JP2009008444A - Time management server, time management program, and time management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect precisely a computer having a failed internal timepiece. <P>SOLUTION: A time information collection means 1c acquires a local time shown by client side internal timepieces carried by clients 2, 3, 4. Then, a delay time calculation means 1d calculates a delay time in communication from a transmission time and an arrival time relative to each client 2, 3, 4. An obstacle detection means 1e corrects the local time by the delay time, and it is determined whether an error between a server side internal timepiece 1a and each client side internal timepiece is within a prescribed threshold or not relative to each client 2, 3, 4. When each error of all the clients 2, 3, 4 exceeds the threshold, it is determined that the server side internal timepiece 1a is failed. When the number of clients having each error exceeding the threshold is below a prescribed ratio, it is determined that each client side internal timepiece of the clients having each error exceeding the threshold is failed. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a time management server, a time management program, and a time management method for performing time management of a plurality of devices connected via a network, and in particular, a time management server and time management capable of detecting a device having a failure in an internal clock. The present invention relates to a program and a time management method.

  When processing is performed using a computer, the time at which the processing is performed may be recorded as a time stamp. For example, a time stamp indicating the time when the contents of the document are approved may be added to the electronic signature. This makes it difficult to forge a time stamp.

  As described above, when the reliability of the document content is ensured by the time stamp, it is desired that the internal clock of the computer is accurate. Therefore, in many cases, a server for managing time (hereinafter referred to as a time management server) is installed on the network. The time management server periodically receives radio waves that notify the correct time, and adjusts the internal clock to the correct time. Examples of the radio wave for notifying the time include a standard radio wave (call sign: JJY) transmitted from a standard time signal station and a radio wave transmitted from a satellite in GPS (Global positioning system). The time management server has an accurate internal clock, and manages the accurate time based on the acquired time information. Then, the time management server transmits time information in response to a request from another computer.

  Other computers connected to the time management server via the network acquire time information from the time management server using a time adjustment protocol such as NTP (Network Time Protocol). The computer that has acquired the time information sets its own internal clock to the time acquired from the time management server.

  However, if time information is centrally managed by a specific server such as a time management server, it is impossible to cope with an abnormality of the internal clock in the time management server. That is, even if there is an abnormality in the internal clock of the time management server, it cannot be detected by another computer. As a result, the time of all computers on the network will be out of order.

  Thus, conventionally, it has been considered that all communication stations in a distributed system transmit their own time to other communication stations and select a system reference time by majority (see, for example, Patent Document 1).

In addition, there is a technique for inputting external time data from an externally connected clock device and taking external time data into the system time of a computer or performing abnormality processing such as an abnormality alarm (for example, see Patent Document 2).
JP-A-3-77114 JP-A-5-165545

  However, in the majority voting system as in Patent Document 1, when the internal clocks of a large number of computers have the same characteristics, the time of the majority of computers may be shifted in the same way from the exact time. For example, when there are a large number of computers having an internal clock whose time tends to advance, a time that is more advanced than the correct time may be selected as the reference time by majority vote.

  As described above, in the time management of the computer system, it is difficult to guarantee that the clock of the time management server is not upset, and there is no guarantee that the time is correct even if a majority vote of a plurality of computers is taken. That is, it is difficult to determine whether the time of the server clock is shifted or the time of the client clock is shifted.

  Moreover, if the time information is frequently synchronized in the entire computer system, the processing efficiency of the system is lowered. For this reason, when synchronizing time information at certain intervals, it is necessary to manage the time using an internal clock from the time of synchronization until the next synchronization timing. Then, when the internal clock of the computer is not operating normally, the time may be greatly distorted before the next time information is synchronized. In the meantime, the time stamp of the process executed by the computer becomes an incorrect time. In order to avoid such a situation, it is necessary to accurately find a computer in which the internal clock is not operating normally and stop the business processing by the computer.

  If the internal clock of the computer is not operating normally, it is possible to perform an abnormality process by comparing with an external clock device as shown in Patent Document 2. In this case, however, it is assumed that the external clock device is accurate. That is, when an external clock device operates abnormally, the failure cannot be detected.

  As described above, in order to synchronize the time information, it is necessary to ensure that the internal clock of each computer is functioning normally in addition to ensuring that the time as a reference for time synchronization is accurate. Guaranteeing that the time that is the reference for time synchronization is accurate can be ensured by confirming that the internal clock of the time management server that manages the reference time is functioning normally. Therefore, in order to prevent setting a time stamp with an incorrect time, it is necessary to accurately detect a computer having a failure in the internal clock among the computers on the network including the time management server and the client. It becomes.

  The present invention has been made in view of these points, and an object thereof is to provide a time management server, a time management program, and a time management method that can accurately detect a computer having a failure in an internal clock. To do.

  In order to solve the above-described problems, the present invention provides a time management server 1 as shown in FIG. The time management server 1 performs server time management of a plurality of devices connected via a network. The server-side internal clock 1a, client information storage means 1b, time information collection means 1c, delay time calculation means 1d, and failure detection means 1e. The server-side internal clock 1a generates a time that is a reference for time synchronization. In the client information storage unit 1b, a plurality of managed clients 2, 3, and 4 are registered. The time information collecting unit 1c transmits a request for acquiring time information to each of the clients 2, 3 and 4 registered in the client information storage unit 1b, and is indicated by a client-side internal clock included in the clients 2, 3 and 4. The local time is acquired, and the sending time that is the time of the server-side internal clock 1a when the acquisition request is transmitted, the local time, and the arrival time that is the time of the server-side internal clock when the local time is acquired are paired. And stored in the client information storage means 1b. The delay time calculation means 1d is a one-way portion between the time management server 1 and the clients 2, 3, 4 from the transmission time and arrival time stored for each of the clients 2, 3, 4 in the client information storage means 1b. The delay time in communication is calculated. The failure detection unit 1e corrects the local time based on the delay time calculated by the delay time calculation unit 1d, and determines the difference between the corrected local time and the transmission time or arrival time between the server-side internal clock 1a and the client-side internal clock. It is determined whether the error for each of the clients 2, 3 and 4 is within a predetermined threshold. If the errors of all the clients 2, 3 and 4 exceed the threshold, the server-side internal clock 1a is faulty. If the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, it is determined that the client-side internal clock of the client whose error exceeds the threshold is faulty.

