JP2009186326A - Device controller, electric device, and device control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform control so that an appliance does not operate after its usable period expires, by determining whether time is within the usable period of the appliance by using time information generated by a clock inoperable from outside. <P>SOLUTION: The home appliance 10 includes a local clock unit incapable of being operated from outside excluding its initial time setting and a power supply control processing unit. The local clock unit includes an independent power source, generates time information from an oscillation signal of fixed intervals generated with an oscillation means by the use of the power source, and outputs transmission data including this time information at fixed intervals. The power supply control processing unit obtains the time information from received transmission data, transmits the obtained time information to a time audit department system 70 and receives data on a time audit certificate, and holds information on an effective duration represented by the data. If an operation for turning the power source of the home appliance 10 on is performed by a user, power-on is allowed when the present time obtained from the local clock unit is within the effective duration represented by the held information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a device control apparatus, an electrical device, and a device control method.

Conventionally, in a gas shut-off device that monitors the use state of gas appliances that use city gas or LP gas, etc., the battery shut-off is controlled by having a battery power source inside and measuring the battery usage time (for example, Patent Document 1).
Japanese Patent No. 3620438

  The conventional gas shut-off device does not provide a means for confirming that the internal clock measuring means is operating normally, and is not a mechanism that can be used only by authorized parties to set the expiration date. Can be tampered with. In addition, in order to prevent accidents caused by the aging of home appliances, the revised Safety Law was passed on November 14, 2007, and the Electric Safety Law was also revised. Has pointed out the problem of unauthorized modification.

  The present invention has been made in consideration of such circumstances, and its purpose is to determine whether the device is within the expiration date of use using the time generated by a clock that cannot be operated from the outside, and to determine the expiration date of use. It is an object to provide a device control device, an electric device, and a device control method capable of controlling the device so that the device does not operate when exceeding the above.

  The present invention has been made to solve the above-described problem, and is provided in a device including a functional unit having a predetermined function, and is a device control device including a clock unit and a device control processing unit, The timepiece unit includes a power source, an oscillation unit that receives power supplied from the power source and generates an oscillation signal having a fixed period, a time control unit that generates time from the oscillation signal generated by the oscillation unit, and the time A time setting unit that sets the time only once to the control unit, and thereafter prohibits the setting of the time, and a signal transmission unit that outputs transmission data including time information generated by the time control unit at regular intervals. The device control processing unit includes: a signal receiving unit that receives transmission data output from the signal transmission unit at regular intervals; and a time acquisition unit that acquires time information from the transmission data received by the signal receiving unit; , A time audit control unit that transmits time information acquired by the time acquisition unit to the time audit station system and receives time audit certificate data for the transmitted time information; and receives an execution request for the predetermined function. The time acquired by the time acquisition unit when the execution request is received is within the expiration date obtained from the time audit certificate data received by the time audit control unit, the predetermined unit in the function unit And a control unit that outputs a function execution permission.

  Further, the present invention is the device control apparatus described above, wherein the time audit control unit holds the expiration date set in the time audit certificate data received first in the storage unit as the device expiration date, The device control processing unit receives the execution request for the predetermined function, information indicating that the time is normal is set in the time audit certificate data received immediately before by the time audit control unit, and When the time acquired by the time acquisition unit when the execution request is received is within the expiration date of the device stored in the storage unit, the execution permission of the predetermined function in the function unit is output. It is characterized by.

  Further, the present invention is the above-described device control apparatus, wherein the time audit control unit uses the time audit station system to obtain the time information acquired by the time acquisition unit when an instruction to extend the validity period is input. The expiration date set in the time audit certificate data for the transmitted time information is stored in the storage unit as the expiration date of the device.

