Facility equipment control device, control method and program

Abstract

To provide a facility apparatus control device, a control method, and a program that can make a remote control system less susceptible to attacks from malicious third parties.SOLUTION: A facility apparatus control device 100 controls a facility apparatus 200 according to an instruction from a remote monitoring device 300 in a remote control system that remotely controls the facility apparatus 200 from the remote monitoring device 300 via a network. An acquisition unit 101 acquires a packet transmitted to and received from the remote monitoring device 300. A determination unit 102 determines whether or not the remote control system has an unauthorized configuration in which a VPN router that connects to the facility apparatus control device 100 is not installed, based on whether or not a transmission source IP address or a destination IP address of the packet is a global IP address. When it is determined that the remote control system has an unauthorized configuration, a warning unit 103 warns a user of the facility apparatus control device 100 that the remote control system has an unauthorized configuration.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to an equipment control device, a control method, and a program. [Background technology]

[0002] There is known a remote control system that remotely controls equipment such as an air conditioner installed in a property from a remote monitoring device located in a place other than the property via a public network such as the Internet. For example, Patent Document 1 discloses a technology for remotely controlling electrical equipment in a house from a communication terminal via the Internet. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2006-287639 A Summary of the Invention [Problem to be solved by the invention]

[0004] In such a remote control system, an equipment device control apparatus is provided that communicates with a remote monitoring apparatus that remotely instructs the control content, and controls the equipment devices based on the instructions from the remote monitoring apparatus. The equipment device control apparatus is generally installed in the same property as the equipment devices, and the user of the equipment device control apparatus manages the equipment devices. In order to perform secure remote control, the user of the equipment device control apparatus is required to install a VPN (Virtual Private Network) router that connects to the equipment device control apparatus between the equipment device control apparatus and the remote monitoring apparatus.

[0005] However, users of facility equipment control devices may not install a VPN router due to the complexity and expense involved in installing the router. If a remote control system is illegally configured without a VPN router connected to the facility equipment control device, it may be vulnerable to attacks from malicious third parties. Therefore, it is necessary to encourage users of facility equipment control devices to install a VPN router and make the remote control system less susceptible to attacks from malicious third parties.

[0006] The present disclosure has been made in consideration of the above circumstances, and aims to provide an equipment control device, a control method, and a program that can make a remote control system less susceptible to attacks from malicious third parties. [Means for solving the problem]

[0007] In order to achieve the above object, the facility equipment control device according to the present disclosure includes: In a remote control system in which facility equipment is remotely controlled from a remote monitoring device via a network, there is provided a facility equipment control device which controls the facility equipment in accordance with an instruction from the remote monitoring device, An acquisition means for acquiring packets transmitted and received between the remote monitoring device; a determination means for determining whether the remote control system has an illegal configuration in which a VPN router connected to the facility equipment control device is not installed, based on whether a source IP (Internet Protocol) address or a destination IP address of the acquired packet is a global IP address; a warning means for warning a user of the facility equipment control device that the remote control system has an unauthorized configuration when the remote control system is determined to have an unauthorized configuration; Equipped with. Effect of the Invention

[0008] According to the present disclosure, it is possible to provide an equipment control device, a control method, and a program that can make a remote control system less susceptible to attacks from malicious third parties. [Brief description of the drawings]

[0009] [Figure 1] Block diagram of a remote control system according to an embodiment. [Diagram 2] FIG. 1 is a block diagram showing a hardware configuration of an equipment control device according to an embodiment; [Diagram 3] FIG. 2 is a block diagram showing a functional configuration of an equipment control device according to an embodiment; [Figure 4] FIG. 13 is a diagram showing an example of a warning image according to the embodiment; [Diagram 5] A flowchart showing a control process executed by an equipment control device according to an embodiment. [Figure 6] FIG. 1 is a sequence diagram illustrating an example of communication between an equipment control device and a remote monitoring device according to an embodiment; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] (Embodiment) A remote control system 1 according to the embodiment is a system in which facility equipment is remotely controlled from a remote monitoring device via a network.

[0011] 1, the remote control system 1 includes an equipment control device 100, one or more equipment devices 200, and a remote monitoring device 300. The equipment control device 100 is communicatively connected to the remote monitoring device 300 via a network 400. The equipment control device 100 and the equipment device 200 are installed in the same property. Here, the property is, for example, an office building, a commercial facility, a house, etc.

[0012] The following describes an example in which a remote control service is provided in the remote control system 1. The remote control service is, for example, a service in which the remote monitoring device 300 remotely controls the equipment 200, such as monitoring the operation status of the equipment 200, automatic operation, and maintenance.