  According to such a time management server 1, first, the local time indicated by the client-side internal clocks of the clients 2, 3, 4 is acquired by the time information collecting unit 1 c, the acquisition request sending time, The time and the arrival time of the local time are stored in the client information storage unit 1b as a set. Next, the delay time calculating means 1d determines the delay time in one-way communication between the time management server 1 and the clients 2, 3, 4 from the transmission time and arrival time for each of the clients 2, 3, 4. Calculated. Then, the failure detection unit 1e corrects the local time based on the delay time, and determines whether the error between the server-side internal clock 1a and the client-side internal clock is within a predetermined threshold for each of the clients 2, 3, and 4. The When the errors of all the clients 2, 3, 4 exceed the threshold, the failure detection unit 1 e determines that there is a failure in the server-side internal clock 1 a. When the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the failure detection unit 1e determines that there is a failure in the client-side internal clock of the client whose error exceeds the threshold.

  In the present invention, if the error of all clients exceeds the threshold, it is determined that the server-side internal clock has a failure, and if the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the error is the threshold The client side internal clock of a client exceeding the limit is judged to have a failure. As a result, it is possible to detect a failure when there is a failure in the server-side internal clock in addition to a failure in the client's internal clock.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing an outline of the invention. The time management server 1 is connected to a plurality of clients 2, 3, and 4 via a network. Each client 2, 3, 4 has an internal clock and executes processing using the time indicated by the internal clock. The internal clock is an electronic circuit dedicated to a clock called RTC (Real Time Clock) mounted on the mother boards of the clients 2, 3, and 4, for example.

  The time management server 1 performs server time management of a plurality of devices connected via a network, and includes a server-side internal clock 1a, client information storage means 1b, time information collection means 1c, delay time calculation means 1d, and failure detection means 1e. , Time synchronization means 1f, and service stop instruction means 1g.

  The server-side internal clock 1a generates a time that is a reference for time synchronization. The server-side internal clock 1a has a function of periodically receiving, for example, a standard radio wave transmitted from a standard time signal station or a radio wave notifying a time from a GPS satellite. The server-side internal clock 1a is a highly accurate clock that incorporates an accurate transmitter such as a rubidium transmitter.

  In the client information storage unit 1b, a plurality of managed clients 2, 3, and 4 are registered. For example, an IP (Internet Protocol) address is set in the client information storage unit 1b as identification information of each of the clients 2, 3, and 4.

  The time information collecting unit 1c transmits a time information acquisition request to each of the clients 2, 3, and 4 registered in the client information storage unit 1b. As a result, the time information collecting unit 1c acquires the local time indicated by the client-side internal clock included in the clients 2, 3, and 4. Then, the time information collecting means 1c sets the sending time that is the time of the server-side internal clock 1a when the acquisition request is transmitted, the local time, and the arrival time that is the time of the server-side internal clock when the local time is acquired. And stored in the client information storage means 1b.

  The delay time calculation means 1d is a one-way portion between the time management server 1 and the clients 2, 3, 4 from the transmission time and arrival time stored for each of the clients 2, 3, 4 in the client information storage means 1b. The delay time in communication is calculated. The delay time is the time from when the clients 2, 3 and 4 send a response packet until the time management server 1 receives the response packet. By dividing the average time difference from the transmission time to the arrival time for each of the clients 2, 3, and 4 by 2, the communication delay time for one direction can be obtained for each of the clients 2, 3, and 4.

  The delay time calculation means 1d can also obtain an average value of delay times for each of the clients 2, 3, and 4 and use the average value as a delay time in communication with each of the clients 2, 3, and 4.

  The failure detection unit 1e corrects the local time based on the delay time calculated by the delay time calculation unit 1d, and determines the difference between the corrected local time and the transmission time or arrival time between the server-side internal clock 1a and the client-side internal clock. Error.

  Here, when the difference between the corrected local time and the transmission time is taken, the failure detection unit 1e performs correction by subtracting the delay time from the local time. Further, when the difference between the corrected local time and the arrival time is taken, the failure detection means 1e performs correction by subtracting the delay time from the local time. By performing such correction, the error between the server-side internal clock and the client-side internal clock can be accurately calculated in consideration of the packet transmission time on the network.

  Further, the failure detection unit 1e determines whether or not the error for each of the clients 2, 3, and 4 is within a predetermined threshold. When the errors of all the clients 2, 3, and 4 exceed the threshold, the failure detection unit 1e determines that there is a failure in the server-side internal clock 1a. When the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the failure detection unit 1e determines that there is a failure in the client-side internal clock of the client whose error exceeds the threshold.

  When the server internal clock 1a is determined to be normal by the failure detection unit 1e, the time synchronization unit 1f performs time synchronization processing for matching the time with the client whose client internal clock is determined to be normal. Execute. In the example of FIG. 1, the time synchronization unit 1 f performs time synchronization processing with the clients 2 and 3.

  The service stop instructing unit 1g instructs the client that has been determined to have a fault in the client-side internal clock by the fault detection unit 1e to stop the service using the client-side internal clock. In the example of FIG. 1, the service stop instruction unit 1 g issues a service stop instruction to the client 4.

