 201 in S112.

[0052] In S113, the device information acquisition unit 201 receives a device information acquisition request from the communication control unit 202 and acquires device information from the device 100 to which the communication device 200 is connected, to be registered in the device information database 303 of the device information storage device 300.

[0053] The device information acquisition unit 201 acquires the device information from the device 100, and transmits the device information to the communication control unit 202 in S114.

[0054] In S115, the communication control unit 202 receives the device information from the device information acquisition unit 201 and transmits a device information registration request to the device information storage device 300. The device information registration request includes the device information and an authentication key.

[0055] In S116, communication control unit 301 of device information storage device 300 that has received a device information registration request from communication device 200 transmits an authentication request to authentication control unit 302 to check whether an authentication key associated with the received device information registration request is already held. Upon receiving the authentication request from communication control unit 301, authentication control unit 302 responds to communication control unit 301 with the result of checking the authentication key.

[0056] If, as a result of the above, the authentication key associated with the device information received from the communication device 200 is not present in the device information storage device 300, in order to determine whether to accept the request from the communication device 200, in S117, the communication control unit 301 makes an authentication request to the authentication system 500 using the authentication key, and receives a response.

[0057] In above S117, the authentication system 500 that has received the authentication request from the device information storage device 300 checks the authentication information held within the system and the authentication key accompanying the authentication request to determine whether the authentication has succeeded or failed.

[0058] As in the above-mentioned case, in authentication within the authentication system 500, the success / failure of authentication may be determined based only on the SIM information in the authentication key received from the device information storage device 300. In this case, the authentication system 500 performs registration by linking the device specific information included in the authentication key received from the device information storage device 300 to the SIM information in the authentication system.

[0059] In step S118, the communication control unit 301 of the device information storage device 300 that has received the authentication response from the authentication system 500 transmits the authentication result to the authentication control unit 302. The authentication control unit 302 registers the authentication key.

[0060] After the authentication confirmation of the authentication key associated with the device information received from the communication device 200 has been completed by the authentication system 500, or after confirmation within the device information storage device 300 has been completed, in S119, the communication control unit 301 makes a device information registration request to the device information database 303 to register the device information received from the communication device 200 in the device information storage device 300.

[0061] In S119 , upon receiving the device information registration request from the communication control unit 301 , the device information database 303 registers the device information and transmits a device information registration response to the communication control unit 301 .

[0062] Upon receiving the device information registration response from the device information database 303, the communication control unit 301 transmits the device information registration response to the communication device 200 in S120.

[0063] <Example 1-2: With communication device, with management system, with provisioning, with Applet> Next, an embodiment 1-2 will be described. Fig. 3 is a configuration diagram of a communication system in the embodiment 1-2. As shown in Fig. 3, in the embodiment 1-2, an authentication control unit 203 of a communication device 200 is provided as a program (applet) on a SIM 204. Except for this point, the communication system in the embodiment 1-2 is the same as the communication system in the embodiment 1-1.

[0064] 4 shows a sequence in the embodiment 1-2. As described above, the only difference from the embodiment 1-1 is that the authentication control unit 203 of the communication device 200 is provided as a program (applet) on the SIM 204. The operation related to the sequence is the same as that of the embodiment 1-1.

[0065] <Example 1-3: With communication device, without management system, with provisioning> Next, an embodiment 1-3 will be described. Fig. 5 is a configuration diagram of a communication system in the embodiment 1-3. As shown in Fig. 5, the embodiment is different from the embodiment 1-1 in that the communication system does not include a management system 400. For ease of understanding, Fig. 5 shows the management system 400 that is not connected to the communication system.

[0066] 6 shows a sequence in the embodiment 1-3. In the embodiment 1-3, the device information storage device 300 executes a process for a provisioning information request. This point differs from the sequence (FIG. 2) in the embodiment 1-1. The process for the provisioning information request will be described below.

[0067] In S305, the communication control unit 202 transmits a provisioning information request to the device information storage device 300. The provisioning information request includes the above-mentioned authentication key.

[0068] In S306 and S307, the device information storage device 300 that has received the provisioning information request uses the authentication key accompanying the provisioning information request to make an authentication request for the communication device 200 to the authentication system 500. The authentication process in the authentication system 500 is the same as the process described in the embodiment 1-1.