[0013] The facility equipment control device 100 controls the facility equipment in accordance with instructions transmitted from the remote monitoring device 300. The facility equipment control device 100 is, for example, a system controller. The facility equipment control device 100 is connected to the facility equipment 200 so as to be able to communicate with each other wirelessly or via wire. A user of the facility equipment control device 100 is a person who receives the remote control service, and is, for example, an administrator of the facility equipment 200.

[0014] The facility equipment 200 is electrical equipment installed in a property. The facility equipment 200 is, for example, an air conditioner, a lighting device, a ventilation device, etc.

[0015] The remote monitoring device 300 transmits instructions indicating the content of remote control of the facility equipment 200 to the facility equipment control device 100. The remote monitoring device 300 is, for example, a personal computer, a tablet computer, etc. The user of the remote monitoring device 300 is a person who provides a remote control service for the facility equipment 200 of a property.

[0016] The network 400 is a wireless or wired communication network, for example, the Internet.

[0017] In the remote control system 1 in FIG. 1, a VPN router 500 is not installed between the facility equipment control device 100 and the remote monitoring device 300. In order to perform secure remote control, a VPN router that connects to the facility equipment control device 100 is installed between the facility equipment control device 100 and the remote monitoring device 300, and communication is required after establishing a VPN connection. Therefore, the administrator of the facility equipment 200 is required to install a VPN router 500 that connects to the facility equipment control device 100. If the VPN router 500 is not installed, there is a risk of being attacked by a malicious third party, and secure remote control cannot be guaranteed. Hereinafter, a configuration of the remote control system 1 in which a VPN router 500 is not installed between the facility equipment control device 100 and the remote monitoring device is referred to as an "illegal configuration."

[0018] Next, the hardware configuration of the facility device control device 100 will be described with reference to FIG.

[0019] First, the hardware configuration of the facility equipment control device 100 will be described. The facility equipment control device 100 has a processor 11 that executes various processes, a main memory unit 12 used as a working area for the processor 11, an auxiliary memory unit 13 that stores various data used in the processing of the processor 11, a communication unit 14 for communicating with external devices, an input unit 15 that acquires input information, an output unit 16 that presents various information, and an RTC (Real Time Clock) 17 that keeps time. The main memory unit 12, the auxiliary memory unit 13, the communication unit 14, the input unit 15, the output unit 16, and the RTC 17 are all connected to the processor 11 via a bus 18.

[0020] The processor 11 includes a CPU (Central Processing Unit). The processor 11 executes programs stored in the auxiliary storage unit 13 to realize various functions of the facility device control device 100.

[0021] The main memory unit 12 includes a RAM (Random Access Memory). Programs are loaded into the main memory unit 12 from the auxiliary memory unit 13. The main memory unit 12 is used as a working area for the processor 11.

[0022] The auxiliary storage unit 13 includes a non-volatile memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory). In addition to programs, the auxiliary storage unit 13 stores various data used in the processing of the processor 11. In accordance with instructions from the processor 11, the auxiliary storage unit 13 supplies the processor 11 with data used by the processor 11 and stores the data supplied from the processor 11.

[0023] The communication unit 14 includes a network interface circuit for communicating with an external device. The communication unit 14 receives a signal from the external device and outputs data indicated by the signal to the processor 11. The communication unit 14 also transmits a signal indicating the data output from the processor 11 to the external device.

[0024] The input unit 15 includes input devices such as an input key, a pointing device, etc. The input unit 15 acquires information input by a user of the facility device control device 100, and notifies the processor 11 of the acquired information.

[0025] The output unit 16 includes output devices such as an LCD (Liquid Crystal Display) and a speaker. The output unit 16 may be configured as a touch screen integrally formed with a pointing device constituting the input unit 15. The output unit 16 presents various information to the user according to instructions from the processor 11.

[0026] The RTC 17 is a clock device that includes an oscillation circuit using a crystal oscillator. The RTC 17 includes, for example, a built-in battery and continues to measure time even when the facility equipment control device 100 is powered off.

[0027] Next, functions of the facility device control device 100 will be described with reference to FIG.

[0028] Functionally, the facility equipment control device 100 comprises an acquisition unit 101 that acquires packets transmitted and received between the facility equipment control device and the remote monitoring device, a judgment unit 102 that judges whether or not the configuration is invalid, a warning unit 103 that issues a warning about the invalid configuration, a control unit 104 that controls the facility equipment 200, and an authentication unit 105 that transmits a request to present authentication information.