  According to such a time management server 1, first, the local time indicated by the client-side internal clock of the clients 2, 3, 4 is acquired by the time information collecting unit 1 c. Then, the time information collection unit 1c stores the acquisition request transmission time, the local time, and the arrival time of the local time in pairs in the client information storage unit 1b.

  Next, the delay time calculating means 1d determines the delay time in one-way communication between the time management server 1 and the clients 2, 3, 4 from the transmission time and arrival time for each of the clients 2, 3, 4. Calculated. Then, the failure detection unit 1e corrects the local time based on the delay time, and determines whether the error between the server-side internal clock 1a and the client-side internal clock is within a predetermined threshold for each of the clients 2, 3, and 4. The

  When the errors of all the clients 2, 3, 4 exceed the threshold, the failure detection unit 1 e determines that there is a failure in the server-side internal clock 1 a. When the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the failure detection unit 1e determines that there is a failure in the client-side internal clock of the client whose error exceeds the threshold.

  When the failure detection unit 1e determines that the server-side internal clock 1a is normal, the time synchronization unit 1f performs time synchronization processing with a client whose client-side internal clock is determined to be normal. In addition, for the client determined to have a fault in the client-side internal clock by the fault detection unit 1e, a service stop instruction using the client-side internal clock is issued by the service stop instruction unit 1g.

In this way, in addition to the case where the internal clocks of the clients 2, 3 and 4 have a failure, the failure can be detected also when there is a failure in the server-side internal clock 1a.
Next, details of the present embodiment will be described. In the following description, the abbreviation of the internal clock of the server is STS, and the abbreviation of the internal clock of the client is STC.

  FIG. 2 is a diagram illustrating a system configuration example of the present embodiment. In the network system according to the present embodiment, the time management server 100 and clients 200, 200a,..., 200m are connected via the network 10.

  The time management server 100 is a computer that manages time in the network. The time management server 100 has a function of receiving radio waves including time information from GPS satellites (GPS satellites) 21, 22, 23,. Further, the time management server 100 collects time information (client local time) from the clients 200, 200a,..., 200m, and the internal clock of the time management server 100 and the clients 200, 200a,. Determine if there is a failure.

  When the internal clock of the time management server 100 itself is normal, the time management server 100 performs time synchronization with a client that is determined to have a normal internal clock. In this time synchronization process, the internal clock of each client is corrected to the same time as the internal clock of the time management server 100. The time management server 100 instructs a client determined to have a failure in the internal clock to stop the service of the time stamp function using the internal clock.

  The clients 200, 200a,..., 200m are computers that execute a service that uses time information of the internal clock as a time stamp. In the present embodiment, it is assumed that signature processing is performed on a file as a service using time information. The internal clocks of the clients 200, 200a,..., 200m are synchronized with the internal clock of the time management server 100 at the time of system construction, and are corrected to the same time as the internal clock of the time management server 100. The

  Furthermore, the clients 200, 200a,..., 200m transmit the time information of the internal clock to the time management server 100 when the power is turned on, and are authenticated that the internal clock is normal. When the time management server 100 determines that the internal clock is normal, the clients 200, 200a,..., 200m synchronize time with the time management server 100, and the internal clock is transferred from the time management server 100. Match the notified time information. When there is a failure in the internal clock, the clients 200, 200a,..., 200m receive a service stop instruction for the time stamp function from the time management server 100, and stop the function using the time stamp.

  In this embodiment, when all of the time management clients 200, 200a,..., 200m are activated, the failure determination of the internal clock and the time synchronization are performed. Therefore, it is assumed that the administrator who operates the system turns on the power of the clients 200, 200a,..., 200m every morning.

  In such a system configuration, in this embodiment, an internal clock is prepared for each of the plurality of clients 200, 200a,..., 200m, and time synchronization is performed when the system is constructed. As a result, the internal clocks of the clients 200, 200a,..., 200m are corrected to the same time as the internal clock of the time management server 100.

  Thereafter, a time information acquisition request including time information (STS transmission time) is sent from the time management server 100 to the plurality of clients 200, 200a,. The time management server 100 acquires the time of the internal clock of the client that has responded (STC local time). In addition, the time management server 100 calculates an average path delay time from the transmission time of the time information acquisition request and the response arrival time when the STC local time is acquired from each of the clients 200, 200a,. Further, the STC local time is corrected by the average delay time, and an error between the time of the internal clock of each client and the time of the internal clock of the time management server is obtained.

  Then, the time management server 100 determines whether or not the time management server and the internal clock of each client are normal depending on whether or not the error obtained for each client is equal to or less than a threshold value. If the errors of the internal clocks for all clients fall within a certain threshold, the internal clocks of the time management server 100 and the clients 200, 200a,. If the error of the internal clock of the majority of clients does not fall within a certain threshold, the internal clock of the time management server 100 is abnormal. In this case, for example, a warning that there is an abnormality in the internal clock of the time management server 100 can be issued. Further, when the error of the internal clock of a small number of clients does not fall within the threshold value, there is an abnormality in the internal clock of the client whose error exceeds the threshold value. In this case, a time abnormality and warning can be issued regarding the internal clock of the corresponding client.

Thus, in this embodiment, a highly reliable mutual time monitoring system is provided using a plurality of client information and server time information.
The functions of the time management server 100 and the clients 200, 200a,..., 200m for realizing such processing will be specifically described below.

  FIG. 3 is a diagram illustrating a hardware configuration example of the time management server used in the present embodiment. The entire time management server 100 is controlled by a CPU (Central Processing Unit) 101. A random access memory (RAM) 102, a hard disk drive (HDD) 103, a graphic processing device 104, an input interface 105, a communication interface 106, and a time management circuit 107 are connected to the CPU 101 via a bus 108. Yes.