[0069] In S309 and S310, the authentication system 500 returns an authentication response (assuming here that the authentication was successful) to the device information storage device 300.

[0070] In S311, the communication control unit 301 of the device information storage device 300 that has received the authentication response from the authentication system 500 requests and acquires provisioning information from the device information database 303. In S312, the communication control unit 301 transmits a provisioning information response to the communication device 200. After that, the device information registration process is executed in the same manner as in Example 1-1.

[0071] <Example 1-4: With communication device, without management system, with provisioning, with applet> Next, an embodiment 1-4 will be described. Fig. 7 is a configuration diagram of a communication system in the embodiment 1-4. As shown in Fig. 7, in the embodiment 1-4, an authentication control unit 203 of a communication device 200 is provided as a program (applet) on a SIM 204. Except for this point, the communication system in the embodiment 1-4 is the same as the communication system in the embodiment 1-3.

[0072] 8 shows a sequence in Example 1-4. As described above, the only difference from Example 1-3 is that the authentication control unit 203 of the communication device 200 is provided as a program (applet) on the SIM 204. The operation related to the sequence is the same as that of Example 1-3.

[0073] <Example 1-5: Communication device present, management system absent, provisioning absent> Next, an embodiment 1-5 will be described. Fig. 9 is a configuration diagram of a communication system in the embodiment 1-5. The configuration of the communication system in the embodiment 1-5 is the same as the configuration of the communication system in the embodiment 1-3 etc. (Fig. 5), in that the management system 400 is not present.

[0074] Fig. 10 shows a sequence in the embodiment 1-5. S501 to S504 in Fig. 10 are the same as S101 to S104 in the embodiment 1-1 (Fig. 2).

[0075] Upon receiving the authentication key, the communication control unit 202 performs either the following process a or process b, depending on the state of the communication device 200. Specifically, if provisioning is required, the communication control unit 202 performs process a, and if provisioning has already been performed or provisioning is not required, the communication control unit 202 performs process b.

[0076] Process a: The communication control unit 202 transmits a provisioning information request to the device information storage device 300 or the management system 400 .

[0077] Process b: The communication control unit 202 requests the device information storage device 300 for authentication.

[0078] In the embodiment 1-5, the process b is executed. That is, in S505, the communication control unit 202 transmits an authentication request to the device information storage device 300. The authentication request includes an authentication key. The device information storage device 300 transmits the authentication request to the authentication system using the authentication key. The authentication process contents in the authentication system 500 are the same as those in the embodiment 1-1.

[0079] In S509 and S510, the authentication system 500 returns an authentication response (assuming here that the authentication has been successful) to the device information storage device 300.

[0080] Upon receiving the authentication response from the authentication system 500, the communication control unit 301 of the device information storage device 300 transmits the authentication response to the communication device in S511.

[0081] If an authentication key is held in the device information storage device 300 and the authentication key accompanying the authentication request received from the communication device 200 is known, an authentication response may be sent from the device information storage device 300 to the communication device 200 without sending an authentication request to the authentication system 500. Thereafter, the device information registration process is performed in the same manner as in Example 1-1 and the like.

[0082] <Example 1-6: With communication device, without management system, without provisioning, with applet> Next, an example 1-6 will be described. Fig. 11 is a configuration diagram of a communication system in the example 1-6. As shown in Fig. 11, in the example 1-6, an authentication control unit 203 of a communication device 200 is provided as a program (applet) on a SIM 204. Except for this point, the communication system in the example 1-6 is the same as the communication system in the example 1-5.

[0083] 12 shows a sequence in the embodiment 1-6. As described above, the only difference from the embodiment 1-5 is that the authentication control unit 203 of the communication device 200 is provided as a program (applet) on the SIM 204. The operation related to the sequence is the same as that of the embodiment 1-5.

[0084] <Example 1-7: Equipment installation, management system, provisioning> Next, an embodiment 1-7 will be described. Fig. 13 is a configuration diagram of a communication system in the embodiment 1-7. As can be seen by comparing Fig. 13 with Fig. 1 (embodiment 1-1), in embodiment 1-7, the communication device 200, which is an external SIM-equipped device, is not used, and instead, the functions of the communication device 200 are provided in the equipment 100. In other words, in embodiment 1-7, the equipment 100 itself is provided with the functions of SIM authentication + equipment authentication.