  Further, the present invention is the device control apparatus described above, wherein the oscillating unit includes a first oscillating unit and a second oscillating unit that generate an oscillation signal having a constant period, and the time control unit includes the first oscillating unit. A first time control unit that generates time from an oscillation signal generated by one oscillation unit, and a second time control unit that generates time from an oscillation signal generated by the second oscillation unit, The time setting unit performs time setting only once for each of the first time control unit and the second control unit, and thereafter prohibits time setting, and the signal transmission unit transmits the transmission data As the first transmission data including the time information generated by the first time control unit and the second transmission data including the time information generated by the second time control unit at regular intervals The time acquisition unit outputs the Time information is acquired from each of the first transmission data and the second transmission data received as data, and the device control processing unit further receives the first transmission data by the time acquisition unit when receiving the execution request. When the error between the time obtained from the above and the time obtained from the second transmission data is within a normal range, the execution permission of the predetermined function in the function unit is output.

  The present invention is the above-described device control apparatus, wherein the timepiece unit and the device control processing unit have tamper resistance.

  In addition, the present invention is the above-described device control apparatus, wherein the clock unit and the device control processing unit are detachable.

  Further, the present invention provides the above-described device control apparatus, wherein when a new clock unit is attached to the device control processing unit, the time audit control unit is configured to transmit the new clock unit using the time acquisition unit. The time information acquired from the transmission data output by is transmitted to the time audit bureau system.

  The device control processing unit further includes a detection unit that sets information indicating that the received time audit certificate data is invalid in the device control information storage unit when the replacement of the clock unit is detected, and the control When the information indicating that the time audit certificate data is invalid is set in the device control information storage unit, the unit regulates the output of permission to execute the predetermined function.

  Further, the present invention is the above-described device control apparatus, wherein the signal transmission unit outputs transmission data including encrypted time information that is the encrypted time, and the time acquisition unit includes the transmission The encryption time information set in the data is decrypted.

  The present invention is the above-described device control device, wherein the clock unit further includes an encryption time holding unit that holds information in which a time is associated with an encryption time of the time, and the signal The transmission unit reads information on the encryption time corresponding to the time generated by the time control unit from the encryption time holding unit, and outputs transmission data including the read information on the encryption time. To do.

  Further, the present invention is the above-described device control apparatus, wherein the device control processing unit further includes a decryption time holding unit that holds information in which an encryption time is associated with a decrypted time, The time acquisition unit reads the decrypted time corresponding to the encryption time set in the transmission data received by the signal reception unit from the decryption time holding unit.

  Further, the present invention is the device control apparatus described above, wherein the time acquisition unit sets the information on the encryption time set in the transmission data received by the signal reception unit in the transmission data received in the past. The transmission data is judged to be valid when the encrypted time information is not correct.

  Further, the present invention is the above-described device control apparatus, wherein the device control processing unit further includes an output unit that notifies that the expiration date is near when a predetermined period is reached until the expiration date of the clock unit. It is characterized by providing.

  Further, the present invention is the device control apparatus described above, wherein the time setting unit receives time setting request, and information indicating that initial setting of time is performed in a storage unit included in the clock unit is set. If not, the time is set in the time control unit, and information indicating that the time is initially set is written in the storage unit.

  Further, the present invention is the device control apparatus described above, wherein the time acquisition unit determines that the acquired time information is correct when the acquired time information is a time advanced from a previously acquired time. It is characterized by judging.

  Further, the present invention is the device control apparatus described above, wherein the device control processing unit, as the execution permission of the predetermined function, to the power control unit that controls power supply to the function unit in the device, The power supply permission to the function unit is output.

  Further, the present invention provides a function unit having a predetermined function, a power control unit that controls power supply to the function unit, a clock unit that generates time, and a time generated by the clock unit. An electrical device including a device control processing unit that controls the operation of the functional unit, wherein the clock unit includes a power source and an oscillation unit that receives power supplied from the power source and generates an oscillation signal having a constant period A time control unit that generates time from the oscillation signal generated by the oscillation unit, a time setting unit that sets the time only once in the time control unit, and prohibits time setting thereafter, and the time control unit A signal transmission unit that outputs transmission data including time information generated at a constant interval, and the device control processing unit receives the transmission data output from the signal transmission unit at a constant interval. And the signal reception The time acquisition unit that acquires time information from the transmission data received by the method, and the time information acquired by the time acquisition unit are transmitted to the time audit station system, and the time audit certificate data for the transmitted time information is received. A time audit control unit that receives the execution request for the predetermined function, and the time acquired by the time acquisition unit when the execution request is received is obtained from the time audit certificate data received by the time audit control unit. A control unit that outputs permission of power supply to the function unit to the power control unit when the expiration date is within the specified expiration date, and the power control unit permits permission of power supply to the function unit. An electric device characterized by receiving power from a device control processing unit and supplying power to the functional unit.

