Information management system, information management method, and firewall

Abstract

To provide an information management system which can sufficiently and surely control the connection of a user terminal to an apparatus and can confirm pictures or sound of the apparatus from the user terminal on the basis of safety.SOLUTION: An information management system 1 includes: a fire wall 3 connected to a network camera 2 (an apparatus) having an imaging function and a sound collecting function; and a management server 4 for performing authentication processing to authenticate a user who uses a user terminal 5 with the user terminal 5 and permitting the user terminal to connect to the network camera by the fire wall. The user terminal, which performed authentication processing with the management server, acquires media data including pictures taken by the network camera and sound collected by the network camera from the network camera permitted to be connected on the basis of the connection permission condition determined by the management server by the fire wall.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information management system. [Background technology]

[0002] For example, Patent Document 1 discloses a surveillance camera system configured to enable a client terminal (user terminal) to view images captured by a network camera. In this surveillance camera system, a client terminal that has been authenticated by a server can view images from multiple network cameras connected to the server. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Application No. 2021-2736 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional surveillance camera systems, as long as a client terminal (user terminal) was authenticated by the server, it was possible to view the images from the network camera at any time, and it was possible to view any images from multiple network cameras connected to the server. In other words, the viewing of the images from the network cameras could not be sufficiently restricted, and there was a problem with security.

[0005] The present invention provides an information management system that can sufficiently and reliably control the connection from a user terminal to a device, and can check the video and audio of the device from the user terminal while ensuring safety. [Means for solving the problem]

[0006] An information management system according to one aspect of the present invention includes a firewall connected to a device having at least one of a photographing function and a sound collecting function, and a management server that performs an authentication process between the user terminal and the management server to authenticate a user who uses the user terminal and allows the user terminal to connect to the device via the firewall. The information management system is configured so that the user terminal that has performed the authentication process with the management server can obtain, via the firewall, media data including at least one of video photographed by the device and audio collected by the device from the device that is permitted to connect based on the connection permission conditions determined by the management server.

[0007] In the above-mentioned information management system, the connection permission conditions may be determined by basic connection information preset in the management server and linkage data acquired by the management server from outside, which is information that takes precedence over the basic connection information.

[0008] In addition, WebRTC technology may be used for communication between the user terminal and the firewall, and the management server may be used as a signaling server to establish P2P communication between the user terminal and the firewall.

[0009] In addition, when establishing P2P communication between a user terminal and the firewall using WebRTC technology, the firewall may be configured to be transparent so that the user terminal can connect to the device via the firewall and so that media data from the device can be transmitted to the user terminal via the firewall, at least using information regarding the user terminal and the firewall exchanged between the user terminal and the firewall via a management server which is a signaling server.

[0010] The user terminal and firewall may also be configured to control the media channel used for transmitting and receiving media data between the devices.

[0011] In addition, the user terminal and the firewall may be capable of transmitting and receiving data other than the media data of the device between them, and may be configured to control the data channel used to transmit and receive data between them. Effect of the Invention

[0012] According to the present invention, it is possible to provide an information management system that can sufficiently and reliably control the connection from a user terminal to an equipment, and that can check the video and audio of the equipment from the user terminal while ensuring safety. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is an explanatory diagram illustrating a configuration of an information management system according to a first embodiment. [Diagram 2] 2 is a functional block diagram showing the functional configuration of a firewall in the information management system of the first embodiment. FIG. [Diagram 3] 2 is a functional block diagram showing a functional configuration of a user terminal in the information management system of the first embodiment. FIG. [Figure 4] FIG. 2 is an explanatory diagram showing a communication connection process between a user terminal and a firewall in the information management system of the first embodiment. [Diagram 5] FIG. 11 is an explanatory diagram showing the configuration of an information management system according to a second embodiment. [Figure 6] FIG. 13 is a functional block diagram showing the functional configuration of a firewall in an information management system according to a third embodiment. [Figure 7] FIG. 13 is a functional block diagram showing the functional configuration of a user terminal in an information management system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. (First embodiment) The information management system 1 of this embodiment is an example applied to a service in which parents who leave their children at a nursery school can check how their children are doing at the nursery school via a network such as the Internet.