[0085] 13, the device 100 of the embodiment 1-7 includes a device information acquisition unit 101, a communication control unit 102, an authentication control unit 103, a SIM 104, and a device information recording unit 106. The device information recording unit 106 stores device specific information used for authentication and device information to be registered. The SIM 104 includes a provisioning control unit 105.

[0086] The functions of the device information acquisition unit 101, the communication control unit 102, the authentication control unit 103, and the SIM 104 are the same as those of the device information acquisition unit 201, the communication control unit 202, the authentication control unit 203, and the SIM 204 in the communication device 200. However, in the embodiments 1-7, the device specific information and the device information are acquired from the device information recording unit 106.

[0087] 14 shows a sequence in Example 1-7. In Example 1-7, the process of SIM authentication+device authentication starts when the power of the device 100 is turned on. However, this is just an example, and the process of SIM authentication+device authentication may start at other timing.

[0088] Except for acquiring the device specific information and device information from the device information recording unit 106 in the device 100, the processing operations related to the sequence in the embodiment 1-7 are the same as the processing operations related to the sequence in the embodiment 1-1 (FIG. 2).

[0089] <Example 1-8: Device installation, management system, provisioning, Applet> Next, Example 1-8 will be described. Fig. 15 is a configuration diagram of a communication system in Example 1-8. As shown in Fig. 15, in Example 1-8, an authentication control unit 103 of a device 100 is provided as a program (applet) on a SIM 104. Except for this point, the communication system in Example 1-8 is the same as the communication system in Example 1-7.

[0090] 16 shows a sequence in Example 1-8. As described above, the only difference from Example 1-7 is that the authentication control unit 103 of the device 100 is provided as a program (applet) on the SIM 104. The operation related to the sequence is the same as that of Example 1-7.

[0091] <Example 1-9: Equipment installation, no management system, provisioning available> Next, an example 1-9 will be described. Fig. 17 is a configuration diagram of a communication system in the example 1-9. As shown in Fig. 17, the difference from the example 1-7 is that the communication system does not include a management system 400. For ease of understanding, Fig. 17 shows the management system 400 that is not connected to the communication system.

[0092] Fig. 18 shows a sequence in Example 1-9. In Example 1-9, the device information storage device 300 executes a process for a provisioning information request. This point differs from the sequence (Fig. 14) in Example 1-7. The process for a provisioning information request in the device information storage device 300 is as described in Example 1-3 (Fig. 6).

[0093] <Example 1-10: Device installation, no management system, provisioning, Applet> Next, an example 1-10 will be described. Fig. 19 is a configuration diagram of a communication system in the example 1-10. As shown in Fig. 19, in the example 1-10, an authentication control unit 103 of a device 100 is provided as a program (applet) on a SIM 104. Except for this point, the communication system in the example 1-10 is the same as the communication system in the example 1-9.

[0094] 20 shows a sequence in the embodiment 1-10. As described above, the only difference from the embodiment 1-9 is that the authentication control unit 103 of the device 100 is provided as a program (applet) on the SIM 104. The operation related to the sequence is the same as that of the embodiment 1-9.

[0095] <Example 1-11: No equipment installation, no management system, no provisioning> Next, an embodiment 1-11 will be described. Fig. 21 is a configuration diagram of a communication system in the embodiment 1-11. The configuration of the communication system in the embodiment 1-11 is the same as the configuration of the communication system in the embodiment 1-9 etc. (Fig. 17), in that the management system 400 is not present.

[0096] Fig. 22 shows a sequence in the embodiment 1-11. S1101 to S1104 in Fig. 22 are the same as S701 to S704 in the embodiment 1-7 (Fig. 14).

[0097] In the embodiment 1-11, in S1105, the communication control unit 102 transmits an authentication request to the device information storage device 300. The subsequent processing contents are the same as those in the embodiment 1-5.