  The RAM 102 temporarily stores at least part of an OS (Operating System) program and application programs to be executed by the CPU 101. The RAM 102 stores various data necessary for processing by the CPU 101. The HDD 103 stores an OS and application programs.

  A monitor 11 is connected to the graphic processing device 104. The graphic processing device 104 displays an image on the screen of the monitor 11 in accordance with a command from the CPU 101. A keyboard 12 and a mouse 13 are connected to the input interface 105. The input interface 105 transmits a signal sent from the keyboard 12 or the mouse 13 to the CPU 101 via the bus 108.

  The communication interface 106 is connected to the network 10. The communication interface 106 transmits / receives data to / from another computer via the network 10.

  The time management circuit 107 has an internal clock with little error and manages time information. Further, the GPS antenna 20 is connected to the time management circuit 107. The time management circuit 107 periodically receives a radio wave indicating the time transmitted from the GPS 21, 22, 23,... Via the GPS antenna 20. The time management circuit 107 recognizes the current time from the received radio wave, and adjusts the internal clock to that time.

  FIG. 4 is a diagram illustrating a hardware configuration example of a client used in the present embodiment. The entire apparatus of the client 200 is controlled by the CPU 201. A RAM 202, a hard disk drive (HDD) 203, a graphic processing device 204, an input interface 205, a PC card interface 206, and a communication interface 207 are connected to the CPU 201 via a bus 208.

  The RAM 202 temporarily stores at least a part of OS programs and application programs to be executed by the CPU 201. The RAM 202 stores various data necessary for processing by the CPU 201. The HDD 203 stores an OS and application programs.

  A monitor 31 is connected to the graphic processing device 204. The graphic processing device 204 displays an image on the screen of the monitor 31 in accordance with a command from the CPU 201. A keyboard 32 and a mouse 33 are connected to the input interface 205. The input interface 205 transmits a signal sent from the keyboard 32 or the mouse 33 to the CPU 201 via the bus 208.

  The PC card interface 206 can be connected to the PC card 34. The PC card interface 206 transmits / receives data to / from the connected PC card 34. The PC card 34 used in the present embodiment has a built-in clock circuit 34a. The clock circuit 34a manages the current time using an internal clock. The PC card 34 passes time information indicated by the clock circuit 34 a to the client 200 in response to a request from the client 200.

  The communication interface 207 is connected to the network 10. The communication interface 207 transmits and receives data to and from other computers via the network 10.

  With the hardware configuration as described above, the processing functions of the present embodiment can be realized. 4 shows only the hardware configuration of the client 200, other clients 200a,..., 200m can also be realized with the same hardware configuration.

Next, functions of the time management server 100 and the clients 200, 200a,..., 200m for performing clock monitoring via the network will be described.
FIG. 5 is a block diagram illustrating functions of the time management server and the client. The time management server 100 includes a client information storage unit 110, a time information collection unit 120, an average delay time calculation unit 130, a failure determination unit 140, a signature management unit 150, and a time synchronization processing unit 160.

  The client information storage unit 110 stores information about a client that is a time monitoring countermeasure. Specifically, in the client information storage unit 110, the IP address of the time monitoring target client is registered in advance. The client information storage unit 110 is provided with a time information registration area in association with the IP address of each client.

  The time information collecting unit 120 starts collecting time information from the clients 200, 200a,..., 200m at a predetermined time. For example, at 7 am every day, the time information collecting unit 120 waits for the clients 200, 200a,..., 200m to be activated, and transmits a time information acquisition request to the activated clients. This acquisition request includes the time when the acquisition request is transmitted (STS transmission time). Then, the time information collection unit 120 receives the acquired time notification from the client. The received time notification includes the STS transmission time, the STC time when the client responded to the time notification (STC local time), and the STS transmission time. The time information collection unit 120 registers the STS transmission time, the STC local time, and the time (STS arrival time) at which the time notification is acquired, in association with the IP address of the corresponding client in the client information storage unit 110. To do.

  Based on the time information acquired from the clients 200, 200a,..., 200m, the average delay time calculation unit 130 communicates between the time management server 100 and the clients 200, 200a,. Each average delay time in minutes) is calculated. Specifically, the average delay time calculation unit 130 refers to the client information storage unit 110 and confirms that the time information is registered in association with the IP addresses of all clients. Then, the average delay time calculation unit 130 calculates the average in one-way communication between the time management server 100 and the clients 200, 200a,..., 200m based on the information registered in the client information storage unit 110. Calculate the delay time. The average delay time can be calculated by averaging the delay times for each client. Specifically, for each client, the difference between the STS transmission time and the STS arrival time is divided by 2 to obtain the delay time for each client. If the delay times obtained for each client are added together and divided by the total number of clients subject to time management, the average delay time for one direction of communication is obtained.

  Based on the time information acquired from each of the clients 200, 200a,..., 200m, the failure determination unit 140 sets the time management server 100 itself or the clients 200, 200a,. Detect faulty computers. Specifically, the failure determination unit 140 corrects the value by adding the average delay time to the STC local time acquired from each of the clients 200, 200a,. Then, failure determination section 140 calculates the difference (error) between the STS arrival time and the STC local time corrected with the average delay time for each client. Furthermore, the failure determination unit 140 determines whether the error calculated for each client is equal to or less than a predetermined threshold. The threshold is about 50 ms, for example.

  The failure determination unit 140 determines that all computers are normal if the error is less than or equal to the threshold value in all clients. The failure determination unit 140 determines that the internal clock of the time management server 100 has a failure when the error exceeds the threshold value in all clients. If the error exceeds a threshold value for a predetermined number of clients or less, the failure determination unit 140 determines that there is a failure in the internal clock for the client whose error exceeds the threshold value. For other clients and the time management server 100, it is determined that the internal clock is normal. The failure determination unit 140 determines that the exact time that can be guaranteed in the entire system is unknown if the error exceeds a threshold value in the number of clients (excluding the total number) exceeding a predetermined number. The failure determination unit 140 passes the determination result to the signature management unit 150.