[0015] 1, the information management system 1 includes a network camera 2 (device), a firewall 3, a management server 4, and a user terminal 5. The firewall 3 and the management server 4 are connected to each other so as to be able to communicate with each other via a network 6 such as the Internet. Similarly, the management server 4 and the user terminal 5 are connected to each other so as to be able to communicate with each other via the network 6.

[0016] The network camera 2 is a camera with a sound-collecting microphone that is installed at a predetermined location. The network camera 2 has a shooting function for shooting video and a sound collection function for collecting sound. The network camera 2 can shoot a predetermined location and collect sound around the location. In this embodiment, the network camera 2 is installed, for example, in a classroom or a playground of a nursery school.

[0017] The network camera 2 is connected to a network 6 via a firewall 3. The network camera 2 can distribute media data to the outside via the network 6. The media data includes images (video data) captured by the network camera 2 and audio (audio data) collected by the network camera 2. The network camera 2 can also be remotely controlled from the outside via the network 6.

[0018] The firewall 3 is a type of network device, and is disposed between the network 6 and the network camera 2. The firewall 3 controls communication from the outside via the network 6 to the network camera 2. The firewall 3 also controls communication from the network camera 2 to the outside via the network 6.

[0019] The firewall 3 has a transparency setting function. The firewall 3 uses the transparency setting to allow communication from a specific source to pass through and block communication from a specific source, thereby controlling communication from the outside to the network camera 2. The firewall 3 also uses the transparency setting to allow communication to a specific destination to pass through and block communication to a specific destination, thereby controlling communication from the network camera 2 to the outside.

[0020] The management server 4 is a cloud server that can be used via the network 6. The management server 4 has a function of performing an authentication process between the management server 4 and the user terminal 5 to authenticate a user who uses the user terminal 5, a function of allowing the user terminal 5 to connect to the network camera 2 via the firewall 3, and the like. The functions of the management server 4 will be described later. The management server 4 may be a virtual server such as a cloud server as in this embodiment, or may be a physical server such as a physically existing server device.

[0021] The user terminal 5 is a terminal device of a user who uses the information management system 1. The user here is, for example, a parent who leaves their child at a nursery school. The user terminal 5 has a display function (such as an LCD screen) for displaying images from the network camera 2 and a playback function (such as a speaker) for playing back audio.

[0022] The user terminal 5 may be, for example, a personal computer (PC), or a mobile terminal such as a smartphone or tablet. The user terminal 5 does not need to be a physical device, and may be a virtual device. Although only one user terminal 5 is shown in FIG. 1, the information management system 1 can actually be used with a plurality of user terminals 5.

[0023] Next, the function of the firewall 3 will be described. The firewall 3 has a control function equipped with a CPU, memory, etc. The CPU executes various processes according to computer programs (hereinafter simply referred to as programs) stored in the memory, thereby realizing various functions of the firewall 3. The firewall 3 also has a memory function for storing data and programs required for various processes by the control function, and a communication function for controlling communication regarding various information exchanged between the firewall 3 and other devices connected via the network 6.

[0024] As shown in FIG. 2, the control function of firewall 3 includes a setting management unit 301, a camera control unit 302, a video / audio receiving unit 303, a video / audio recording management unit 304, a signaling coordination unit 305, a media channel processing unit 306 and a data channel processing unit 307.

[0025] The setting management unit 301 manages information relating to the firewall 3 system (information relating to the OS (Operating System), applications, etc.) and various setting information relating to other control functions. It also updates information relating to the firewall 3 system, and registers, changes, and deletes various setting information. It also executes and manages the transparency settings of the firewall 3, retains information on transparency settings that have already been set, and deletes unnecessary transparency settings.

[0026] The camera control unit 302 controls the network camera 2 based on operation information from the user terminal 5. Specifically, it controls the zoom, pan, etc. of the network camera 2, and changes the shooting mode of the network camera 2.

[0027] The video / audio receiving unit 303 receives video / audio from the network camera 2 and provides it to a video / audio management unit 304 and a media channel processing unit 306, which will be described later.

[0028] The video / audio recording management unit 304 records the video and audio from the network camera 2 in a storage device built into the firewall 3, based on various setting information managed by the setting management unit 301 of the firewall 3 and operation information from the user terminal 5. It also manages information related to the video / audio recording, such as the identification information of the network camera 2, information that triggered recording (user identification information, etc.), and the start and end dates and times of video / audio recording.

