JP2017211850A - Data transmission/reception method and sensing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make data secret with a small processing burden.SOLUTION: When various types of data are stored in a packet and communicated between a sensor terminal 10 and a processing device 20 connected via a communication network NW, a transmission side among the sensor terminal 10 and the processing device 20 partially encrypts data on a sensor value or setting value in the packet and transmits the resultant packet, and a reception side partially decrypts the encrypted data in the received packet.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a data transmission / reception technique for transmitting / receiving various data in packets between a sensor terminal and a processing device via a communication network.

The sensor value collection system is a system that collects data from sensors installed at remote locations on a server using a communication network.For the purpose of improving business efficiency, improving serviceability, and ensuring safety and security, Various services such as remote meter reading, vending machine inventory management, truck delivery management, greenhouse temperature monitoring, and substation equipment monitoring are being developed.
In addition, energy management systems for realizing efficient energy consumption by using sensor information such as current sensor, temperature sensor, humidity sensor, illuminance sensor, human sensor etc. due to the growing awareness of energy saving in general households It has been devised.
In recent years, studies on health care and watching using human biological information have been conducted.

  In such a system, in order to ensure security, it is necessary to confirm that the sensor terminal accessing the network is valid or to conceal the sensor value depending on the application. For example, in personal computers and smartphones, mutual authentication using electronic certificates and encrypted communication using private key encryption are performed (see, for example, Non-Patent Document 1).

  FIG. 8 is a sequence diagram showing conventional encrypted communication. FIG. 9 is a configuration example of packets exchanged by conventional encrypted communication. In conventional encrypted communication, the processing device encrypts the entire packet and transmits it to the sensor terminal. When the sensor terminal receives the packet, it decodes the entire packet, interprets the contents of the packet, and acquires the sensor value. The sensor terminal packetizes the acquired sensor value and then encrypts the entire packet and transmits it to the processing device. When the processing device receives the packet, it decodes the entire packet and interprets the contents of the packet, and thereafter repeats these processes between the processing device and the sensor terminal.

"Basics of Network Learning by Illustration: SSL", Nikkei NETWORK, June 2007, page 78

  However, in such a conventional technique, a general sensor terminal is required to have low power consumption and low cost. Therefore, hardware resources such as CPU performance and memory are limited, and encryption / decryption is secret. Processing could not be performed at a practical speed. An increase in processing time increases the operating time of the terminal, leading to an increase in power consumption.

  An object of the present invention is to provide a data transmission / reception technique capable of concealing data with a small processing load.

  In order to achieve such an object, the data transmitting / receiving method according to the present invention stores various data in a packet and transmits / receives between the sensor terminal and the processing device connected via the communication network. A data transmission / reception method used, wherein a transmission side partially encrypts and transmits data related to a sensor value or a setting value in the packet, and a reception side is encrypted in the received packet A receiving step of partially decoding the data.

  Also, in one configuration example of the data transmission / reception method according to the present invention, the transmission step adds a check code calculated for the entire packet before the encryption to the packet after the encryption. In the transmission and reception step, the check code added to the received packet is checked against the check code calculated for the entire packet after the decoding.

  In addition, in the above-described configuration example of the data transmission / reception method according to the present invention, the reception step should be executed according to the terminal ID of the sensor terminal that transmits / receives the packet and the reception of the packet as a response regarding the received packet. A response packet composed of a processing code indicating processing is returned.

  Also, one configuration example of the data transmission / reception method according to the present invention is such that when the reception step performs the decoding, the plurality of received packets are collectively decoded.

  Also, in one configuration example of the data transmission / reception method according to the present invention, in the transmission step, a terminal ID of a sensor terminal that transmits / receives the packet among the packets is partially encrypted and transmitted. .

  The sensing system according to the present invention is a sensing system that collects sensor values detected by a sensor terminal by a processing device via a communication network, and stores the sensor values in a packet and performs the processing from the sensor terminal. At the time of transmission to the apparatus, transmission is performed using any of the data transmission / reception methods described above.

  According to the present invention, only data relating to sensor values or setting values to be concealed is encrypted in the packet, and other information, specifically, additional information such as a terminal ID and a processing code is encrypted. It will be sent as plain text without. Therefore, it is possible to reduce the burden of concealment processing related to encryption / decryption, and even a sensor terminal in which hardware resources such as CPU performance and memory are restricted due to low power consumption and cost reduction. Therefore, it is possible to conceal data with a small processing load.