  The signature management unit 150 transmits a signature function stop notification to the client determined by the failure determination unit 140 that the internal clock has a failure. Further, when it is determined that there is a failure in the internal clock of the time management server 100 itself, the signature management unit 150 transmits a signature function stop notification to all the clients 200, 200a,. That is, when the internal clock of the time management server 100 cannot be trusted, even if the clients 200, 200a,..., 200m perform time synchronization with the time management server 100, the corrected time is not always correct. Therefore, the accuracy of the time of the internal clock of the clients 200, 200a,. Therefore, when it is determined that there is a failure in the internal clock of the time management server 100, it is necessary to stop the signature processing in all the clients 200, 200a,. Further, the signature management unit 150 transmits a signature function stop notification to all clients 200, 200a,..., 200m even when the exact time that can be guaranteed in the entire system is unknown.

  The time synchronization processing unit 160 performs time synchronization processing with the client that has received the determination that the internal clock is normal in the failure determination unit 140. Specifically, the time synchronization processing unit 160 notifies the client determined that the internal clock is normal (this notification is referred to as a time synchronization permission notification). Note that the IP address of the client to be notified is determined with reference to the client information storage unit 110. When the time synchronization processing unit 160 receives an STS acquisition request from the client that has transmitted the time synchronization permission notification, the time synchronization processing unit 160 refers to the current internal time managed by the time management circuit 107 and uses the internal time as the STS for the client. Send to. The communication with the client performed by the time synchronization processing unit 160 can be performed using NTP, for example.

The client 200 includes a time information transmission unit 210, a signature processing unit 220, and a time synchronization processing unit 230.
When receiving the time information acquisition request from the time management server 100, the time information transmission unit 210 refers to the internal clock of the client 200 itself and acquires the STC. In the present embodiment, since time management is performed for providing a service with time stamp processing using the PC card 34, the time indicated by the clock circuit 34a in the PC card 34 is handled as STC. When acquiring the STC, the time information transmission unit 210 transmits a response including the STC and the STS included in the time information acquisition request to the time management server 100.

  The signature processing unit 220 has a function of giving an electronic signature to a predetermined file created in the client 200. The signature processing unit 220 applies a time stamp to the electronic signature when giving the electronic signature to the file. Specifically, when receiving a processing request for adding a signature to a file by an operation input or the like, the signature processing unit 220 instructs the PC card 34 to create an electronic signature of the user who performed the operation. At this time, the signature target file is also transferred to the PC card 34. Then, the PC card 34 generates an electronic signature corresponding to the content of the file and the time (STC) at that time, and adds it to the file. Then, the signature processing unit 220 stores the file with the electronic signature added in the HDD 203 or the like. Thereafter, the signature processing unit 220 can use the PC card 34 to check whether the file with the electronic signature has been tampered with.

  When the signature processing unit 220 receives a signature function stop notification from the time management server 100, the signature processing unit 220 stops the signature processing. That is, when the time management server 100 determines that the clock circuit (STC) built in the PC card 34 is abnormal, the signature processing unit 220 stops using the signature addition / falsification check function.

  The time synchronization processing unit 230 performs time synchronization processing with the time management server 100. Specifically, when the time synchronization processing unit 230 receives a notification that the internal clock of the client 200 is normal (time synchronization permission notification) as a result of failure determination by the time management server 100, the time synchronization processing unit 230 performs time synchronization with the time management server 100. Process. In the time synchronization process, first, an internal time (STS) acquisition request is transmitted from the time synchronization processing unit 230 to the time management server 100. Then, the time synchronization processing unit 230 updates the time of the internal clock using the acquired STS. In the present embodiment, the time indicated by the clock circuit 34a built in the PC card 34 is handled as an internal clock. Therefore, the time synchronization processing unit 230 adjusts the time of the clock circuit 34a to STS.

In the example of FIG. 5, only the function of the client 200 is shown, but the other clients 200a,..., 200m have the same function.
FIG. 6 is a diagram illustrating an example of a data structure of the client information storage unit. The client information storage unit 110 has columns for client IP address and time information. In the client IP address column, the IP address of the client to be managed is set in advance.

  The time information acquired from the client is stored in the time information column. Note that the time information column is all cleared (initialized to invalid data) by the time information collection unit 120 at the start of time information collection.

  The time information column is subdivided into STS transmission time, STC local time, and STS arrival time columns. In the STS transmission time column, the time at which the time information acquisition request is transmitted to the client is set. In the STC local time column, the time of the internal clock of the client when the client responds to the acquisition request is set. In the STS arrival time column, the time at which the time management server 100 receives a response from the client to the acquisition request is set.

  In the example of FIG. 6, the collection of time information from the client whose IP address is “192.168.1.100” has been completed, but the collection of time information from the client whose IP address is “192.168.1.101” has not been completed. .

Next, the entire procedure of the time management process will be described.
FIG. 7 is a sequence diagram illustrating the procedure of the time management process. 7 representatively shows processing between the time management server 100 and the client 200, but similar processing is also performed between the other clients 200a,..., 200m and the time management server 100. Is done. In the following, the process illustrated in FIG. 7 will be described in order of step number.

[Step S11] The client 200 is activated.
[Step S12] The time information transmission unit 210 of the time management server 100 detects that the client 200 is activated. For example, the time management server 100 periodically sends a predetermined command (for example, ping) to clients that have not yet collected time information among the clients to be managed. It can detect whether the client has been started. When the client 200 is activated, the time management server 100 can recognize the activation of the client 200 by notifying the time management server 100 of information indicating that the client 200 has been activated.