[0029] The acquisition unit 101 acquires packets transmitted and received between the remote monitoring device 300. The acquisition unit 101 is realized by cooperation between the processor 11 and the communication unit 14. The acquisition unit 101 is an example of an acquisition means.

[0030] For example, when a packet including information regarding settings is transmitted from the remote monitoring device 300 in order to perform initial settings for communication between the facility equipment control device 100 and the remote monitoring device 300, the acquisition unit 101 acquires the packet transmitted from the remote monitoring device 300. Alternatively, when a packet including information regarding settings is transmitted from the facility equipment control device 100 to the remote monitoring device 300 in order to perform initial settings for communication, the acquisition unit 101 acquires the packet transmitted from the facility equipment control device 100, which is inside the facility equipment control device 100.

[0031] The determination unit 102 determines whether the remote control system 1 has an unauthorized configuration in which the VPN router 500 connected to the facility equipment control device 100 is not installed, based on whether the source IP address or destination IP address of the acquired packet is a global IP address. The determination unit 102 is realized by the processor 11. The determination unit 102 is an example of a determination means.

[0032] An unauthorized configuration is a configuration in the remote control system 1 in which a VPN router 500 that connects to the facility equipment control device 100 is not installed between the facility equipment control device 100 and the remote monitoring device, and is a configuration that poses a high security risk.

[0033] For example, it is assumed that address information indicating a range of private IP addresses is stored in the auxiliary storage unit 13. The determination unit 102 refers to the address information and determines whether the source IP address of the acquired packet or the destination IP address of the packet is a global IP address.

[0034] Specifically, when the source IP address of a packet transmitted from the remote monitoring device 300 among the acquired packets is a global IP address, the determining unit 102 determines that the configuration is unauthorized. For example, when the source IP address of a packet transmitted from the remote monitoring device 300 does not match a private IP address in the range indicated in the address information, the determining unit 102 determines that the source IP address is a global IP address.

[0035] For example, if a VPN router 500 connected to the facility equipment control device 100 is installed between the facility equipment control device 100 and the remote monitoring device 300, the source IP address of a packet transmitted from the remote monitoring device 300 and received by the facility equipment control device 100 will be a private IP address assigned to the VPN router 500, not a global IP address. Therefore, if the source IP address of a packet transmitted from the remote monitoring device 300 is a global IP address, the determination unit 102 determines that the remote control system 1 has an invalid configuration.

[0036] Alternatively, when the source IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 among the acquired packets is a global IP address, the determination unit 102 determines that the configuration is invalid. For example, when the source IP address transmitted from the facility equipment control device 100 to the remote monitoring device 300 matches a private IP address in the range indicated in the address information, the determination unit 102 determines that the source IP address is a global IP address.

[0037] For example, if a VPN router 500 connected to the facility equipment control device 100 is installed between the facility equipment control device 100 and the remote monitoring device 300, the source IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 is a private IP address assigned to the facility equipment control device 100, not a global IP address. Therefore, if the source IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 is a global IP address, the determination unit 102 determines that the remote control system 1 has an invalid configuration.

[0038] Alternatively, the determining unit 102 determines that the configuration is invalid when the destination IP address of a packet transmitted from the remote monitoring device 300 among the acquired packets is a global IP address. For example, when the destination IP address of a packet transmitted from the remote monitoring device 300 does not match a private IP address in the range indicated in the address information, the determining unit 102 determines that the destination IP address is a global IP address.

[0039] For example, if a VPN router 500 connected to the facility equipment control device 100 is installed between the facility equipment control device 100 and the remote monitoring device 300, the destination IP address of a packet transmitted from the remote monitoring device 300 and received by the facility equipment control device 100 will be a private IP address assigned to the facility equipment control device 100, not a global IP address. Therefore, if the destination IP address of a packet transmitted from the remote monitoring device 300 is a global IP address, the determination unit 102 determines that the remote control system 1 has an invalid configuration.

[0040] If it is determined that the configuration is unauthorized, the warning unit 103 warns the user of the facility equipment control device 100 that the remote control system 1 has an unauthorized configuration. The warning unit 103 also queries the user of the facility equipment control device 100 as to whether or not the user acknowledges that the remote control system 1 has an unauthorized configuration. The warning unit 103 is realized by the processor 11, the communication unit 14, the input unit 15, and the output unit 16. The warning unit 103 is an example of a warning means.