[0029] The signaling coordination unit 305 coordinates between the firewall 3 and the management server 4 (signaling server) when performing communication connection processing between the user terminal 5 and the firewall 3 using the WebRTC (Web Real-Time Communication) technology described later.

[0030] The media channel processing unit 306 controls the media channel used for transmitting and receiving video and audio from the network camera 2 when transmitting and receiving video and audio from the network camera 2 between the firewall 3 and the user terminal 5 using WebRTC.

[0031] The data channel processing unit 307 controls the data channel used for transmitting and receiving data such as operation information other than the video and audio of the network camera 2 (for example, operation information of the network camera 2 and firewall 3), files, messages, etc., between the firewall 3 and the user terminal 5 using WebRTC.

[0032] Next, the functions of the management server 4 will be described. The management server 4 has a control function equipped with a CPU, memory, etc. The CPU executes various processes according to programs stored in the memory, and various functions of the management server 4 are realized. The management server 4 also has a memory function for storing data and programs required for various processes by the control function, and a communication function for controlling communication regarding various information exchanged with other devices, etc. connected via the network 6.

[0033] As shown in FIG. 1, the control function of the management server 4 includes a connection control unit 41, a data linking unit 42, and a setting management unit 43. The connection control unit 41 has an authentication function for performing authentication processing with the user terminal 5. The authentication processing here includes authentication of the user who uses the user terminal 5 and authentication of the user terminal 5 itself, and may perform only authentication of the user, or may perform both authentication of the user and authentication of the user terminal 5. The authentication processing performed with the user terminal 5 may use an advanced authentication method that is considered difficult to spoof, such as two-step authentication or multi-factor authentication.

[0034] The connection control unit 41 also has a connection control function that controls the connection of the user terminal 5 that has been authenticated by the user to the network camera 2 via (through) the firewall 3. Specifically, the connection control unit 41 determines whether or not to permit the user terminal 5 that has been authenticated by the user to connect to the network camera 2 via (through) the firewall 3, based on a connection permission condition determined in the setting management unit 43, which will be described later.

[0035] The data linking unit 42 has a function of acquiring linking data required for connection permission (connection permission conditions) of the user terminal 5 in the connection control unit 41 from outside, and registering / updating the acquired linking data in the setting management unit 43 .

[0036] The setting management unit 43 is necessary for the connection control unit 41 to determine whether or not to allow the user terminal 5 to connect, and has the function of managing setting information that sets pre-set basic connection information, linkage data obtained from outside by the data linkage unit 42, and setting information that sets the relationship between the firewall 3 and the device information connected to the firewall 3, etc.

[0037] Here, the basic connection information is static information that is set in advance by an administrator of the information management system 1 using a management terminal device. The basic connection information includes information on the days and time periods when the user terminal 5 can connect to the network camera 2 via the firewall 3 and check the video and audio of the network camera 2.

[0038] The association data is information that takes precedence over the basic connection information, and is dynamic information that is different from the static basic connection information. The association data includes information on the date when the user can connect, connection start time, connection end time information, information on disallowing connection of a device that the user is permitted to connect to in the basic connection information and its expiration date (the expiration date may be indefinite), information on allowing connection of a device that the user is prohibited from connecting to in the basic connection information and its expiration date (the expiration date may be indefinite), information on invalidating user information and invalidation start date and time information, information on enabling user information and validity start date and time information, information on invalidating device information and invalidation start date and time information, information on enabling device information and validity start date and time information, information on invalidating firewall 3 information and invalidation start date and time information, etc.

[0039] The configuration information also includes information identifying the firewall 3, an authentication method for authenticating the firewall 3 by the management server 4, information identifying the port connecting a device to the firewall 3, information identifying the device connected to the firewall 3, information identifying the type of device connected to the firewall 3, information on the type of video, audio, etc. available for each device type, information identifying the device connected to each port of the firewall 3, etc.

[0040] Next, the functions of the user terminal 5 will be described. The user terminal 5 has a control function equipped with a CPU, memory, etc. The CPU executes various processes according to programs stored in the memory, thereby realizing various functions of the user terminal 5. The user terminal 5 also has a memory function for storing data and programs required for various processes by the control function, and a communication function for controlling communication regarding various information exchanged with other devices, etc. connected via the network 6.