It is a block diagram which shows the structure of a sensing system. It is a structural example of a packet. It is a sequence diagram which shows sensor value transmission operation | movement. It is a sequence diagram which shows setting value transmission operation. It is a sequence diagram which shows sensor value autonomous transmission operation | movement. It is a sequence diagram which shows a sensor value one-way transmission operation. It is a sequence diagram which shows packet authentication operation | movement. It is a sequence diagram which shows the conventional encryption communication. It is a structural example of the packet exchanged by the conventional encryption communication.

Next, an embodiment of the present invention will be described with reference to the drawings.
[Sensing system]
First, a sensing system 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of the sensing system.

  In the sensing system 1, a plurality of sensor terminals 10 are connected to a processing device 20 via a communication network NW, and sensor values detected by the sensor terminals 10 are collected by the processing device 20 via the communication network NW. System.

The sensor terminal 10 stores the sensor value detected by the sensor in a packet and transmits the data related to the sensor value in the packet partially when transmitting the packet to the processing device 20 via the communication network NW. Have.
The processing device 20 has a function of partially decrypting encrypted data among packets received via the communication network NW.

  As shown in FIG. 1, the sensor terminal 10 stores a sensor 11 that detects a physical quantity related to a target as a sensor value, a secret processing unit 12 that partially encrypts / decrypts data stored in the packet, and a packet. It is comprised from the memory | storage part 13, the communication I / F part 14 which transmits / receives a packet between the processing apparatuses 20 via the communication network NW, and the terminal control part 15 which controls operation | movement of the sensor terminal 10 whole. As a specific encryption / decryption method in the concealment processing unit 12, a general method may be used.

FIG. 2 is a configuration example of a packet.
A request packet that requests the sensor terminal 10 to transmit a sensor value from the processing device 20 and a dummy response packet that is returned when responding to the setting packet and the call packet are the terminal ID of the sensor terminal 10 that transmits and receives these packets. And processing codes indicating processing to be executed in response to reception of these packets.

In addition, a response packet that is sent back in response to a request packet, or a call packet that autonomously transmits a sensor value from the sensor terminal 10 to the processing device 20 includes a terminal ID, a processing code, and an encrypted sensor value. It is configured.
A setting packet for transmitting a setting value from the processing device 20 to the sensor terminal 10 includes a terminal ID, a processing code, and an encrypted setting value.

  Therefore, for the response packet, the call packet, and the setting packet, only the data consisting of the sensor value and the setting value is encrypted. For the other information, specifically the incidental information such as the terminal ID and the processing code, It will be sent as plain text without encryption.

[Sensor value transmission operation]
Next, a sensor value transmission operation for transmitting the sensor value detected by the sensor terminal 10 from the sensor terminal 10 to the processing device 20 in the sensing system 1 according to the present embodiment will be described with reference to FIG. . FIG. 3 is a sequence diagram illustrating the sensor value transmission operation.

  When the communication control unit 14 receives the request packet from the processing device 20 through the communication I / F unit 14 (step 100), the terminal control unit 15 of the sensor terminal 10 confirms that the terminal ID included in the request packet matches its own terminal ID. Then, according to the processing code included in the request packet, the sensor value is acquired from the sensor 11 and stored in the response packet (step 101), and only the sensor value of the response packet is partially encrypted by the concealment processing unit 12. (Step 102), and transmitted from the communication I / F unit 14 to the processing device 20 (Step 103).

  Thus, after returning the response packet from the sensor terminal 10 in response to the request packet transmitted from the processing device 20 is repeated a plurality of times, the processing device 20 detects the sensor value included in the received plurality of response packets. Are collectively decoded (step 104), and the series of sensor value transmission operations is terminated.

  Therefore, in the sensor value transmission operation, only the sensor value included in the response packet is encrypted, and the terminal ID and the processing code included in the request packet and the response packet are exchanged in plain text. . For this reason, compared with the case where the whole packet is encrypted, the processing load and the processing time can be reduced, and the data concealment regarding the sensor value can be realized by a simple process.

[Set value transmission operation]
Next, referring to FIG. 4, in the sensing system 1 according to the present embodiment, a setting value transmission operation for transmitting a setting value for setting a processing operation of the sensor terminal 10 from the processing device 20 to the sensor terminal 10. Will be described. FIG. 4 is a sequence diagram showing a set value transmission operation.