[0041] For example, when the determination unit 102 determines that the configuration is unauthorized, the warning unit 103 displays a warning image 600 shown in Fig. 4 on the screen of the facility equipment control device 100. The warning image 600 includes a warning message 601, a button 602 indicating that the contents of the warning message 601 are accepted, and a button 603 indicating that the contents of the warning message 601 are not accepted. The warning message 601 includes the following: a notification that the configuration is unauthorized and that a VPN router is not used; a notification that there is a high security risk; a notification that a VPN router should be installed; and a notification that any problems that occur when communication is continued without using a VPN router are not covered by the service guarantee.

[0042] When the warning unit 103 receives a response acknowledging that the remote control system 1 has an unauthorized configuration, the facility device control device 100 performs normal control of the facility device 200 in accordance with instructions from the remote monitoring device 300.

[0043] For example, when the button 602 is selected in the warning image 600 in FIG. 4, the warning unit 103 determines that a response acknowledging that the remote control system 1 has an unauthorized configuration has been received, and the facility equipment control device 100 performs normal control to control the facility equipment 200 according to an instruction from the remote monitoring device 300. Hereinafter, the operation mode of the facility equipment control device 100 in which normal control is performed is referred to as the "normal mode." In addition to the "normal mode," the facility equipment control device 100 also has a "restricted mode" and a "authentication mode," which will be described later, as operation modes. Operation mode information indicating the current operation mode is stored in the auxiliary storage unit 13. When the operation mode information is set to any one of the values ​​of the "normal mode," "restricted mode," and "authentication mode," the facility equipment control device 100 performs operation in the set operation mode.

[0044] On the other hand, when the warning unit 103 receives a response that does not acknowledge that the remote control system has an illegal configuration, the control unit 104 restricts the contents of remote control that can be performed by the remote monitoring device 300. The contents of the remote control that can be restricted can be arbitrarily set by the user of the remote monitoring device 300. For example, the auxiliary storage unit 13 stores restriction information indicating the contents of remote control that are permitted and the contents of remote control that are not permitted when a response that does not acknowledge that the remote control system has an illegal configuration is received. The user of the remote monitoring device 300 can arbitrarily set the contents of the restriction information. Hereinafter, the operation mode of the facility equipment control device 100 in which the contents of remote control that can be performed are restricted is referred to as a "restriction mode". The control unit 104 is realized by the processor 11 and the communication unit 14. The control unit 104 is an example of a control means.

[0045] For example, when button 603 is selected in warning image 600 in Fig. 4, warning unit 103 determines that a response not acknowledging that remote control system 1 has an unauthorized configuration has been received. Control unit 104 sets the operation mode to the restricted mode by setting the value of the operation mode information stored in auxiliary storage unit 13 to "restricted mode". Then, when control unit 104 subsequently receives a remote control instruction from remote monitoring device 300, it refers to the restriction information stored in auxiliary storage unit 13, and if the instruction is an instruction for remote control that is permitted, controls facility device 200 in accordance with the instruction.

[0046] For example, the restriction information is set to permit the remote monitoring device 300 to only acquire information related to the facility equipment control device 100, the facility equipment 200, and the property in which the facility equipment 200 is installed, but not to control the operation of the facility equipment 200. In this case, when the control unit 104 receives an information acquisition request from the remote monitoring device 300, it transmits information related to the acquisition request to the remote monitoring device 300. On the other hand, when the control unit 104 receives an instruction related to the operation of the facility equipment 200 from the remote monitoring device 300, it discards the instruction and transmits a message to the remote monitoring device 300 to the effect that the operation related to the instruction cannot be executed. For example, when the facility equipment 200 is an air conditioner, the instruction related to the operation is an instruction to start operation, stop operation, change the temperature setting, etc.

[0047] Also, for example, it is possible to set the information permitted to be acquired from the remote monitoring device 300 to be low confidentiality information and not to permit acquisition of highly confidential information. Here, low confidentiality information is, for example, information such as the specifications and maintenance history of the facility equipment 200. On the other hand, highly confidential information is, for example, information related to privacy such as current operation information of the facility equipment 200 that can determine whether a person is present or not, and billing information. When the control unit 104 receives an acquisition request for low confidentiality information from the remote monitoring device 300, it transmits information related to the acquisition request to the remote monitoring device 300. On the other hand, when the control unit 104 receives an acquisition request for highly confidential information from the remote monitoring device 300, it transmits a message to the remote monitoring device 300 indicating that the information related to the acquisition request cannot be transmitted.

[0048] Alternatively, when the warning unit 103 receives a response that does not acknowledge that the remote control system has an unauthorized configuration, the authentication unit 105 transmits to the remote monitoring device 300 a request for presentation of authentication information for remotely controlling the facility equipment control device 100 every time an instruction is received from the remote monitoring device 300. The operation mode of the facility equipment control device 100 in which a request for presentation of authentication information is transmitted every time an instruction is received from the remote monitoring device 300 is called an "authentication mode." The authentication unit 105 is realized by the processor 11 and the communication unit 14. The authentication unit 105 is an example of an authentication means.