[0041] 3, the control function of the user terminal 5 has a setting management unit 501, a camera operation unit 502, a video / audio confirmation unit 503, a video / audio recording operation unit 504, a signaling coordination unit 505, a media channel processing unit 506, and a data channel processing unit 507. In this embodiment, the control function of the user terminal 5 is realized based on a program including a web application using a web browser.

[0042] The setting management unit 501 manages various setting information related to each function of the Web application and other control functions. It also manages copies of setting information related to the firewall 3 system (to confirm, register, change, delete, etc., setting information from the Web application). It also manages information related to the firewall 3 system (information about the OS, applications, etc.).

[0043] The camera operation unit 502 remotely controls the network camera 2 connected to the firewall 3. Specifically, it controls the zoom, pan, etc. of the network camera 2, and changes the shooting mode of the network camera 2.

[0044] The video / audio confirmation unit 503 provides a function to display real-time video and play audio from the network camera 2 connected to the firewall 3 and to check the video / audio. In addition, by operating the video / audio operation unit 504, a function to display recorded video and play recorded audio and to check the video / audio is provided.

[0045] The video / audio recording operation unit 504 performs operations such as recording video and audio from the network camera 2 to a storage device built into the firewall 3, displaying a list of recorded video and audio data, and selecting, playing, and deleting video and audio data.

[0046] The signaling coordination unit 505 coordinates between the user terminal 5 and the management server 4 (signaling server) when performing communication connection processing between the user terminal 5 and the firewall 3 using the WebRTC (Web Real-Time Communication) technology described later.

[0047] The media channel processing unit 506 controls the media channel used for transmitting and receiving video and audio from the network camera 2 when transmitting and receiving video and audio from the network camera 2 between the firewall 3 and the user terminal 5 using WebRTC.

[0048] The data channel processing unit 507 controls the data channel used to send and receive data such as operation information other than the video and audio of the network camera 2 (for example, operation information of the network camera 2 and firewall 3), files, messages, etc., between the firewall 3 and the user terminal 5 using WebRTC.

[0049] The administrator of the information management system 1 can use a management terminal device to appropriately maintain the information on the network camera 2 and the firewall 3, and to maintain the information on users.

[0050] Next, a flow of using the information management system 1 will be described. As a prerequisite for using the information management system 1, the above-mentioned basic connection information and setting information are preset in the management server 4, and linkage data is imported from the outside as necessary. Also, the firewall 3 is authenticated in advance by the management server 4. The authentication process of the firewall 3 by the management server 4 can use advanced authentication methods such as two-step authentication and multi-factor authentication.

[0051] First, a user who wishes to use the information management system 1 (to check the video and audio of the network camera 2) accesses the management server 4 using the user terminal 5. The management server 4 performs an authentication process with the user terminal 5. Specifically, the management server 4 authenticates the user who uses the user terminal 5 based on the setting information.

[0052] The management server 4 then determines whether or not to permit a user terminal 5 used by a user who has been authenticated by the management server 4 and is logged in to the management server 4 to connect to the network camera 2 via the firewall 3. This determination is made based on the basic connection information registered in the management server 4 and the connection permission conditions defined by the linkage data.

[0053] When the management server 4 permits the connection of the user terminal 5, it performs a communication connection process between the user terminal 5 and the firewall 3. In this embodiment, WebRTC (Web Real-Time Communication) technology is used for the communication between the user terminal 5 and the firewall 3. Specifically, P2P (Peer to Peer) communication is established between the user terminal 5 and the firewall 3 with the management server 4 as a signaling server. The procedure of the communication connection process will be described below.

[0054] 4, in step S11, the user terminal 5 transmits an Offer SDP (Session Description Protocol) to the management server 4. In step S12, the management server 4 transmits the Offer SDP to the firewall 3. The firewall 3 registers the Offer SDP.

[0055] Next, in step S13, the firewall 3 transmits the Answer SDP to the management server 4. In step S14, the management server 4 transmits the Answer SDP to the user terminal 5. The user terminal 5 registers the Answer SDP. As a result, the user terminal 5 and the firewall 3 exchange codec information available on each device, and network information such as the IP addresses and port numbers of each device.

[0056] Next, in step S15, the user terminal 5 transmits an ICE (Interactive Connectivity Establishment) candidate to the management server 4. In step S16, the management server 4 transmits the ICE candidate to the firewall 3.