[Step S <b> 13] The time information transmission unit 210 transmits a request to acquire time information including the STS transmission time to the client 200.
[Step S14] In the client 200, the time information transmission unit 210 receives a time information acquisition request.

  [Step S15] The time information transmitter 210 uses the time indicated by the internal clock of the client 200 (in this embodiment, the clock circuit 34a of the PC card 34) as the STC local time, and calculates the STS transmission time and the STC local time. A response including this is transmitted to the time management server 100.

  [Step S16] When the time information collection unit 120 of the time management server 100 receives the response sent from the client 200, the STS transmission time, the STC local time, and the time of the internal clock at the time of receiving the response (included in the response) STS arrival time) is stored in the client information storage unit 110.

[Step S17] The average delay time calculation unit 130 calculates the average delay time after acquiring time information from all the clients to be managed.
[Step S18] The failure determination unit 140 determines whether the internal clocks of the time management server 100 and the client 200 are normal. Details of the failure determination process for determining whether or not it is normal will be described later (see FIG. 10 and the like).

  [Step S19] The failure determination unit 140 determines whether both the internal clocks of the time management server 100 and the client 200 are normal based on the failure determination. If both the internal clocks of time management server 100 and client 200 are normal, the process proceeds to step S20. If an abnormality (including a case where reliable time information of the entire system is unknown) is detected in at least one of the processes, the process proceeds to step S22.

  [Step S <b> 20] If the internal clocks of the time management server 100 and the client 200 are normal, the time synchronization processing unit 160 transmits the time of the current internal clock to the client 200.

[Step S21] The time synchronization processor 230 of the client 200 sets its own internal clock to the time sent from the time management server 100.
[Step S22] If at least one of the internal clocks of the time management server 100 and the client 200 is abnormal, the signature management unit 150 transmits a signature function stop notification to the client.

[Step S23] In the signature processing unit 220 of the client 200, the time synchronization processing unit 160 transmits the time of the current internal clock to the client 200.
The process shown in FIG. 7 is similarly performed between the time management server 100 and the other clients 200a,. As a result, it is determined whether or not the internal clocks of the time management server 100 and the clients 200, 200a,. Then, the processing of the electronic signature at the client having a failure in the internal clock stops. When the internal clock of the time management server 100 is faulty or when the correct time is unknown, the processing of the electronic signature is stopped in all clients 200, 200a,.

Next, time information collection processing will be described in detail.
FIG. 8 is a diagram illustrating time information collection processing. As shown in FIG. 8, a time information acquisition request including the internal clock (STS) information of the time management server 100 is sent from the time information collection unit 120 of the time management server 100 to each of the clients 200, 200 a,. Sent. In FIG. 8, identification numbers 1, 2,..., N (n is an integer of 2 or more) are assigned to the clients 200, 200a,. Then, the value (STS transmission time) of the internal clock of the time management server 100 when the time information acquisition request is transmitted to the i-th (i = 1, 2,..., N) client is expressed as “Tst i. "

  Receiving the time information acquisition request, each client 200, 200a,..., 200m acquires the time (STC local time) from the client's own internal clock and responds to the time management server 100. The response includes the STS transmission time and the STC local time. Here, the STC local time of the i-th client is assumed to be “Tc i”.

  When the time information collection unit 120 of the time management server 100 receives a response from the clients 200, 200a,..., 200m, the time of the internal clock of the time management server 100 (STS arrival time) when the response is received. get. Here, it is assumed that the STS arrival time when receiving a response from the i-th client is “Tsri”.

The time information collection unit 120 of the time management server 100 stores the STS transmission time, the STC local time, and the STS arrival time as a set in the client information storage unit 110.
FIG. 9 is a flowchart showing a procedure of time information collection processing. In the following, the process illustrated in FIG. 9 will be described in order of step number.

  [Step S31] The time information collection unit 120 determines whether it is a time information collection start time. The time information collection start time is set in advance in the time information collection unit 120 and stored in a storage medium such as the RAM 102. For example, 7 o'clock every day between Monday and Friday is set as the time information collection start time.

  When the time information collection start time comes, the time information collection unit 120 advances the process to step S32. If the time information collection start time has not been reached, the process of step S31 is repeated to wait for the time information collection start time.

  [Step S32] The time information collection unit 120 initializes the time information column of the client information storage unit 110. Specifically, the time information collection unit 120 sets invalid data in all the time information fields of the client information storage unit 110.

  [Step S33] The time information collection unit 120 confirms whether or not the processing target client has been activated. For example, the time information collection unit 120 confirms network communication with respect to an IP address of a client whose time information has not been acquired among IP addresses registered in the client IP address column of the client information storage unit 110. Send the command (ping) by multicast. When there is a response to the transmitted command, the time information collection unit 120 can determine that the managed client has been activated.

  [Step S34] The time information collection unit 120 determines whether a client that has not acquired time information has been newly activated. If a new client is activated, the process proceeds to step S35. If there is no newly activated client, the process proceeds to step S33.

[Step S35] The time information collection unit 120 transmits a time information acquisition request to the newly activated client.
[Step S36] The time information collection unit 120 acquires the time information (STC local time) of the client in response to the time information acquisition request from the client.

  [Step S37] The time information collection unit 120 stores time information (STS transmission time, STC local time, STS arrival) in the time information column in the client information storage unit 110 in association with the IP address of the newly activated client. Time).

  [Step S38] The time information collection unit 120 determines whether time information has been collected from all clients to be managed. If the collection of time information from all managed clients is complete, the process ends. If there is a client whose time information has not been collected, the process proceeds to step S33.

In this way, time information can be collected from each of the clients 200, 200a,. Based on the time information collected in this way, the average delay time calculation unit 130 calculates the average delay time τ _AVE by the following formula.