[0049] The authentication information for remotely controlling the facility equipment control device 100 is, for example, a login ID and a password registered in the facility equipment control device 100. The authentication information is registered by a user of the remote monitoring device 300 during initial setting for communication between the facility equipment control device 100 and the remote monitoring device 300, and is stored in the auxiliary storage unit 13.

[0050] For example, when the button 603 is selected in the warning image 600 in FIG. 4, the warning unit 103 determines that a response that does not acknowledge that the remote control system 1 has an illegal configuration has been received. The authentication unit 105 sets the operation mode to the authentication mode by setting the value of the operation mode information stored in the auxiliary storage unit 13 to "authentication mode". Then, the authentication unit 105 transmits a request for presentation of a login ID and a password to the remote monitoring device 300 every time the authentication unit 105 receives a remote control instruction, such as a request to obtain information or an instruction regarding operation, from the remote monitoring device 300. When the user of the remote monitoring device 300 inputs the login ID and password and the authentication unit 105 receives the login ID and password registered in advance from the remote monitoring device 300, the control unit 104 controls the facility device 200 according to the instruction from the remote monitoring device 300.

[0051] Next, a control process executed by the facility equipment control device 100 according to the present embodiment will be described with reference to the flowchart of Fig. 5. The control process of Fig. 5 is executed, for example, at the time of initial setting for communication between the facility equipment control device 100 and the remote monitoring device 300.

[0052] The acquiring unit 101 judges whether or not a packet to be transmitted / received between the remote monitoring device 300 has been acquired (step S101). When the acquiring unit 101 judges that a packet to be transmitted / received between the remote monitoring device 300 has been acquired (step S101; YES), the judging unit 102 judges whether or not the remote control system 1 has an illegal configuration in which the VPN router 500 is not installed, based on whether or not the source IP address or the destination IP address of the acquired packet is a global IP address (step S102). On the other hand, when the acquiring unit 101 judges that a packet to be transmitted / received between the remote monitoring device 300 has not been acquired (step S101; NO), it waits as it is.

[0053] For example, when the acquiring unit 101 acquires a packet transmitted from the remote monitoring device 300, the determining unit 102 determines whether the remote control system 1 has an unauthorized configuration based on whether the source IP address of the packet transmitted from the remote monitoring device 300 is a global IP address. On the other hand, when the acquiring unit 101 does not acquire a packet to be transmitted or received between the acquiring unit 101 and the remote monitoring device 300, the acquiring unit 101 waits as it is.

[0054] In step S102, if the determination unit 102 determines that the remote control system 1 has an unauthorized configuration (step S102; YES), the warning unit 103 warns the user of the facility equipment control device 100 that the remote control system 1 has an unauthorized configuration (step S103). On the other hand, if the determination unit 102 determines that the remote control system 1 does not have an unauthorized configuration (step S102; NO), the facility equipment control device 100 ends the processing of FIG.

[0055] For example, if the determination unit 102 determines that the source IP address of the packet transmitted from the remote monitoring device 300 is a global IP address, it determines that the remote control system 1 has an unauthorized configuration. Then, the warning unit 103 displays a warning image 600 shown in Fig. 4 on the screen of the facility equipment control device 100. On the other hand, if the determination unit 102 determines that the source IP address of the packet transmitted from the remote monitoring device 300 is not a global IP address, it determines that the remote control system 1 does not have an unauthorized configuration. Then, the facility equipment control device 100 ends the processing of Fig. 5.

[0056] Next, the warning unit 103 inquires of the person who manages the facility equipment 200 whether or not they acknowledge that the remote control system 1 has an unauthorized configuration, and judges whether or not an acknowledgment has been received (step S104). If the warning unit 103 judges that an acknowledgment has been received (step S104; YES), the facility equipment control device 100 ends the processing in Fig. 5. On the other hand, if the warning unit 103 judges that an acknowledgment has not been received (step S104; NO), the process proceeds to step S105.

[0057] For example, when button 602 is selected in warning image 600 in Fig. 4, warning unit 103 determines that a response acknowledging that remote control system 1 has an unauthorized configuration has been received. On the other hand, when button 603 is selected in warning image 600 in Fig. 4, warning unit 103 determines that a response not acknowledging that remote control system 1 has an unauthorized configuration has been received.