[0057] Next, in step S17, the firewall 3 transmits the ICE candidate to the management server 4. In step S18, the management server 4 transmits the ICE candidate to the user terminal 5. As a result, the user terminal 5 and the firewall 3 exchange candidate information for paths that allow continued communication.

[0058] Next, in step S19, the firewall 3 performs a transparent setting using the SDP and ICE candidate exchanged between the user terminal 5 and the firewall 3. Specifically, the firewall 3 performs a transparent setting so that the user terminal 5 can connect to the network camera 2 via (transparent) the firewall 3, and so that video and audio of the network camera 2 can be transmitted to the user terminal 5 via (transparent) the firewall 3.

[0059] Next, in step S20, P2P communication is established between the user terminal 5 and the firewall 3. That is, a secure communication path that allows continuous communication is established between the user terminal 5 and the firewall 3 without going through the management server 4. As a result, a secure communication path that allows continuous communication is established between the user terminal 5 and the network camera 2 via the firewall 3.

[0060] The user then accesses the network camera 2 from the user terminal 5 via the firewall 3 and requests video and audio from the network camera 2. The network camera 2 transmits the captured video and collected audio to the user terminal 5 via the firewall 3. The user terminal 5 displays the video received from the network camera 2 and plays back the audio. This allows the user to obtain and check the video and audio from the network camera 2 in real time from the user terminal 5. The user can also obtain and check recorded video and audio.

[0061] Thereafter, if the communication is explicitly disconnected by the user terminal 5, it is determined that the user has finished checking the video and audio from the network camera 2, and the transparency setting of the firewall 3 in step S19 is deleted. This blocks the communication path between the user terminal 5 and the firewall 3. The same applies when communication is explicitly disconnected by the firewall 3 or the management server 4.

[0062] In addition, the transparency setting of the firewall 3 in step S19 is also deleted if an unintended communication interruption occurs due to a communication failure or the like and communication is not restored even after a certain period of time (e.g., 5 minutes) has passed, or if the operation of the user terminal 5, firewall 3 or management server 4 stops due to a dead battery or power outage, causing communication to be interrupted.

[0063] Next, the effects of the information management system 1 of this embodiment will be described. According to the information management system 1 of this embodiment, a user terminal 5 (user) that has performed authentication processing with the management server 4 (authentication of the user by the management server 4) is configured to be able to obtain, via the firewall 3, video and audio (media data) from a network camera 2 that has been permitted to connect based on the connection permission conditions set by the management server 4.

[0064] That is, the user terminal 5 (user) cannot view the video and audio of the network camera 2 unless the user terminal 5 (user) is authenticated by the management server 4 and permitted to connect to the network camera 2 based on the connection permission conditions. This allows sufficient and reliable control of the connection from the user terminal 5 to the network camera 2. Furthermore, by using the firewall 3 as an intermediary, the user terminal 5 permitted to connect can view the video and audio of the network camera 2 in a secure environment.

[0065] In the information management system 1, the connection permission conditions are determined by basic connection information preset in the management server 4 and associated data acquired by the management server 4 from an external source, which is information prioritized over the basic connection information. Therefore, the connection permission conditions can be appropriately changed using various elements (associated data). This allows for more precise control of the connection from the user terminal 5 to the network camera 2.

[0066] Furthermore, WebRTC technology is used for communication between the user terminal 5 and the firewall 3, and P2P communication is established between the user terminal 5 and the firewall 3 with the management server 4 acting as a signaling server. Therefore, a secure communication path that allows continuous communication between the user terminal 5 and the firewall 3 can be established without placing a load on the management server 4.

[0067] Furthermore, when establishing P2P communication between the user terminal 5 and firewall 3 using WebRTC technology, the firewall 3 uses information about the user terminal 5 and firewall 3 exchanged between the user terminal 5 and firewall 3 via the management server 4, which is a signaling server, to set transparency so that the user terminal 5 can connect to the network camera 2 via the firewall 3 and so that video and audio from the network camera 2 can be transmitted to the user terminal 5 via the firewall 3. Therefore, the transparency setting of the firewall 3 can be easily and reliably performed.