Next, the failure determination unit 140 determines whether or not the time management server 100 and the internal clocks of the clients 200, 200a,.
The failure determination unit 140 corrects the STC local time with the average delay time τ _AVE . If the difference (error) between the corrected STC local time and the STS arrival time is less than or equal to a predetermined threshold value ε for all clients, the failure determination unit 140 determines that the time management server 100 and all clients 200, It is determined that the internal clocks 200a, ..., 200m are normal. Specifically, when the following conditions are satisfied, it is determined that the internal clock of each computer is normal.

  Also, the failure determination unit 140 determines that the internal clock of the time management server 100 is abnormal if the difference (error) between the corrected STC local time and the STS arrival time exceeds a predetermined threshold ε for all clients. It is determined that Specifically, when the following conditions are satisfied, it is determined that the internal clock of each computer is normal.

  Furthermore, if the difference (error) between the corrected STC local time and the STS arrival time is greater than a predetermined threshold ε for the failure determination unit 140 for a client having a predetermined ratio (for example, several percent) or less, It is determined that the internal clock of the client whose error exceeds the threshold ε is abnormal. Specifically, when the following conditions are satisfied, it is determined that the internal clock of each computer is normal.

Note that “Tsr k” and “k” of “Tc k” in Equation (4) are integers of 1 or more and n or less.
Next, the failure determination process in the failure determination unit 140 will be described in detail.

  FIG. 10 is a flowchart illustrating the procedure of the failure determination process. In the following, the process illustrated in FIG. 10 will be described in order of step number. The following processing is executed when the average delay time is received from the average delay time calculation unit 130.

[Step S41] The failure determination unit 140 selects one unprocessed client from the client information storage unit 110.
[Step S42] The failure determination unit 140 corrects the STC local time of the selected client with the average delay time. Specifically, the average delay time is added to the STC local time.

  [Step S43] The failure determination unit 140 calculates a difference between the corrected STC local time and the corresponding STS arrival time, and sets it as an error in internal time between the time management server 100 and the corresponding client.

  [Step S44] The failure determination unit 140 compares a preset threshold value with the error calculated in Step S43. Then, the failure determination unit 140 stores the comparison result in the RAM 102 in association with the identification information (for example, IP address) of the client. There are two comparison results: whether the error is less than or equal to the threshold or whether the error exceeds the threshold.

  [Step S45] The failure determination unit 140 determines whether or not all clients to be monitored have been selected. If all the clients to be monitored have been selected, the process proceeds to step S46. If there is an unselected client, the process proceeds to step S41.

  [Step S46] The failure determination unit 140 determines whether all the errors of each client are equal to or less than a threshold based on the comparison result in Step S44. If the errors regarding all clients are equal to or smaller than the threshold value, the process proceeds to step S47. If the error of at least one client exceeds the threshold, the process proceeds to step S48.

  [Step S47] When all of the client errors are equal to or smaller than the threshold value, the failure determination unit 140 determines that the internal clocks of the time management server 100 and all the clients to be monitored are normal. Thereafter, the process ends.

  [Step S48] When the error of at least one client exceeds the threshold, the failure determination unit 140 determines whether the errors of all the clients exceed the threshold. If the errors of all clients exceed the threshold, the process proceeds to step S49. If the error of at least one client is less than or equal to the threshold, the process proceeds to step S50.

[Step S49] The failure determination unit 140 determines that there is a failure in the internal clock of the server when the errors of all clients exceed the threshold. Thereafter, the process ends.
[Step S50] When the error of at least one client is equal to or less than the threshold, the failure determination unit 140 determines whether the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio. If the error exceeds the threshold in the client exceeding the predetermined ratio, the process proceeds to step S51. If the number of clients whose error exceeds the threshold is equal to or less than the predetermined ratio, the process proceeds to step S52.

  [Step S51] When the number of clients whose error exceeds the threshold exceeds a predetermined ratio, the failure determination unit 140 determines that the exact time in the system is unknown. Thereafter, the process ends.

  [Step S52] When the number of clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the failure determination unit 140 determines that the internal clock of the client whose error exceeds the threshold is abnormal. Thereafter, the process ends. Thereafter, the process ends.

  As described above, it is possible to accurately detect a computer having an abnormal internal clock and stop the service. As a result, it is possible to prevent the generation of an electronic signature including an incorrect time as a time stamp.

  In the above embodiment, the STC local time is corrected by the average delay time. This is based on the premise that the communication quality between the time management server 100 and the clients 200, 200a,. For example, with respect to VoIP (Voice over IP), if the delay of the entire network is less than 150 ms, it is possible to maintain call quality equivalent to that of a subscriber telephone. In principle, the network of this embodiment also assumes that the communication delay is less than 150 ms. In this way, in a network environment in which the communication delay is suppressed to a certain extent, the average of the delay times calculated for all clients is closer to the actual delay time.

  The above processing functions can be realized by a computer. In that case, a program describing the processing contents of the functions that the time management server and the client should have is provided. By executing the program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of the computer-readable recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Examples of the magnetic recording device include a hard disk device (HDD), a flexible disk (FD), and a magnetic tape. Optical discs include DVD (Digital Versatile Disc), DVD-RAM, CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), and the like. Magneto-optical recording media include MO (Magneto-Optical disk).

  When distributing the program, for example, portable recording media such as a DVD and a CD-ROM in which the program is recorded are sold. It is also possible to store the program in a storage device of a server computer and transfer the program from the server computer to another computer via a network.

  The computer that executes the program stores, for example, the program recorded on the portable recording medium or the program transferred from the server computer in its own storage device. Then, the computer reads the program from its own storage device and executes processing according to the program. The computer can also read the program directly from the portable recording medium and execute processing according to the program. In addition, each time the program is transferred from the server computer, the computer can sequentially execute processing according to the received program.