[0098] <Example 1-12: Device installation, no management system, no provisioning, no applet> Next, an embodiment 1-12 will be described. Fig. 23 is a configuration diagram of a communication system in the embodiment 1-12. As shown in Fig. 23, in the embodiment 1-12, an authentication control unit 103 of a device 100 is provided as a program (applet) on a SIM 104. Except for this point, the communication system in the embodiment 1-12 is the same as the communication system in the embodiment 1-11.

[0099] 24 shows a sequence in Example 1-12. As described above, the only difference from Example 1-11 is that the authentication control unit 103 of the device 100 is provided as a program (applet) on the SIM 104. The operation related to the sequence is the same as that of Example 1-11.

[0100] (Example 2: Pattern focused on device information storage device) Example 2 is divided into Example 2-1 to Example 2-8. Each of them will be explained below. <Example 2-1: With communication device, with management system, with provisioning> Fig. 25 is a configuration diagram of a communication system in Example 2-1. As shown in Fig. 25, the communication system in Example 2-1 includes a communication device 200, an equipment information storage device 300, a management system 400, an authentication system 500, and a subscriber management device 600. The communication device 200, the equipment information storage device 300, the management system 400, the authentication system 500, and the subscriber management device 600 are capable of communicating with other devices via a network as shown in the figure.

[0101] Communication device 200 is an external device with a SIM card, and is used by connecting it to device information storage device 300. Communication device 200 may be called a "dongle." As described above, communication device 200 is not limited to a small device. As shown in FIG. 25, communication device 200 has device information acquisition unit 201, communication control unit 202, authentication control unit 203, and SIM 204. SIM 204 also has provisioning control unit 205. Provisioning control unit 205 is a program (applet) for performing provisioning. The processing operations of each unit will be described in the sequence description below.

[0102] The device information storage device 300 is a device that stores information acquired from devices. However, devices are not shown in Fig. 25. As shown in Fig. 25, the device information storage device 300 has a communication control unit 301, an authentication control unit 302, a device information database 303, and a device information recording unit 304.

[0103] The management system 400 is a system that manages provisioning information, etc. The authentication system 500 is a system that performs authentication. The subscriber management device 600 is a device that manages the subscriber information of the operator of the SIM 104, and includes a function of performing SIM authentication.

[0104] An operation example of the communication system according to the embodiment 2-1 having the above configuration will be described with reference to the sequence of FIG.

[0105] The SIM authentication + device authentication process starts when communication device 200 is connected to device information storage device 300 and power supply to communication device 200 begins, or when communication device 200 is turned on and connected to device information storage device 300.

[0106] In S1301, the device information acquisition unit 201 mounted on the communication device 200 acquires device specific information of the device information storage device 300 from the device information recording unit 304 of the device information storage device 300, and in S1303, passes the acquisition result based on a request from the authentication control unit 203. The device specific information is any one or more of the following: "device specific ID", "hash value of device software", and "device specific behavior".

[0107] Note that the "device-specific behavior" may be any information that represents device-specific behavior, and does not have to be specific information. For example, the "device-specific behavior" may be fluctuation information (cycle, magnitude, etc.) of power usage, statistics (average, median, etc.) of the amount of data registered in the device information storage device 300 for a certain period of time, or other information.

[0108] The authentication control unit 203 is a program installed in the application area of ​​the communication device 200 or on the SIM applet, but in the embodiment 2-1, the authentication control unit 203 is installed in the application area of ​​the communication device 200.

[0109] In S1302, the authentication control unit 203 requests SIM information from the SIM 204 and acquires the SIM information. The SIM information is information consisting of an International Mobile Subscriber Identity (IMSI) and an authentication key.

[0110] After acquiring the SIM information (IMSI and authentication key), authentication control unit 203 generates an authentication key from the SIM information and device specific information. Authentication control unit 203 may use the device specific information and SIM information as the authentication key as they are, or may generate new information from the device specific information and SIM information and use this as the authentication key. In the following description, it is assumed that the device specific information and SIM information are used as the authentication key as they are.

[0111] After generating the authentication key, the authentication control unit 203 transmits the authentication key to the communication control unit 202 in S1304.

