System and method of operation of the system

Abstract

To improve the efficiency of certification acquisition for authenticity of IoT apparatuses.SOLUTION: In a system having a terminal device and an apparatus that communicates with the terminal device, the terminal device generates a digital signature in response to a digital certificate signing request generated by the apparatus, and the apparatus sends the digital certificate signing request, the digital signature, and a digital certificate to a server having information that associates a user with the terminal device, and establishes communication with the server on the condition that the digital certificate is authenticated by a certification authority coordinating with the server.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a system and a method of operation of the system. [Background technology]

[0002] In the Internet of Things (IoT), or the so-called Internet of Things, various IoT devices such as houses, vehicles, home appliances, and electronic devices are connected to the Internet to transmit and receive information between the devices, and to remotely control the devices. When various IoT devices establish communication with a server device or the like via the Internet, a technology has been proposed for verifying the authenticity of the IoT device in order to prevent fraud such as spoofing. In relation to such a technology, for example, Patent Document 1 discloses a technology relating to an electronic certificate for authenticating the authenticity of an IoT device that communicates with other devices via the Internet or the authenticity of information transmitted and received. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6465426 Summary of the Invention [Problem to be solved by the invention]

[0004] The process of certifying the authenticity of IoT devices is generally cumbersome, so there is room for streamlining the process.

[0005] The present disclosure provides a system etc. that enables improved efficiency in obtaining authentication regarding the authenticity of IoT devices. [Means for solving the problem]

[0006] The system disclosed herein is a system having a terminal device and an apparatus that communicates with the terminal device, wherein the terminal device generates an electronic signature in response to an electronic certificate signature request generated by the apparatus, and the apparatus sends the electronic certificate signature request, the electronic signature, and the electronic certificate to a server that has information matching a user with the terminal device, and establishes communication with the server on the condition that the electronic certificate is authenticated by a certification authority associated with the server.

[0007] A system operation method in the present disclosure is a system operation method having a terminal device and an apparatus that communicates with the terminal device, and includes a step in which the terminal device generates an electronic signature in response to an electronic certificate signature request generated by the apparatus, and a step in which the apparatus sends the electronic certificate signature request, the electronic signature, and an electronic certificate to a server having information matching a user with the terminal device, and establishes communication with the server on the condition that the electronic certificate is authenticated by a certification authority associated with the server. Effect of the Invention

[0008] According to the system etc. disclosed herein, it is possible to improve the efficiency of obtaining authentication regarding the authenticity of IoT devices. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an IoT system. [Diagram 2] FIG. 1 is a diagram illustrating an example of an operation procedure of each device in an IoT system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment will be described with reference to the drawings.

[0011] FIG. 1 is a diagram showing a configuration example of an IoT system in an embodiment. The IoT system 1 includes one or more devices 11, a back-end server 12, and an authentication server 13, which are connected to each other via a network 14 so as to be able to communicate with each other. The IoT system 1 also includes a terminal device 10 configured to be able to directly communicate with the device 11. The device 11 includes a communication function and an information processing function, and is, for example, various home appliances, various sensor devices, various home facilities, etc. The back-end server 12 is, for example, a server computer belonging to a cloud computing system or other computing system, and functions as a server implementing various functions. The back-end server 12 processes various information collected from the device 11, and relays information transmission and reception and control between the devices 11. The authentication server 13 is a server of a certification authority that performs authentication processing to ensure the authenticity of the device 11 when the device 11 connects to the back-end server 12. The terminal device 10 is, for example, a hardware token, an IC (Integrated Circuit) card, etc., which has a function of directly communicating with the device 11 via wired or wireless communication and processes and stores information required for authenticating the device 11. Network 14 may be, for example, the Internet, but may also include an ad-hoc network, a LAN, a metropolitan area network (MAN), or other network, or any combination thereof.