When transmitting the setting value in the setting packet, the processing device 20 partially encrypts only the setting value in the setting packet (step 200), and then transmits the setting packet to the sensor terminal 10 (step 201).
The terminal control unit 15 of the sensor terminal 10 confirms the match between the terminal ID included in the setting packet and its own terminal ID when the communication I / F unit 14 receives the setting packet from the processing device 20 (step 201). After that, a dummy response packet including its own terminal ID and processing code is transmitted according to the processing code included in the setting packet (step 202).

  Thus, after the return of the dummy response packet from the sensor terminal 10 according to the setting packet transmitted from the processing device 20 is repeated a plurality of times, the terminal control unit 15 of the sensor terminal 10 receives the received plurality of settings. The set values included in the packet are collectively decoded by the concealment processing unit 12 (step 203), and the obtained plurality of set values are collectively set in the storage unit 13 (step 204).

  Therefore, in the setting value transmission operation, only the setting value included in the setting packet is encrypted, and the terminal ID and processing code included in the setting packet and the dummy response packet are exchanged in plain text. Become. For this reason, it is possible to reduce the processing load and the processing time as compared with the case of encrypting the entire packet, and it is possible to realize data concealment regarding the set value with a simple process.

[Sensor value autonomous transmission operation]
Next, referring to FIG. 5, in the sensing system 1 according to the present embodiment, sensor value autonomous transmission for autonomously transmitting the sensor value detected by the sensor terminal 10 from the sensor terminal 10 to the processing device 20. The operation will be described. FIG. 5 is a sequence diagram showing the sensor value autonomous transmission operation.

  The terminal control unit 15 of the sensor terminal 10 acquires the sensor value from the sensor 11 and stores it in the call packet in response to the arrival of the transmission timing measured by itself (step 300), and only the sensor value of the call packet is stored. After partial encryption by the confidential processing unit 12 (step 301), the data is transmitted from the communication I / F unit 14 to the processing device 20 (step 302).

  When receiving the call packet from the sensor terminal 10 (step 302), the processing device 20 determines the terminal ID and the process code of the sensor terminal 10 that is the transmission source of the call packet according to the process code included in the call packet. The dummy response packet including it is returned (step 303).

  In this manner, after the return of the dummy response packet from the processing device 20 according to the call packet transmitted from the sensor terminal 10 is repeated a plurality of times, the processing device 20 is included in the received plurality of call packets. The sensor values are collectively decoded (step 304), and the series of sensor value autonomous transmission operations is terminated.

  Usually, the timing and the period at which the sensor value is detected by the sensor terminal 10 are set separately according to the characteristics of the sensor value and the event to be detected. According to the autonomous transmission operation, the transmission timing of the call packet is managed by each sensor terminal 10, so that it is not necessary to manage the request packet transmission timing to each sensor terminal 10 in the processing device 20. Therefore, as compared with the sensor value transmission operation of FIG. 3 described above, the processing load and processing time of the processing device 20 can be reduced.

[Sensor value one-way transmission operation]
Next, referring to FIG. 6, in the sensing system 1 according to the present embodiment, a sensor for autonomously transmitting the sensor value detected by the sensor terminal 10 from the sensor terminal 10 to the processing device 20 in one direction. A value one-way transmission operation will be described. FIG. 6 is a sequence diagram illustrating a sensor value one-way transmission operation.

  The terminal control unit 15 of the sensor terminal 10 acquires the sensor value from the sensor 11 and stores it in the call packet in response to the arrival of the transmission timing measured by itself (step 400), and only the sensor value of the call packet is stored. After partial encryption by the confidential processing unit 12 (step 401), the data is transmitted from the communication I / F unit 14 to the processing device 20 (step 402).

  When receiving a call packet from the sensor terminal 10 (step 402), the processing device 20 partially decodes the sensor value included in the received call packet (step 403) and transmits a series of sensor value one-way transmissions. End the operation.

  The sensor value detected by the sensor terminal 10 includes a sensor value that should be detected in response to the occurrence of an arbitrary event, not periodically. According to the sensor value one-way transmission operation, the processing device 20 sequentially decodes the call packets from the sensor terminal 10 individually, not collectively, so that the sensor terminal 10 discretely responds to any event occurrence. In the case of detecting the sensor value, it can be efficiently collected.