[0112] Upon receiving the authentication key, the communication control unit 202 performs either the following process a or process b, depending on the state of the communication device 200. Specifically, if provisioning is required, the communication control unit 202 performs process a, and if provisioning has already been performed or provisioning is not required, the communication control unit 202 performs process b.

[0113] Process a: The communication control unit 202 transmits a provisioning information request to the management system 400.

[0114] Process b: The communication control unit 202 sends an authentication request to the authentication system 500 .

[0115] In the embodiment 2-1, the process a is executed. Specifically, in S1305, the communication control unit 202 transmits a provisioning information request to the management system 400. The provisioning information request includes the above-mentioned authentication key.

[0116] In step S1306, the management system 400 that has received the provisioning information request makes an authentication request for the communication device 200 to the authentication system 500 using the authentication key accompanying the provisioning information request.

[0117] Upon receiving the authentication request, the authentication system 500 checks the authentication information held within the system and the authentication key accompanying the authentication request to determine whether the authentication has succeeded or failed. If the authentication within the authentication system 500 is successful, in S1307, an authentication request for SIM information is made to the subscriber management device 600. If the authentication using the authentication key is successful, authentication using only the SIM information need not be performed.

[0118] In cases where the device specific information has not been registered in the authentication system 500, the authentication system 500 may determine the success / failure of authentication based only on the SIM information in the authentication key received from the management system 400. In this case, the authentication system 500 registers the device specific information received from the management system 400 by linking it to the SIM information in the authentication system 500.

[0119] Upon receiving the authentication response from the subscriber management device 600, the authentication system 500 transmits the authentication response to the management system 400 in S1308.

[0120] If the result of the authentication request to the subscriber management device 600 is a failure, even if the result of the authentication within the authentication system 500 is a success, the authentication is determined to have failed.

[0121] In S1309, the management system 400, which has received the authentication response (assuming here that the authentication was successful) from the authentication system 500, transmits a provisioning information response to the communication device 200. The provisioning information response includes, as the provisioning information, information indicating the upload destination of the information of the device information storage device 300. The provisioning information response also includes the result of the authentication response.

[0122] The management system 400 may hold the authentication key received from the communication device 200. Then, in S1305, if the authentication key accompanying the provisioning information request received from the communication device 200 is known (if it matches the held authentication key), the management system 400 may send a provisioning information response to the communication device 200 without making an authentication request to the authentication system 500.

[0123] In step S1310, the communication control unit 202 of the communication device 200 that has received the provisioning information response from the management system 400 passes the provisioning information to the provisioning control unit 205 on the SIM applet, and completes the provisioning.

[0124] In step S1311, the communication control unit 202 of the communication device 200 that has completed the provisioning transmits the result of the authentication response to the authentication control unit 203.

[0125] <Example 2-2: With communication device, with management system, with provisioning, with Applet> Next, an embodiment 2-2 will be described. Fig. 27 is a configuration diagram of a communication system in the embodiment 2-2. As shown in Fig. 27, in the embodiment 2-2, an authentication control unit 203 of a communication device 200 is provided as a program (applet) on a SIM 204. Except for this point, the communication system of the embodiment 2-2 is the same as the communication system of the embodiment 2-1.

[0126] 28 shows a sequence in the embodiment 2-2. As described above, the only difference from the embodiment 2-1 is that the authentication control unit 203 of the communication device 200 is provided as a program (applet) on the SIM 204. The operation related to the sequence is the same as that of the embodiment 2-1.

[0127] <Example 2-3: Communication device present, management system absent, provisioning absent> Next, an embodiment 2-3 will be described. Fig. 29 is a configuration diagram of a communication system in the embodiment 2-3. As shown in Fig. 29, the embodiment is different from the embodiment 2-1 in that the communication system does not include a management system 400. For ease of understanding, Fig. 29 shows the management system 400 that is not connected to the communication system.

[0128] Fig. 30 shows a sequence in the embodiment 2-3. S1501 to S1504 in Fig. 30 are the same as S1301 to S1304 in the embodiment 2-1 (Fig. 26).

[0129] Upon receiving the authentication key, the communication control unit 202 performs either the following process a or process b, depending on the state of the communication device 200. Specifically, if provisioning is required, the communication control unit 202 performs process a, and if provisioning has already been performed or provisioning is not required, the communication control unit 202 performs process b.