[0068] In this embodiment, the transparency setting of the firewall 3 is performed using information about the user terminal 5 and the firewall 3 exchanged between the user terminal 5 and the firewall 3 via the management server 4. However, in addition to this information, information necessary for the transparency setting of the firewall 3, such as information about the user terminal 5 and the firewall 3 managed by the management server 4, may also be supplemented.

[0069] In addition, the user terminal 5 and the firewall 3 are configured to control a media channel used for transmitting and receiving between them the video and audio (media data) of the network camera 2. Therefore, the transmission and reception of media data between the user terminal 5 and the firewall 3 using WebRTC can be performed smoothly.

[0070] In addition, the user terminal 5 and the firewall 3 are capable of transmitting and receiving data (operation information, files, messages, etc. of the network camera 2 and firewall 3) other than the video and audio (media data) of the network camera 2 between them, and are configured to control the data channel used for transmitting and receiving data between them. Therefore, data can be transmitted and received smoothly between the user terminal 5 and the firewall 3 using WebRTC.

[0071] In addition, the firewall 3 can achieve the following effects: Conventional firewalls control communications based on the contents of the communications (packets, etc.) and allow permitted communications to pass through the firewall, but if communications are tampered with, it can be difficult to determine whether the communication source or destination is genuine, making so-called "spoofing" possible.

[0072] However, in this embodiment, the management server 4 authenticates the firewall 3 in advance, and also authenticates the user who uses the user terminal 5. This ensures that the firewall 3, which is the source of the video and audio from the network camera 2, the user terminal 5, which is the destination, and the user who uses the user terminal are genuine, and "spoofing" can be prevented by controlling based on the content of the communication between the user terminal 5 and the firewall 3.

[0073] Furthermore, according to the information management system 1 of this embodiment, a service can be provided that allows parents who leave their children at a nursery school to check how their children are doing at the nursery school via a network such as the Internet. This can solve the following problems:

[0074] Initially, the nursery school offered a service that allowed users to check the video and audio from network camera 2 installed within the nursery school only on the nursery school's business days and during business hours. However, when it was discovered that User A was checking the video and audio from network camera 2 within the nursery school even though his / her child was absent from the nursery school, other users expressed concern. Therefore, it was decided to restrict the checking of the video and audio from network camera 2 as follows.

[0075] A condition for a user to be able to check the video and audio from network camera 2 is decided to limit this to only while the user's child is in nursery school. Specifically, the user card is scanned when the user's child begins and ends daycare, and the time is recorded. By uploading the user's identification ID and the data on the start and end of daycare as linked data to management server 4, the user can check the video and audio from network camera 2 only "from the start to the end of daycare." If the user's child is absent from daycare, the user's identification ID and the data on the start and end of daycare are not uploaded to management server 4 as linked data, and the user cannot use the service. The service also becomes unavailable if the user withdraws from daycare.

[0076] Second embodiment This embodiment is an example in which the configuration of the information management system 1 is changed, as shown in Fig. 5. Note that a description of the configuration and the effects similar to those of the first embodiment will be omitted.

[0077] The information management system 1 includes a plurality of network cameras 2 and a plurality of firewalls 3. In this embodiment, as an example, a configuration including three network cameras 2 and three firewalls 3 connected to the network cameras 2 is shown. In such a configuration, for example, when the management server 4 permits the user terminal 5 to connect to the plurality of network cameras 2, the plurality of connectable network cameras 2 are displayed on the user terminal 5, and the user can select the network camera 2 to connect to.

[0078] Regarding the information management system 1 of this embodiment, taking an example of a service provided to a company, three network cameras 2 are installed in each department (head office, research laboratory, factory) of X company. Employee Y, who is a user, belongs to the research laboratory, but is a manager and spends a lot of time at the head office for management meetings, etc., so he is able to check the state of his workplace through the video and audio of the network camera 2 installed in the research laboratory. For example, if an employee is working overtime until late at night, the employee may be interviewed about the work situation and encouraged to correct the illegal working practices.

[0079] For example, if employee Y is transferred to the head office due to personnel changes, employee Y will no longer be able to view the video and audio from network camera 2 installed in the research lab, but will be able to view the video and audio from network camera 2 installed in the head office. Also, if employee Y resigns from company X, he or she will no longer be able to use company X's system.

[0080] This is because the data in the setting management section 43 of the management server 4 is updated by uploading linked data (data that generates information on the network cameras 2 that can be used for each employee of Company X) that is generated based on the personnel transfer data of Company X.