[Packet authentication operation]
Next, with reference to FIG. 7, the packet authentication operation | movement for authenticating the content of the packet exchanged between the sensor terminal 10 and the processing apparatus 20 in the sensing system 1 concerning this Embodiment is demonstrated. FIG. 7 is a sequence diagram showing a packet authentication operation. Here, a packet authentication operation in the case of transmitting a response packet including an encrypted sensor value from the sensor terminal 10 to the processing device 20 will be described as an example. However, the present invention is not limited to this, and includes encrypted data. It can also be applied to call packets and setting packets.

  As shown in FIG. 7A, the terminal control unit 15 of the sensor terminal 10 serving as the response packet transmission side transmits a response packet including the encrypted sensor value, before the sensor value is encrypted. A check code is calculated for the entire packet, and the obtained check code is added to the response packet after encryption and transmitted to the processing device 20. At this time, a general method such as CRC or BCC may be used as a check code calculation method.

  On the other hand, as shown in FIG. 7B, the processing device 20 on the receiving side of the response packet receives the response packet including the encrypted sensor value, and the encrypted sensor value of the response packet is received. After partial decoding, a check code is calculated for the entire packet and checked against the check code added to the received response packet. If the check codes match as a result of the verification, it is possible to confirm that the encryption key used for encryption is correct, and simple authentication can be performed.

  In the above, the case where the sensor value and the setting value are partially encrypted in the packet has been described as an example. However, the terminal ID included in the packet may be encrypted and transmitted. As a result, it is possible to cope with an application that requires data attribute concealment.

[Effects of the present embodiment]
As described above, in the present embodiment, when various types of data are stored in packets and transmitted / received between the sensor terminal 10 and the processing device 20 connected via the communication network NW, the sensor terminal 10 and the processing device. 20, the transmitting side partially encrypts and transmits the data related to the sensor value or the setting value in the packet, and the receiving side partially decrypts the encrypted data in the received packet. It is what I did.

  As a result, only the data related to the sensor value or setting value to be concealed is encrypted in the packet, and the other parts, specifically the incidental information such as the terminal ID and the processing code, are encrypted without encryption. It is sent as it is. Therefore, the sensor terminal 10 can reduce the burden of encryption processing related to encryption / decryption, and hardware resources such as CPU performance and memory are restricted due to low power consumption and cost reduction. However, it is possible to conceal data with a small processing load.

[Extended embodiment]
The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In addition, each embodiment can be implemented in any combination within a consistent range.

  DESCRIPTION OF SYMBOLS 1 ... Sensing system, 10 ... Sensor terminal, 11 ... Sensor, 12 ... Secret processing part, 13 ... Memory | storage part, 14 ... Communication I / F part, 15 ... Terminal control part, 20 ... Processing apparatus, NW ... Communication network.

Claims (6)

A data transmission / reception method used when transmitting and receiving various data in packets between a sensor terminal and a processing device connected via a communication network,
A transmission step in which the transmission side partially encrypts and transmits data relating to a sensor value or a setting value in the packet;
And a reception step of partially decrypting the encrypted data in the received packet. The data transmission / reception method according to claim 1,
In the transmission step, a check code calculated for the entire packet before the encryption is added to the packet after the encryption and transmitted,
The data transmission / reception method characterized in that the receiving step collates a check code added to the received packet and a check code calculated for the entire packet after the decoding. The data transmission / reception method according to claim 1 or 2,
The reception step returns a response packet including a terminal ID of a sensor terminal that transmits and receives the packet and a processing code indicating a process to be executed in response to reception of the packet as a response regarding the received packet. Characteristic data transmission / reception method. In the data transmission / reception method in any one of Claims 1-3,
The data receiving and transmitting method characterized in that the receiving step decodes the plurality of received packets at a time when performing the decoding. In the data transmission / reception method in any one of Claims 1-4,
The data transmitting / receiving method characterized in that, in the transmitting step, a terminal ID of a sensor terminal that transmits / receives the packet among the packets is partially encrypted. A sensing system for collecting sensor values detected by a sensor terminal by a processing device via a communication network,
6. The sensing system according to claim 1, wherein when the sensor value is stored in a packet and transmitted from the sensor terminal to the processing device, the data is transmitted using the data transmission / reception method according to any one of claims 1 to 5.

Images