[0130] Process a: The communication control unit 202 transmits a provisioning information request to the device information storage device 300 or the management system 400 .

[0131] Process b: The communication control unit 202 sends an authentication request to the authentication system 500 .

[0132] In the embodiment 2-3, the process b is executed. That is, in S1505, the communication control unit 202 transmits an authentication request to the authentication system 500. The authentication request includes an authentication key. The authentication process contents in the authentication system 500 are the same as the authentication process contents in the embodiment 2-1.

[0133] In S1507, authentication system 500 transmits an authentication response to communication device 200. In S1508, communication control unit 202 transmits to authentication control unit 203 a result of the authentication.

[0134] <Example 2-4: Communication device present, management system absent, provisioning absent, Applet> Next, an example 2-4 will be described. Fig. 31 is a configuration diagram of a communication system in the example 2-4. As shown in Fig. 31, in the example 2-4, an authentication control unit 203 of a communication device 200 is provided as a program (applet) on a SIM 204. Except for this point, the communication system in the example 2-4 is the same as the communication system in the example 2-3.

[0135] 32 shows a sequence in Example 2-4. As described above, the only difference from Example 2-3 is that the authentication control unit 203 of the communication device 200 is provided as a program (applet) on the SIM 204. The operation related to the sequence is the same as that of Example 2-3.

[0136] <Example 2-5: Equipment installation, management system, provisioning> Next, an embodiment 2-5 will be described. Fig. 33 is a configuration diagram of a communication system in the embodiment 2-5. As can be seen by comparing Fig. 33 with Fig. 25 (embodiment 2-1), in embodiment 2-5, the communication device 200, which is an external SIM-equipped device, is not used, and instead, the functions in the communication device 200 are provided in the device information storage device 300. In other words, in embodiment 2-5, the device information storage device 300 itself is provided with the functions of SIM authentication + device authentication.

[0137] 33, the device information storage device 300 of Example 2-5 includes a communication control unit 301, an authentication control unit 302, a device information database 303, a device information recording unit 304, a device information acquisition unit 305, and an SIM 307. The SIM 307 includes a provisioning control unit 306.

[0138] The functions of device information acquisition unit 305 , communication control unit 301 , authentication control unit 302 , and SIM 307 are the same as the functions of device information acquisition unit 201 , communication control unit 202 , authentication control unit 203 , and SIM 204 in communication device 200 , respectively.

[0139] Fig. 34 shows a sequence in Example 2-5. In Example 2-5, the process of SIM authentication+device authentication starts when the device information storage device 300 is powered on. However, this is an example, and the process of SIM authentication+device authentication may start at other timings. The processing operation related to the sequence in Example 2-5 is the same as the processing operation related to the sequence in Example 2-1 (Fig. 26).

[0140] <Example 2-6: Device installation, management system, provisioning, Applet> Next, an example 2-6 will be described. Fig. 35 is a configuration diagram of a communication system in the example 2-6. As shown in Fig. 35, in the example 2-6, the authentication control unit 302 of the device information storage device 300 is provided as a program (applet) on the SIM 307. Except for this point, the communication system in the example 2-6 is the same as the communication system in the example 2-5.

[0141] 36 shows a sequence in the embodiment 2-6. As described above, the only difference from the embodiment 2-5 is that the authentication control unit 302 of the device information storage device 300 is provided as a program (applet) on the SIM 307. The operation related to the sequence is the same as that of the embodiment 2-5.

[0142] <Example 2-7: No equipment installation, no management system, no provisioning> Next, an example 2-7 will be described. Fig. 37 is a configuration diagram of a communication system in the example 2-7. The configuration of the communication system in the example 2-7 is the same as the configuration of the communication system in the example 2-3 etc. (Fig. 29), in which the management system 400 is not present.

[0143] Fig. 38 shows a sequence in the embodiment 2-7. S1901 to S1904 in Fig. 38 are the same as S1701 to S1704 in the embodiment 2-5 (Fig. 34).

[0144] In the embodiment 2-7, in S1905, the communication control unit 301 transmits an authentication request to the authentication system 500. The subsequent processing contents are the same as those in the embodiment 2-3.