[0081] Third embodiment This embodiment is an example in which the configuration of the information management system 1 is changed, as shown in Figures 6 and 7. Note that a description of the configuration and effects similar to those of the first embodiment will be omitted.

[0082] As shown in FIG. 6, the firewall 3 further includes an AI processing unit 308, a firewall status management unit 309, and an IoT cooperation unit 310.

[0083] The AI ​​processing unit 308 performs AI (Artificial Intelligence) processing according to a learning model on the video and audio (including video and audio that have been recorded) of the network camera 2. The setting management unit 301 manages information related to the learning model required for the AI ​​processing of the AI ​​processing unit 308, and registers, updates, and deletes the learning model.

[0084] The firewall status management unit 309 acquires error log information when an error occurs in each function of the firewall 3. In addition, upon acquiring the error log information, the firewall status management unit 309 transmits to the management server 4, in addition to the "error log information", the "date, time, minute, and second" of the error occurrence, the "identification information of the firewall" where the error occurred, the "function identifier of the firewall" where the error occurred, and the like.

[0085] The IoT coordinating unit 310 controls communication between the firewall 3 and an IoT device (connected device 30) connected to the firewall 3. Specifically, the IoT coordinating unit 310 receives information acquired by the IoT device from the IoT device, and transmits operation information of the IoT device received from the user terminal 5 to the IoT device.

[0086] As shown in FIG. 7, the user terminal 5 further includes an AI collaboration unit 508, an IoT information confirmation unit 509, and an IoT operation unit 510.

[0087] The AI ​​collaboration unit 508 displays an alert detected by the AI ​​processing of the AI ​​processing unit 308 of the firewall 3 on the screen of the Web application. It also displays and plays, on the Web application, video and audio based on the AI ​​processing result of the AI ​​processing unit 308 of the firewall 3. It also provides a function for performing operations related to the AI ​​processing of the AI ​​processing unit 308 of the firewall 3 from the screen of the Web application.

[0088] The IoT information confirmation unit 509 displays on the screen of the Web application information acquired from the IoT device (connected device 30) connected to the firewall 3. It also displays on the screen of the Web application information related to the occurrence of an error in each function detected by the firewall status management unit 309 of the firewall 3. If necessary, it also displays error log information and the like.

[0089] The IoT operation unit 510 provides a function for operating an IoT device (connected device 30) connected to the firewall 3 from a Web application screen.

[0090] Next, a description will be given of an example of use of the data channels (the data channel processing unit 307 of the firewall 3 and the data channel processing unit 507 of the user terminal 5) in the information management system 1 having the above configuration.

[0091] <Data channel usage example 1> As described in the first embodiment above, the network camera 2 can be remotely controlled by transmitting operation information of the network camera 2 from the user terminal 5 to the firewall 3. For example, the zoom, pan, etc. of the network camera 2 can be controlled, and the shooting mode of the network camera 2 can be changed.

[0092] <Data channel usage example 2> The system administrator can transfer program files, etc. for updating applications in the firewall 3 from the user terminal 5 to the firewall 3 and perform operations such as starting up the program files, etc. In addition, the system administrator can remotely change the settings of the firewall 3 from the user terminal 5.

[0093] <Data channel usage example 3> If a temperature sensor, GPS, etc. are installed inside the firewall 3, when checking the video from the network camera 2 on the user terminal 5, the temperature, location information, etc. of the firewall 3 can also be checked. Furthermore, if an external sensor (connection device 30) is connected to the firewall 3, the information of the external sensor connected to the firewall 3 can be checked from the user terminal 5. Furthermore, if the external sensor detects some information (for example, a door has been opened illegally), an alert can be sent from the firewall 3 to the user terminal 5 to notify the user.

[0094] <Data channel usage example 4> When a device (connection device 30) such as a robot arm is connected to the firewall 3, the user can remotely control the device such as a robot arm while checking the video of the network camera 2 from the user terminal 5.

[0095] <Data channel usage example 5> In the firewall 3, the video of the network camera 2 is analyzed by AI processing, and if any information (for example, a suspicious person) is detected in the video of the network camera 2, an alert can be sent from the firewall 3 to the user terminal 5 to notify the user. In addition to notifying the user of an alert, it is also possible to operate the connection device 30 connected to the firewall 3 in accordance with predetermined rules based on the content detected by the AI ​​processing.