  The present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the gist of the present invention.

It is a figure which shows the outline | summary of invention. It is a figure which shows the system configuration example of this Embodiment. It is a figure which shows the hardware structural example of the time management server used for this Embodiment. It is a figure which shows the hardware structural example of the client used for this Embodiment. It is a block diagram which shows the function of a time management server and a client. It is a figure which shows the example of a data structure of a client information storage part. It is a sequence diagram which shows the procedure of a time management process. It is a figure which shows a time information collection process. It is a flowchart which shows the procedure of a time information collection process. It is a flowchart which shows the procedure of a failure determination process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Time management server 1a Server side internal clock 1b Client information storage means 1c Time information collection means 1d Delay time calculation means 1e Failure detection means 1f Time synchronization means 1g Service stop instruction means 2, 3, 4 Client

Claims (8)

In a time management server that performs time management of multiple devices connected via a network,
A server-side internal clock that generates a time that is a reference for time synchronization;
Client information storage means in which a plurality of managed clients are registered,
A time information acquisition request is transmitted to each of the clients registered in the client information storage unit, the local time indicated by the client-side internal clock of the client is acquired, and the acquisition request is transmitted when the acquisition request is transmitted. Time information collecting means for storing in the client information storage means a set of a sending time that is the time of the server-side internal clock, the local time, and an arrival time that is the time of the server-side internal clock when the local time is acquired; ,
Delay time calculating means for calculating a delay time in one-way communication between the time management server and each of the clients from the transmission time and the arrival time of each of the clients stored in the client information storage means When,
The local time is corrected by the delay time calculated by the delay time calculating means, and the difference between the corrected local time and the sending time or the arrival time is calculated between the server-side internal clock and the client-side internal clock. It is determined whether or not the error for each client is within a predetermined threshold value, and if all the client errors exceed the threshold value, it is determined that there is a failure in the internal clock on the server side. Fault detection means for determining that there is a fault in the client-side internal clock of the client whose error exceeds the threshold when the number of the clients whose threshold exceeds the threshold is less than or equal to a predetermined percentage;
A time management server comprising:   The delay time calculating means is a delay time in one-way communication between the time management server and each of the clients from the sending time and the arrival time for each of the clients stored in the client information storage means. 2. The time management server according to claim 1, wherein an average value is calculated, and the calculated average value is used as a delay time in communication with each of the clients.   When the server-side internal clock is determined to be normal by the failure detection means, a time synchronization process is performed for matching the time with the client for which the client-side internal clock is determined to be normal. 2. The time management server according to claim 1, further comprising time synchronization means.   The apparatus further comprises a service stop instruction means for instructing the client determined to have a failure in the client side internal clock by the fault detection means to stop the service using the client side internal clock. The time management server according to claim 1.   The time management according to claim 1, wherein the failure detection unit determines that an accurate time is unknown when the number of the clients whose error exceeds the threshold exceeds a predetermined ratio. server.   And a service stop instructing unit for instructing all the clients to stop the service using the client-side internal clock when it is determined by the failure detecting unit that the exact time is unknown. The time management server according to claim 5. In a time management program for performing time management of a plurality of devices connected by a network with a computer having a server-side internal clock that generates a time serving as a reference for time synchronization,
The computer,
Client information storage means in which a plurality of managed clients are registered,
A time information acquisition request is transmitted to each of the clients registered in the client information storage unit, the local time indicated by the client-side internal clock of the client is acquired, and the acquisition request is transmitted when the acquisition request is transmitted. Time information collecting means for storing in the client information storage means a set of a sending time that is the time of the server-side internal clock, the local time, and an arrival time that is the time of the server-side internal clock at the time of acquisition of the local time;
Delay time calculating means for calculating a delay time in one-way communication between the time management server and each of the clients from the transmission time and the arrival time of each of the clients stored in the client information storage means ,
The local time is corrected by the delay time calculated by the delay time calculating means, and the difference between the corrected local time and the sending time or the arrival time is calculated between the server-side internal clock and the client-side internal clock. It is determined whether or not the error for each client is within a predetermined threshold value, and if all the client errors exceed the threshold value, it is determined that there is a failure in the internal clock on the server side. Failure detection means for determining that there is a failure in the client-side internal clock of the client whose error exceeds the threshold when the number of the clients whose threshold exceeds the threshold is less than or equal to a predetermined percentage;
A time management program characterized by functioning as In a time management method for performing time management of a plurality of devices connected via a network with a computer having a server-side internal clock that generates a time serving as a reference for time synchronization,
The time information collecting means transmits a request for obtaining time information to each of the clients registered in the client information storage means in which a plurality of clients to be managed are registered, and is indicated by a client-side internal clock possessed by the client. The local time is acquired, and the sending time that is the time of the server-side internal clock when the acquisition request is transmitted, the local time, and the arrival time that is the time of the server-side internal clock when the local time is acquired are set. And stored in the client information storage means,
A delay time calculating means calculates a delay time in one-way communication between the time management server and each of the clients from the transmission time and the arrival time of each of the clients stored in the client information storage means. Calculate
A failure detection unit corrects the local time by the delay time calculated by the delay time calculation unit, and calculates a difference between the corrected local time and the transmission time or the arrival time and the server-side internal clock and the An error with the internal clock on the client side is determined, and it is determined whether the error for each client is within a predetermined threshold,
When the failure detection means determines that there is a failure in the server-side internal clock when the error of all the clients exceeds the threshold,
When the number of the clients whose error exceeds the threshold is equal to or less than a predetermined ratio, the failure detection means determines that the client-side internal clock of the client whose error exceeds the threshold is faulty.
A time management method characterized by the above.

Images