[0145] <Example 2-8: Device installation, no management system, no provisioning, applet> Next, Example 2-8 will be described. Fig. 39 is a configuration diagram of a communication system in Example 2-8. As shown in Fig. 39, in Example 2-8, authentication control unit 302 of device information storage device 300 is provided as a program (applet) on SIM 307. Except for this point, the communication system of Example 2-8 is the same as the communication system of Example 2-7.

[0146] 40 shows a sequence in Example 2-8. As described above, the only difference from Example 2-7 is that the authentication control unit 302 of the device information storage device 300 is provided as a program (applet) on the SIM 307. The operation related to the sequence is the same as that of Example 2-7.

[0147] (Example of device hardware configuration) The device 100, communication device 200, device information storage device 300, management system 400, authentication system 500, and subscriber management device 600 (collectively referred to as "devices") in this embodiment can be realized, for example, by making a computer execute a program in which the processing contents described in this embodiment are described. Note that, with respect to the device 100, it is assumed that the part that executes the processing related to this embodiment can be realized by a computer and a program.

[0148] This "computer" may be a physical machine, or a virtual machine on the cloud. When using a virtual machine, the "hardware" described here is virtual hardware.

[0149] The above program can be recorded on a computer-readable recording medium (such as a portable memory) and can be stored or distributed. The above program can also be provided via a network such as the Internet or e-mail.

[0150] Fig. 41 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 41 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are connected to each other via a bus B. Also, the SIM 1009 shown in Fig. 41 is provided in the communication device 200. Also, the SIM 1009 may be provided in the device.

[0151] Depending on the device, one, a plurality, or all of the drive device 1000, the display device 1006, the input device 1007, and the output device 1008 may not be provided.

[0152] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0153] When an instruction to start a program is received, the memory device 1003 reads out the program from the auxiliary storage device 1002 and stores it. The CPU 1004 realizes functions related to the device in accordance with the program stored in the memory device 1003. When an applet (program) of the SIM 1009 is used, a processor built in the SIM 1009 may execute the program.

[0154] The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0155] (Effects of the embodiment) According to the technique according to the present embodiment described above, unauthorized devices can be prevented from connecting to the network.

[0156] In addition, IoT devices are often used to upload data stored in the IoT device to a data collection system. To achieve this, provisioning is required, such as registering initial setting information on the IoT device. However, as the number of IoT devices increases, doing this for each one of them becomes an enormous amount of work.

[0157] On the other hand, the technology according to the present embodiment enables secure communication with a server or cloud, and appropriate provisioning can be registered for each IoT device. If authentication is established for an IoT device, provisioning information registered in the server in advance can be transmitted from the server or cloud to the IoT device, and the IoT device can register the received provisioning information, thereby realizing automatic provisioning. Automatic provisioning eliminates the need for provisioning work for each IoT device.

[0158] (Summary of the embodiment) This specification describes at least the communication device, equipment, communication system, authentication method, and program described in the following sections. (Section 1) A communication device connectable to a device, a device information acquisition unit that acquires device specific information from the device to which the communication device is connected; an authentication control unit that generates an authentication key from authentication information held by the communication device and the device specific information; a communication control unit that transmits the authentication key to an authentication unit that performs an authentication process for the communication device and the equipment using the authentication key; A communication device comprising: (Section 2) The authentication information is SIM information obtained from a SIM provided in the communication device. 2. A communication device as described in item 1. (Section 3) The authentication means includes a means for managing provisioning information, the communication control unit transmits a provisioning information request including the authentication key to the authentication means, and the communication device receives the provisioning information from the authentication means. 3. A communication device according to claim 1 or 2. (Section 4) A device for storing authentication information, a device information acquisition unit for acquiring device specific information of the device; an authentication control unit that generates an authentication key from the authentication information and the device specific information; a communication control unit that transmits the authentication key to an authentication unit that performs an authentication process for the device using the authentication key; Equipment comprising: (Section 5) A communication system including a device, a communication device connected to the device, and an authentication means, The communication device acquires device specific information from the device, the communication device generates an authentication key from authentication information held by the communication device and the device specific information; The communication device transmits the authentication key to the authentication means; The authentication means performs authentication processing for the communication device and the equipment using the authentication key. Communication systems. (Section 6) A communication system including a device that stores authentication information and an authentication means, The device acquires device-specific information of the device, the device generates an authentication key from the authentication information and the device specific information; The device transmits the authentication key to the authentication means; The authentication means performs authentication processing for the device using the authentication key. Communication systems. (Section 7) 1. An authentication method performed by a communication device connectable to a device, comprising: acquiring device specific information from the device to which the communication device is connected; generating an authentication key from authentication information held by the communication device and the device specific information; transmitting the authentication key to an authentication means that performs an authentication process for the communication device and the equipment using the authentication key; An authentication method comprising: (Section 8) A program for causing a computer to function as the device information acquisition unit, the authentication control unit, and the communication control unit in the communication device according to any one of claims 1 to 3. (Section 9) A program for causing a computer to function as the device information acquisition unit, the authentication control unit, and the communication control unit in the device described in claim 4.