[0012] In the present embodiment, in the IoT system 1, the terminal device 10, the device 11, and the back-end server 12 encrypt various information based on a public key cryptosystem and transmit, receive, or decrypt the information. The terminal device 10 generates an electronic signature in response to a digital certificate signature request (hereinafter, referred to as a CSR (Certificate Signature Request)) generated and transmitted by the device 11, and transmits the digital signature to the device 11. The device 11 transmits the CSR, the digital signature, and the digital certificate to the back-end server 12, which has information associating the user with the terminal device 10. On the condition that the digital certificate is authenticated by a certificate authority linked to the back-end server 12, that is, the authentication server 13, communication between the device 11 and the back-end server 12 is established. By having the terminal device 10 communicate with the device 11, the user can obtain authentication of the authenticity of the device 11 and establish a connection between the device 11 and the back-end server 12 without directly inputting information required for authentication to the device 11. This makes it possible to improve the efficiency of obtaining authentication of the authenticity of the IoT device.

[0013] Next, the configuration of each part of the IoT system 1 will be described.

[0014] The terminal device 10 includes a communication unit 101 , a storage unit 102 , a control unit 103 , and an input / output unit 104 .

[0015] The communication unit 101 includes one or more communication interfaces. The communication interface is a wired interface such as a Universal Serial Bus (USB) capable of communicating with the device 11, or a short-range wireless interface such as Bluetooth (registered trademark) or Near Field Communication (NFC).

[0016] The storage unit 102 includes, for example, one or more semiconductor memories, one or more magnetic memories, one or more optical memories, or a combination of at least two of these. The semiconductor memories are, for example, RAM (Random Access Memory) or ROM (Read Only Memory). The RAM is, for example, SRAM (Static RAM) or DRAM (Dynamic RAM). The ROM is, for example, EEPROM (Electrically Erasable Programmable ROM).

[0017] The control unit 103 includes one or more processors, one or more dedicated circuits, or a combination of these. The processor is, for example, a general-purpose processor such as an MPU (Micro Processing Unit), or a dedicated processor specialized for a specific process. The dedicated circuit is, for example, an FPGA (Field-Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), etc.

[0018] The input / output unit 104 has an input interface that detects user input and sends the input information to the control unit 103, and an output interface that outputs information generated by the control unit 103 to the user. The input interface is, for example, a physical key, a capacitive key, a touch screen that is integral with a panel display, etc. The output interface is, for example, a light that turns on and off depending on the information to be output, a display that outputs information as an image, a speaker that outputs information as sound, etc.

[0019] The device 11 includes a communication unit 111 , a storage unit 112 , and a control unit 113 .

[0020] The communication unit 111 includes one or more communication interfaces. The communication interface is, for example, a wired or wireless LAN interface, an interface compatible with a mobile communication standard such as LTE (Long Term Evolution), 4G (4th Generation), or 5G (5th Generation), a wired interface such as USB capable of communicating with the terminal device 10, or a short-range wireless interface such as Bluetooth or NFC. The communication unit 111 receives information used for the operation of the control unit 113 from the terminal device 10 and the back-end server 12, and transmits information obtained by the operation of the control unit 113.

[0021] The storage unit 112 includes, for example, one or more semiconductor memories, one or more magnetic memories, one or more optical memories, or a combination of at least two of these, functioning as a main storage device, an auxiliary storage device, or a cache memory. The semiconductor memory is, for example, a RAM or a ROM. The RAM is, for example, an SRAM or a DRAM. The ROM is, for example, an EEPROM. The storage unit 112 stores information used in the operation of the control unit 113 and information obtained by the operation of the control unit 113.

[0022] The control unit 113 includes one or more processors, one or more dedicated circuits, or a combination of these. The processor is, for example, a general-purpose processor such as a CPU (Central Processing Unit) or an MPU, or a dedicated processor specialized for a specific process. The dedicated circuit is, for example, an FPGA or an ASIC. The control unit 113 executes information processing related to the operation of the device 11 while controlling each part of the device 11.

[0023] The back-end server 12 includes a communication unit 121, a storage unit 122, and a control unit 123. The back-end server 12 is, for example, a single computer. Alternatively, the back-end server 12 may be configured with two or more computers that are communicatively connected and operate in cooperation with each other. In this case, the configuration shown in FIG. 1 is appropriately arranged in the two or more computers.

[0024] The communication unit 121 includes one or more communication interfaces. The communication interface is, for example, a wired or wireless LAN interface. The communication unit 121 receives information used in the operation of the backend server 12, and transmits information obtained by the operation of the backend server 12. The backend server 12 is connected to the network 14 by the communication unit 121, and communicates information with the device 11 and the authentication server 13 via the network 14.