[0058] In step S105, the control unit 104 sets the operation mode to a restriction mode that restricts the contents that can be remotely controlled by the remote monitoring device 300. Alternatively, the authentication unit 105 sets the operation mode to an authentication mode in which a request for presentation of authentication information is transmitted every time an instruction is received from the remote monitoring device 300.

[0059] For example, it is assumed that the operation mode is set to the restricted mode in step S105. In this case, when the control unit 104 receives an information acquisition request from the remote monitoring device 300 after the process of FIG. 5 is completed, the control unit 104 transmits information related to the acquisition request to the remote monitoring device 300. In addition, when the control unit 104 receives an instruction to start the operation of the facility device 200, the control unit 104 discards the instruction and transmits a message to the remote monitoring device 300 indicating that the operation cannot be started. In addition, it is assumed that the operation mode is set to the authentication mode in step S105. In this case, after the process of FIG. 5 is completed, the control unit 104 transmits a request to the remote monitoring device 300 to present a login ID and a password every time the control unit 104 receives an information acquisition request, an instruction for remote control such as an instruction related to operation, from the remote monitoring device 300.

[0060] Next, an example of processing executed between the facility equipment control device 100 and the remote monitoring device 300 according to this embodiment after the operation mode is set to the authentication mode will be described with reference to the sequence diagram of FIG. 6.

[0061] First, the remote monitoring device 300 transmits a request for executing a remote control instruction (step S201). Here, it is assumed that a session ID 1 is assigned to the request. When the facility equipment control device 100 receives the request, it transmits a request for presentation of a login ID and a password (step S202). When the remote monitoring device 300 transmits the login ID and the password in response to the presentation request (step S203), the facility equipment control device 100 performs an authentication process to confirm whether or not the received login ID and password match the login ID and the password stored in the auxiliary storage unit 13 (step S204).

[0062] If the facility equipment control device 100 determines that the received login ID and password match the login ID and password stored in the auxiliary storage unit 13, it transmits a notification that the authentication was successful (step S205). At this time, the facility equipment control device 100 assigns a new session ID 2 to the communication between the facility equipment control device 100 and the remote monitoring device 300. The remote monitoring device 300 transmits a request similar to that in step S201, specifying the new session ID 2 (step S206), and the facility equipment control device 100 transmits a response to the request (step S207).

[0063] According to this embodiment, it is possible to warn the user of the facility equipment control device that the remote control system has an illegal configuration in which a VPN router connected to the facility equipment control device is not installed. This makes it possible to urge the user of the facility equipment control device to install a VPN router, and to make the remote control system less susceptible to attacks from malicious third parties. In addition, by inquiring of the user of the facility equipment control device as to whether or not he or she acknowledges that the configuration is illegal, it is possible to clarify the scope of responsibility in the event of a communication problem.

[0064] Furthermore, according to this embodiment, it is possible to determine whether the configuration is unauthorized based on whether the source IP address or the destination IP address is a global IP address. Generally, facility equipment control devices such as system controllers installed in properties do not have high performance and the applications that can be installed are limited, but with this configuration, it is possible to determine whether the facility equipment control device has an unauthorized configuration in which a VPN router is not installed.

[0065] Furthermore, according to the present embodiment, when the remote control system has an unauthorized configuration and communication continues, it is possible to restrict the contents of remote control that can be performed. This makes it possible to prepare for a cyber attack and prevent unauthorized control of devices by malicious third parties and leakage of highly confidential information.

[0066] Furthermore, according to the present embodiment, when the remote control system has an unauthorized configuration and communication continues, it is possible to request the presentation of authentication information every time a remote control instruction is received. This makes it possible to prepare for a cyber attack and prevent unauthorized control of devices from malicious third parties and leakage of highly confidential information.

[0067] Furthermore, according to this embodiment, if the user of the facility equipment control device acknowledges that the remote control system has an invalid configuration and continues communication, it is possible to enable remote control of the facility equipment without compromising user convenience while clarifying the scope of responsibility in the event of a communication malfunction.

[0068] (Modification) Although the embodiment of the present disclosure has been described above, various modifications and applications are possible in implementing the present disclosure.

[0069] In the above embodiment, one facility equipment control device 100 and one remote monitoring device 300 are shown in the remote control system 1, but this is not limiting and there may be multiple of each. Also, the facility equipment control device 100 and the facility equipment 200 are installed in the same property, but they may be installed in different properties. Also, the facility equipment control device 100 may control the facility equipment 200 installed in multiple properties.