[0159] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0160] 100 equipment 101 Device information acquisition section 102 Communication control section 103 Authentication control section 104 SIM 105 Provisioning control section 106 Equipment information recording section 200 Communication equipment 201 Device information acquisition section 202 Communication control section 203 Authentication control section 204 SIM 205 Provisioning control section 300 Equipment information storage device 301 Communication Control Unit 302 Authentication control section 303 Equipment Information Database 304 Equipment Information Recording Section 305 Device information acquisition section 306 Provisioning control section 307 SIM 400 Management Systems 500 Authentication System 600 Subscriber management equipment 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device 1009 SIM

Claims

1. A communication device connectable to a device, a device information acquisition unit that acquires device specific information from the device to which the communication device is connected; an authentication control unit that generates an authentication key from authentication information held by the communication device and the device specific information; a communication control unit that transmits the authentication key to an authentication unit that performs an authentication process for the communication device and the equipment using the authentication key; The authentication information is SIM information acquired from a SIM provided in the communication device, and the authentication control unit is provided as an applet on the SIM. Communications equipment.

2. The authentication means includes a means for managing provisioning information, the communication control unit transmits a provisioning information request including the authentication key to the authentication means, and the communication device receives the provisioning information from the authentication means. The communication device according to claim 1 .

3. A device for storing authentication information, a device information acquisition unit for acquiring device specific information of the device; an authentication control unit that generates an authentication key from the authentication information and the device specific information; a communication control unit that transmits the authentication key to an authentication unit that performs an authentication process for the device using the authentication key; The authentication information is SIM information obtained from a SIM provided in the device, and the authentication control unit is provided as an applet on the SIM. device.

4. A communication system including a device, a communication device connected to the device, and an authentication means, The communication device acquires device specific information from the device, an authentication control unit in the communication device generates an authentication key from authentication information held by the communication device and the device specific information; The communication device transmits the authentication key to the authentication means; the authentication means performs an authentication process for the communication device and the equipment using the authentication key; The authentication information is SIM information acquired from a SIM provided in the communication device, and the authentication control unit is provided as an applet on the SIM. Communication systems.

5. A communication system including a device that stores authentication information and an authentication means, The device acquires device-specific information of the device, an authentication control unit in the device generates an authentication key from the authentication information and the device specific information; The device transmits the authentication key to the authentication means; the authentication means is a communication system that performs authentication processing for the device using the authentication key, The authentication information is SIM information obtained from a SIM provided in the device, and the authentication control unit is provided as an applet on the SIM. Communication systems.

6. 1. An authentication method performed by a communication device connectable to a device, comprising: acquiring device specific information from the device to which the communication device is connected; an authentication control unit in the communication device generating an authentication key from authentication information held by the communication device and the device specific information; a step of transmitting the authentication key to an authentication means that performs an authentication process for the communication device and the equipment using the authentication key by the communication device; The authentication information is SIM information acquired from a SIM provided in the communication device, and the authentication control unit is provided as an applet on the SIM. Authentication method.

7. A program for causing a computer to function as the device information acquisition unit, the authentication control unit, and the communication control unit in the communication device according to claim 1 or 2.

8. A program for causing a computer to function as the device information acquisition unit, the authentication control unit, and the communication control unit in the device according to claim 3.

Images