[0025] The storage unit 122 includes, for example, one or more semiconductor memories, one or more magnetic memories, one or more optical memories, or a combination of at least two of these, functioning as a main storage device, an auxiliary storage device, or a cache memory. The semiconductor memory is, for example, a RAM or a ROM. The RAM is, for example, an SRAM or a DRAM. The ROM is, for example, an EEPROM. The storage unit 122 stores information used in the operation of the control unit 123 and information obtained by the operation of the control unit 123.

[0026] The control unit 123 includes one or more processors, one or more dedicated circuits, or a combination of these. The processor is, for example, a general-purpose processor such as a CPU, or a dedicated processor such as a GPU specialized for a specific process. The dedicated circuit is, for example, an FPGA, an ASIC, etc. The control unit 123 executes information processing related to the operation of the backend server 12 while controlling each unit of the backend server 12.

[0027] The functions of the backend server 12 are realized by executing a control program in a processor included in the control unit 123. The control program is a program for making a computer realize a function corresponding to the processing of a step included in the operation of the backend server 12 by making the computer execute the processing of the step. In other words, the control program is a program for making a computer function as the backend server 12. Also, some or all of the functions of the backend server 12 may be realized by a dedicated circuit included in the control unit 103. Also, the control program may be stored in a non-transitory recording / storage medium readable by the backend server 12, and read by the backend server 12 from the medium.

[0028] The authentication server 13 has the same configuration as the back-end server 12. The authentication server 13 is composed of one or more computers.

[0029] Fig. 2 is a sequence diagram showing an example of the operation procedure of the terminal device 10, the device 11, the back-end server 12, and the authentication server 13 in the IoT system 1. Steps relating to various information processes of the terminal device 10, the device 11, the back-end server 12, and the authentication server 13 in Fig. 2 are executed by the respective control units 103, 113, 123, and 123. Steps relating to sending and receiving various information are executed by the control units 103, 113, 123, and 123 sending and receiving information to each other via the communication units 101, 111, 121, and 121, respectively.

[0030] 2 is a procedure when a user uses the terminal device 10 to establish communication with the backend server 12 of the device 11. The procedure in FIG. 2 is started when the user physically connects the terminal device 10 to or brings the terminal device 10 close to the device 11.

[0031] In step S201, the terminal device 10 is physically connected to the device 11, whereby the terminal device 10 is recognized by the device 11 and is capable of transmitting and receiving information to and from the device 11. Alternatively, the terminal device 10 is recognized by the device 11 through short-range wireless communication, whereby the terminal device 10 is capable of transmitting and receiving information to and from the device 11.

[0032] In step S203, the device 11 generates a private key, a public key, a digital certificate, and a CSR.

[0033] In step S205, the device 11 sends a request for an electronic signature for the CSR to the terminal device 10. The terminal device 10 generates a private key and a public key in advance, and obtains a public key certificate including the public key from the authentication server 13, thereby obtaining authentication for the terminal device 10.

[0034] In step S207, in response to the electronic signature request, the terminal device 10 outputs a notification to the user prompting the user to enter an electronic signature, and accepts an operation by the user. The notification is output, for example, by blinking a light, displaying text information, or outputting a voice. When the user receives the notification of the electronic signature request and agrees to the electronic signature, the user performs an operation corresponding to the agreement. The user's operation is, for example, touching or pressing an operation button or the like.

[0035] In step S209, in response to a user's operation, the terminal device 10 generates a digital signature by encrypting the hash value of the CSR with the private key of the terminal device 10. Then, the terminal device 10 sends to the device 11 a public key certificate including the digital signature for the CSR and the certified public key.

[0036] In step S211, the device 11 adds the digital signature and public key certificate received from the terminal device 10 to the CSR.

[0037] In step S213, the device 11 sends the CSR with the digital signature added and the public key certificate received from the terminal device 10 to the backend server 12.