[0070] In the above embodiment, the address information indicating the range of private IP addresses is stored in the auxiliary storage unit 13, but this is not limited thereto. The auxiliary storage unit 13 may store address information indicating the range of global IP addresses, or address information indicating the range of both private IP addresses and global IP addresses. In such a case, when the source IP address or the destination IP address matches a global IP address in the range indicated in the address information, the determination unit 102 determines that the source IP address or the destination IP address is a global IP address.

[0071] Furthermore, the determination unit 102 in the above embodiment may determine that the configuration is invalid when the destination IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 among the acquired packets is a global IP address. For example, when the destination IP address transmitted from the facility equipment control device 100 to the remote monitoring device 300 matches a private IP address in the range indicated in the address information, the determination unit 102 determines that the destination IP address is a global IP address.

[0072] For example, if a VPN router 500 connected to the facility equipment control device 100 is installed between the facility equipment control device 100 and the remote monitoring device 300, the destination IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 is a private IP address assigned to the VPN router, not a global IP address. Therefore, if the destination IP address of a packet transmitted from the facility equipment control device 100 to the remote monitoring device 300 is a global IP address, the determination unit 102 determines that the remote control system 1 has an invalid configuration.

[0073] In addition, in the above embodiment and modified examples, an example has been shown in which the judgment unit 102 judges whether or not the configuration is invalid based on whether the source IP address and destination IP address of the packet transmitted from the remote monitoring device 300, and the source IP address and destination IP address of the packet transmitted from the equipment control device 100 to the remote monitoring device 300 are global IP addresses, but which source or destination IP address is to be used for the judgment can be arbitrarily set by the user of the remote monitoring device 300.

[0074] 4 on the screen of the facility equipment control device 100. However, the present invention is not limited to this. The warning unit 103 may transmit information on the contents indicated by the warning image 600 to a preset contact address of the user of the facility equipment control device 100.

[0075] In the above embodiment, when the warning unit 103 receives a response that does not acknowledge that the remote control system has an unauthorized configuration, the control unit 104 restricts the contents that can be remotely controlled by the remote monitoring device 300, but this is not limited to the above. When the control unit 104 determines that the configuration is unauthorized, it restricts the contents that can be remotely controlled by the remote monitoring device 300. For example, when the determination unit 102 determines that the remote control system 1 has an unauthorized configuration, the control unit 104 immediately sets the operation mode of the facility equipment control device 100 to a restricted mode, and restricts the contents that can be remotely controlled.

[0076] In the above embodiment, when the warning unit 103 receives a response that does not acknowledge that the remote control system has an unauthorized configuration, the authentication unit 105 transmits to the remote monitoring device 300 a request for presentation of authentication information for remotely controlling the facility equipment control device 100 every time an instruction is received from the remote monitoring device 300, but this is not limited to the above. When the authentication unit 105 determines that the remote control system 1 has an unauthorized configuration, the authentication unit 105 transmits to the remote monitoring device 300 a request for presentation of authentication information for remotely controlling the facility equipment control device 100 every time an instruction is received from the remote monitoring device 300. For example, when the determination unit 102 determines that the remote control system 1 has an unauthorized configuration, the authentication unit 105 immediately sets the operation mode of the facility equipment control device 100 to an authentication mode, and transmits a request for presentation of authentication information every time an instruction is received from the remote monitoring device 300.

[0077] In the above embodiment, when the determination unit 102 determines that the configuration is unauthorized, the warning unit 103 warns the user of the facility equipment control device 100 that the remote control system 1 has an unauthorized configuration, but this is not limited to the above. When the determination unit 102 determines that the configuration is unauthorized, the user of the remote monitoring device 300 may specify that one of the following processes be performed: a warning by the warning unit 103, a restriction on the contents that can be remotely controlled by the control unit 104, or a request for presentation of authentication information by the authentication unit 105.

[0078] 5 is executed at the time of initial setting for communication between the facility equipment control device 100 and the remote monitoring device 300, but is not limited thereto. For example, the process may be executed at any timing designated by the user of the remote monitoring device 300. For example, the process may be executed periodically, such as once a week, or every time an instruction related to remote control is received from the remote monitoring device 300.

[0079] 5, the operation mode is set to the restriction mode or the authentication mode, but this is not limiting. The operation mode may be set to both the restriction mode and the authentication mode in step S105.

[0080] In addition, by applying an operating program that specifies the operation of the facility equipment control device 100 according to the above embodiment to an existing personal computer or information terminal device, it is also possible to cause the personal computer or information terminal device to function as the facility equipment control device 100 according to the embodiment.

[0081] Furthermore, the method of distribution of such a program is arbitrary; for example, the program may be stored on a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), or a memory card and distributed, or the program may be distributed via a communications network such as the Internet.