[0096] (Other embodiments) The present invention is not limited to the above-described embodiment, and it goes without saying that the present invention can be embodied in various forms without departing from the scope of the present invention.

[0097] (1) In the above embodiment, the network camera 2 is used as a device having at least one of a photographing function and a sound collecting function, but various other devices having a photographing function and a sound collecting function may be used. Also, the network camera 2 (camera with a sound collecting microphone) which is a device having both a photographing function and a sound collecting function is used, but a device having only a photographing function or only a sound collecting function may be used.

[0098] (2) In the above embodiment, it was made possible to check both the video and audio from the network camera 2 from the user terminal 5. However, it may also be possible to make it possible to check, for example, only the video from a device such as a network camera, or only the audio.

[0099] (3) In the above embodiment, the firewall 3 is configured to have a built-in storage device with video and audio recording capabilities to record and save the video and audio from the network camera 2. However, for example, the network camera or other device may have video and audio recording capabilities, or a recording device (recorder) with video and audio recording capabilities may be placed between the network camera or other device and the firewall.

[0100] For example, video and audio captured by a network camera or other device may be recorded by a recording device, and the recorded video and audio may be transmitted to a user terminal via (through) a firewall. This configuration can solve problems with a single device such as a network camera, such as insufficient video and audio transmission capacity when multiple users connect at the same time, or limitations on the number of users that can use the device.

[0101] (4) In the above embodiment, the firewall 3 is configured as an independent device, and the network camera 2 and the firewall 3 are configured as separate entities, but for example, the firewall function may be built into a device such as a network camera or the above-mentioned recording device, and the two may be configured as an integrated whole. Also, the firewall function may be built into a network device such as a router that connects different networks to each other.

[0102] (5) The function of one component in the above embodiments may be distributed among multiple components, or the functions of multiple components may be integrated into one component. Also, a part of the configuration of the above embodiments may be omitted. Also, at least a part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments. All aspects included in the technical idea identified from the wording of the claims are embodiments of the present invention. [Explanation of symbols]

[0103] 1...information management system, 2...network camera, 3...firewall, 4...management server, 5...user terminal, 6...network, 41...connection control unit, 42...data linking unit, 43...setting management unit

Claims

1. An information management system, comprising: A firewall connected to an IoT device; A management server that permits a device that is to connect to the IoT device to connect to the IoT device through the firewall based on a predetermined connection permission condition; The WebRTC technology is used for communication between the device and the firewall, and the management server is used as a signaling server to establish P2P communication between the device and the firewall; The firewall has a transparency setting function for performing transparency setting using information on the device and the firewall exchanged between the device and the firewall via the management server, which is a signaling server, so that the device can be connected to the IoT device via the firewall and data can be transmitted and received between the device and the IoT device via the firewall, when P2P communication between the device and the firewall is established using WebRTC technology. Information management system.

2. An information management system as described in Claim 1, wherein the management server has an authentication function that performs authentication processing between the management server and the device.

3. The information management system of claim 1, wherein the firewall is configured to control communication between the IoT devices.

4. The information management system described in claim 1, configured to enable remote operation of the IoT device by transmitting operation information of the IoT device from the device to the IoT device via the firewall.

5. An information management method, comprising: a connection permission step in which a management server permits a device that is to connect to an IoT device connected to a firewall to connect to the IoT device through the firewall based on a connection permission condition that is determined; a communication establishing step of establishing P2P communication between the device and the firewall using WebRTC technology with the management server as a signaling server; In the communication establishment step, at least information regarding the device and the firewall exchanged between the device and the firewall via the management server, which is a signaling server, is used to set the firewall to be transparent so that the device can be connected to the IoT device via the firewall and so that data can be transmitted and received between the device and the IoT device via the firewall. Information management method.

6. A firewall connected to an IoT device, A management server that permits a device that is to connect to the IoT device through the firewall based on a predetermined connection permission condition is set as a signaling server, and when establishing P2P communication between the device and the firewall using WebRTC technology, the management server has a transparency setting function that performs transparency setting so that the device can connect to the IoT device through the firewall and so that data can be sent and received between the device and the IoT device through the firewall, using at least information about the device and the firewall exchanged between the device and the firewall through the management server that is a signaling server. Firewall.

Images