  The present invention is also provided in a device having a functional unit having a predetermined function, and is a device control method used in a device control device including a clock unit and a device control processing unit, wherein the clock unit includes: The oscillating unit receives power supplied from a power source included in the clock unit and generates an oscillation signal having a constant period, and the time control unit generates time from the oscillation signal generated by the oscillating unit, and a time setting unit However, the time is set only once in the time control unit, and thereafter the time setting is prohibited, and the signal transmission unit outputs transmission data including the time information generated by the time control unit at regular intervals. In the device control processing unit, the signal reception unit receives transmission data output from the signal transmission unit at regular intervals, and the time acquisition unit acquires time information from the transmission data received by the signal reception unit. Shi The time audit control unit receives the execution request for the predetermined function, and the time acquired by the time acquisition unit when the execution request is received is obtained from the time audit certificate data received by the time audit control unit. In the device control method, the execution permission of the predetermined function in the function unit is output when the expiration date is within the valid period.

According to the present invention, it is possible to set the time only at the time of shipment, and thereafter, since it is not subjected to calibration / correction from the external time, it is possible to safely use the electric device using the time by the local clock that is not tampered with. It can be determined whether it is within the expiration date to be guaranteed, and a function as a home appliance or the like can be performed. In addition, the expiration date of this electrical device depends on the time auditing organization. Therefore, it is not possible to operate the electric device by changing the time, and it is possible to prevent the electric device from being used illegally beyond the expiration date.
In addition, since the time label output from the local clock is encrypted, it is possible to prevent the future time from being entered in the electric device. Then, by encrypting the time label in advance and holding it in the local clock, it is not necessary to provide a complicated cryptographic processing device in the local clock. Furthermore, it is not possible to receive the time received in the past again, and it is possible to block replay attacks (observing encrypted data and transmitting the same contents later).
Further, even when the local clock is significantly deviated after the time audit, it is possible to prevent the electric device from being controlled at an incorrect time by checking the time of the two clocks.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is an overall configuration diagram of a device control system according to an embodiment of the present invention. As shown in the figure, the device control system includes a home electric appliance 10 as an electric device and a time inspection station system 70 of a TA (Time Authority). The time auditing bureau system 70 audits the time generated by receiving electric power from an independent power source provided in the home appliance 10 and issues a time audit certificate indicating the audit result. The home electric appliance 10 is an arbitrary device such as a gas device or a heating device that operates by electricity, and is connected to the time audit station system 70 by a network such as ISDN, for example.

The home appliance 10 does not start up without a local clock, and the expiration date of the local clock is equal to or shorter than the operation guarantee expiration date of the home appliance 10, so that replacement is necessary when the expiration date of the local clock comes. is there. The time (capacity) that can be issued by the local clock can be limited to, for example, 2 years, 3 years, 5 years.
The local clock of the home appliance 10 counts the time set by the time of TA by the power of its own battery. When the home appliance 10 is shipped from the factory, the time is audited by the TA with the local clock attached. Receive. The time audit bureau system 70 issues a time audit certificate having an operation guarantee period of the home appliance 10 or an expiration date indicating a time limit that the home appliance 10 can use before the next inspection. Although the time audit is performed once at the time of shipment from the factory, it is possible to extend the time limit by performing a re-time audit by the factory or specialist staff. Even when the local clock is replaced, a time audit will be taken, but even if a time audit certificate that exceeds the time limit of the first time audit certificate at the time of shipment from the factory or by a specialist staff, etc. The home appliance 10 cannot be used beyond the initial expiration date.

  FIG. 2 is a functional block diagram of home appliance 10 according to an embodiment of the present invention. In the figure, the home appliance 10 includes a device control device including a local clock unit 20, a power control processing unit 30, a communication unit 50, and a display unit 52, a power switch 60, a first power control unit 61, and a main unit. And a functional unit 62.