[0082] Various embodiments and modifications of the present disclosure are possible without departing from the broad spirit and scope of the present disclosure. The above-described embodiments are for explaining the present disclosure and do not limit the scope of the present disclosure. In other words, the scope of the present disclosure is indicated by the claims, not the embodiments. Various modifications made within the scope of the claims and the scope of the disclosure equivalent thereto are considered to be within the scope of the present disclosure. [Industrial Applicability]

[0083] The present disclosure can provide an equipment control device, a remote control system, a control method, and a program that can make the remote control system less susceptible to attacks from malicious third parties. [Explanation of symbols]

[0084] 1 remote control system, 11 processor, 12 main memory unit, 13 auxiliary memory unit, 14 communication unit, 15 input unit, 16 output unit, 17 RTC, 18 bus, 100 facility equipment control device, 101 acquisition unit, 102 judgment unit, 103 warning unit, 104 control unit, 105 authentication unit, 200 facility equipment, 300 remote monitoring device, 400 network, 500 VPN router, 600 warning image, 601 warning message, 602, 603 buttons.

Claims

1. In a remote control system in which facility equipment is remotely controlled from a remote monitoring device via a network, there is provided a facility equipment control device which controls the facility equipment in accordance with an instruction from the remote monitoring device, An acquisition means for acquiring packets transmitted and received between the remote monitoring device; a determination means for determining whether the remote control system has an illegal configuration in which a VPN router connected to the facility equipment control device is not installed, based on whether a source IP (Internet Protocol) address or a destination IP address of the acquired packet is a global IP address; a warning means for warning a user of the facility equipment control device that the remote control system has an unauthorized configuration when the remote control system is determined to have an unauthorized configuration; An equipment control device comprising:

2. the determination means determines that the configuration is unauthorized when a source IP address of a packet transmitted from the remote monitoring device among the acquired packets is a global IP address; The facility equipment control device according to claim 1 .

3. the determination means determines that the configuration is invalid when a source IP address of a packet transmitted from the facility equipment control device to the remote monitoring device among the acquired packets is a global IP address; The facility equipment control device according to claim 1 or 2.

4. the determination means determines that the configuration is unauthorized when a destination IP address of a packet transmitted from the remote monitoring device among the acquired packets is a global IP address; The facility equipment control device according to any one of claims 1 to 3.

5. and a control unit that, when it is determined that the configuration is unauthorized, limits the contents of remote control that can be performed by the remote monitoring device. The facility equipment control device according to any one of claims 1 to 4.

6. and an authentication unit configured to transmit, to the remote monitoring device, a request for presentation of authentication information for remotely controlling the facility equipment control device every time the facility equipment control device receives the instruction from the remote monitoring device when the facility equipment control device is determined to be an unauthorized configuration. The facility equipment control device according to any one of claims 1 to 5.

7. The warning means inquires of a user of the facility equipment control device whether or not the user acknowledges that the remote control system has an unauthorized configuration; When the warning means receives a response acknowledging that the remote control system has an invalid configuration, The control means does not limit the contents of the remote control that can be performed by the remote monitoring device. The facility equipment control device according to claim 5 .

8. The warning means inquires of a user of the facility equipment control device whether or not the user acknowledges that the remote control system has an unauthorized configuration; When the warning means receives a response acknowledging that the remote control system has an invalid configuration, the authentication means does not transmit a request for presentation of the authentication information to the remote monitoring device; The facility equipment control device according to claim 6.

9. The facility equipment is an air conditioner. The facility equipment control device according to any one of claims 1 to 8.

10. An equipment control device that controls equipment in accordance with instructions from a remote monitoring device, Acquire packets transmitted to and from the remote monitoring device; determining whether a remote control system that remotely controls the facility equipment has an illegal configuration in which a VPN router connected to the facility equipment control device is not installed, based on whether a source IP address or a destination IP address of the acquired packet is a global IP address; If it is determined that the remote control system has an unauthorized configuration, a user of the facility equipment control device is warned that the remote control system has an unauthorized configuration. Control methods.

11. A computer that controls equipment according to instructions from a remote monitoring device. an acquisition means for acquiring packets transmitted and received between the remote monitoring device; a determination means for determining whether a remote control system that remotely controls the facility equipment has an illegal configuration in which a VPN router connected to the computer is not installed, based on whether a source IP address or a destination IP address of the acquired packet is a global IP address; a warning means for warning a user of the computer that the remote control system is in an unauthorized configuration if the remote control system is determined to be in an unauthorized configuration; A program that functions as a

Images