[0038] In step S215, the backend server 12 checks the validity of the CSR. The backend server 12 decrypts the electronic signature added to the CSR with the authenticated public key of the terminal device 10 included in the public key certificate sent from the device 11, and judges the validity of the CSR by comparing it with the hash value of the CSR. The backend server 12 checks the authenticity of the user on the condition that the public key certificate acquired from the terminal device 10 via the device 11 matches the public key certificate acquired in advance from the authentication server 13. If the validity of the CSR or the authenticity of the user is not confirmed, the backend server 12 notifies the device 11 of an error in step S217, and the procedure in FIG. 2 is terminated.

[0039] In step S219, the backend server 12 accepts authentication by the user. The user accesses the backend server 12 via the network 14 using any information processing device, and sends the user's identification information from the information processing device to the server device. The backend server 12 accepts authentication by the user on the condition that the identification information sent by the user matches the information in the public key certificate. In this way, it is confirmed that the CSR of the device 11 has been digitally signed by a genuine user using a terminal device 10 that has been associated with the device 11 in advance.

[0040] When the authenticity of the user is confirmed, in step S221, the backend server 12 sends the CSR and the electronic certificate received from the device 11 to the authentication server 13. The electronic certificate includes the public key generated by the device 11.

[0041] In step S223, the authentication server 13 obtains the public key from the electronic certificate of the device 11, authenticates the device 11, and generates a public key certificate. The authentication server 13 digitally signs the public key certificate with the private key and sends it to the backend server 12.

[0042] In step S 225 , the back-end server 12 sends the signed public key certificate received from the authentication server 13 to the device 11 .

[0043] In step S227, the device 11 obtains the signed public key certificate received from the backend server 12. Then, the device 11 sets its own public key authenticated by the public key certificate, that is, the authentication server 13. In this way, the authenticity of the device 11 is confirmed.

[0044] According to this embodiment, by having the terminal device 10 communicate with the device 11, the user can obtain authentication of the authenticity of the device 11 and establish a connection between the device 11 and the backend server 12 without directly inputting information required for authenticating the device 11 to the device 11. This makes it possible to improve the efficiency of obtaining authentication of the authenticity of an IoT device.

[0045] 2 shows an example in which the device 11 establishes a connection with the backend server 12. However, it is also possible for an IoT device other than the device 11 to execute steps S213 to S225 instead of the backend server 12, thereby establishing a connection between the device 11 and another IoT device.

[0046] In the above, the embodiment has been described based on the drawings and examples, but it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these modifications and corrections are included in the scope of the present disclosure. For example, the functions included in each means, each step, etc. can be rearranged so as not to be logically inconsistent, and multiple means, steps, etc. can be combined into one or divided into one. [Explanation of symbols]

[0047] 1 IoT System 10 Terminal Equipment 11 Equipment 12 Backend Server 13 Authentication Server 14 Network 101, 111, 121 Communications Department 102, 112, 122 storage section 103, 113, 123 Control unit 104 Input / output section

Claims

1. A system having a terminal device and a device that communicates with the terminal device, the terminal device generates an electronic signature in response to a digital certificate signing request generated by the device; the device sends the digital certificate signature request, the digital signature, and the digital certificate to a server having information associating the user with the terminal device, and establishes communication with the server on the condition that the digital certificate is authenticated by a certification authority associated with the server. system.

2. In claim 1, the server sends the electronic certificate signature request and the electronic certificate to the certification authority on the condition that the electronic signature corresponds to information associating the user with the terminal device, and the authenticated electronic certificate sent from the certification authority is sent to the device; system.

3. In claim 2, When the device recognizes the terminal device via a wired or wireless connection, the device sends the digital certificate signing request to the terminal device. system.

4. A method of operating a system having a terminal device and a device in communication with the terminal device, comprising: generating an electronic signature by the terminal device in response to a digital signature request generated by the device; the device sends the digital certificate signature request, the digital signature, and the digital certificate to a server having information associating a user with the terminal device, and establishes communication with the server on the condition that the digital certificate is authenticated by a certification authority associated with the server; The method of operation includes:

5. In claim 4, The method further includes a step of, in the server, sending the electronic certificate signature request and the electronic certificate to the certification authority, on condition that information included in the electronic signature corresponds to information associating the user with the terminal device, and sending the authenticated electronic certificate sent from the certification authority to the device. How it works.

6. In claim 5, When the device recognizes the terminal device via a wired or wireless connection, the device sends the digital certificate signing request to the terminal device. How it works.

Images