  The communication unit 50 transmits / receives data to / from other devices via a network, and here, communicates with the time auditing station system 70. The display means 52 is a display or lamp such as an LCD (Liquid Crystal Display). For example, the main function unit 62 realizes a function as a home appliance such as a gas appliance or a heating appliance, but the type of the appliance and its main function may be arbitrary. The power switch 60 is a switch for operating the main function unit 62, and the first power control unit 61 always supplies power to the power control processing unit 30 by an external power source and also supplies power from the power control processing unit 30. When the ON permission is received, the main function unit 62 is supplied with power.

  The local clock unit 20 which is a hardware security module (HSM) is detachable from the power supply control processing unit 30, and includes time setting means 21, independent power supply means 22a and 22b, oscillation means 23a and 23b, time control means 24a and 24b. Time A temporary holding means 25a, time B temporary holding means 25b, encrypted time label holding means 26a and 26b, and signal transmission means 27.

  The independent power supply means 22a supplies power to the oscillation means 23a, and the independent power supply means 22b supplies power to the oscillation means 23b. The oscillating means 23a and 23b generate and output an oscillation signal having a predetermined frequency based on the frequency of the source oscillator. The time control unit 24a generates a time using the oscillation signal output from the oscillation unit 23a, and temporarily writes the generated time in the time A temporary holding unit 25a. Similarly, the time control unit 24b generates a time using the frequency signal output from the oscillation unit 23b, and temporarily writes the generated time in the time B temporary holding unit 25b. Here, the time generated by the time control unit 24a using the oscillation signal A that is the oscillation signal from the oscillation unit 23a is referred to as time A, and the time control unit 24b uses the oscillation signal B that is the oscillation signal from the oscillation unit 23b. The time to be generated is time B. The encryption time label holding means 26a and 26b store information in which the time is associated with the encryption time label corresponding to the time, and the time control means 24a is the encryption time corresponding to the generated time A. The encryption time A which is a label is read from the encryption time label holding unit 26a and output to the signal transmission unit 27, and the time control unit 24b converts the encryption time B which is the encryption time label corresponding to the generated time B into the encryption time. Read from the label holding means 26 b and output to the signal transmitting means 27. The signal transmission unit 27 outputs the information on the encryption time A and the encryption time B, the identification number of the local clock unit 20, and information for checking the validity to the power supply control processing unit 30.

  The power supply control processing unit 30 that is an HSM controls the operation permission / denial of the main function unit 62 by instructing the power supply permission / non-permission to the first power supply control unit 61 and operates by supplying power from the outside. To do. The power control processing unit 30 includes a signal receiving unit 31, a decrypting unit 32, encrypted time label holding units 33a and 33b, a local clock identification number confirmation unit 34, a time A holding unit 35a, a time B holding unit 35b, and a power control unit. 36, a time audit control unit 37, a signature key / certificate holding unit 38, a time audit certificate holding unit 39, and a time comparison unit 40.

  The signal receiving unit 31 receives the encryption time A, the encryption time B, the identification number of the local clock unit 20, and the validity confirmation information from the local clock unit 20. The decrypting means 32 refers to the encrypted time label holding means 33a that stores information in which the time A and the encrypted time A are associated with each other, decrypts the received encrypted time A into the time A, and sends it to the time A holding means 35a. Write. Similarly, the decrypting means 32 decrypts the encrypted time B received with reference to the encrypted time label holding means 33b that stores the information that associates the time B with the encrypted time B into the time B, and the time B holding means Write to 35b. The local clock identification number confirmation unit 34 confirms the validity of the local clock unit 20 that has output the encryption time A and the encryption time B based on the received identification number and validity confirmation information of the local clock unit 20.

  The time audit control unit 37 sends the time A information to the time auditing authority system 70 and the device authentication certificate data (hereinafter simply referred to as “device authentication certificate”) of the home appliance 10 read from the signature key / certificate holding unit 38. Is sent to the time audit bureau system 70, and the returned time audit certificate data (hereinafter simply referred to as “time audit certificate” or “time audit certificate”) is time audited. Write to the certificate holding means 39. The power supply control unit 36 receives a power-on request from the first power supply control unit 61, and confirms whether the period for periodic inspection of the household electrical appliance 10 has passed or the operation guarantee deadline for the household electrical appliance 10 has not passed. Then, it is determined whether or not the main function unit 62 is operable, and if it is operable, the first power supply control unit 61 is instructed to permit power ON. The time comparison means 40 determines whether the currently held time information is correct by comparing time A and time B.

  The time auditing bureau system 70 includes a time auditing unit 71 that receives a time auditing request, and a time auditing certificate issuing unit 72 that returns a time auditing certificate for the time set in the received time auditing request. In the time audit certificate, how much time the audit target time is from the exact current time managed by the time auditing bureau system 70 and synchronized with UTC (Coordinated Universal Time) with high accuracy. Information including the information of the time auditing authority added to the information of the error indicating the time limit and the expiration date, but if the time difference between the audit target time and the UTC time is large, A zero value is set as the expiration date.

FIG. 3 shows an example of data held by the encrypted time label holding unit 26a of the local clock unit 20. The encrypted time label holding unit 26b holds similar data.
The encrypted time label holding means 26a, 26b includes a time label indicating time information, an encrypted time label corresponding to the time label, a hash value generated from the encrypted time label and the identification number, and the remaining number of days. Information associated with the label and an identification number identifying the local clock unit 20 are held, and these pieces of information are output to the power supply control processing unit 30 as transmission data. By holding such data, the local clock unit 20 can generate the information of the time A and time B generated by itself only during the date and time period indicated by the time labels held by the encrypted time label holding means 26a and 26b. It is possible to make it impossible to output the time from the local clock unit 20 when it is output to the power control processing unit 30 and the period has passed. In the following, the encryption time label, identification number, hash value, and remaining days label corresponding to time A will be referred to as encryption time label A, identification number A, hash value A, and remaining days label A. The corresponding encryption time label, identification number, hash value, and remaining day number label are described as encryption time label B, identification number B, hash value B, and remaining day number label B.

  The hash value held in the encryption time label holding means 26a, 26b is, for example, 40 hexadecimal digits by using an algorithm such as SHA1 (Secure Hash Algorithm 1) from information obtained by combining the encryption time label and the identification number. A hash value of (160 bits) is calculated, and only the first 20 digits of the calculated hash value are extracted. In addition, the remaining number of days label indicates how many days are left until the date indicated by the label corresponding to the last time among the held time labels, that is, until the date when it becomes unusable. . By displaying the remaining number of days indicated by the remaining number of days label on the display means 52, it is possible to notify the user that the expiration date of the local clock unit 20 is almost over and prompt the user to replace the local clock unit 20 with a new one. Note that the date and time when “−1” is set in the remaining number of days label indicates that there is a sufficient number of days until the expiration date of the local clock unit 20 is reached. Further, the remaining time may be used instead of the remaining days.

FIG. 4 shows an example of data held by the encrypted time label holding unit 33a of the power control processing unit 30. The encrypted time label holding unit 33b also holds similar data.
In the figure, encrypted time label holding means 33a and 33b hold information in which an encrypted time label is associated with a decryption time label indicating a time after decryption of the encrypted time label. For example, the encrypted time label holding means 26a, 26b holds information for three years, and the encrypted time label holding means 33a, 33b holds information for 20 years. In addition, information corresponding to the time of a sufficiently longer period than the encrypted time label holding means 26a, 26b is held. In addition, you may make it hold | maintain the information for the period corresponding to the expiration date of the household appliances 10 in encryption time label holding | maintenance means 33a, 33b. Thereby, when the expiration date of the home appliance 10 has passed, the time cannot be decoded. Hereinafter, a decryption time label corresponding to the encryption time label A is referred to as a decryption time label A, and a decryption time label corresponding to the encryption time label B is referred to as a decryption time label B.

FIG. 5 is a diagram for explaining a power control status flag held as permission information in the storage unit included in the power control unit 36.
As shown in the figure, the power control status flag includes four flags F0 to F3, and a time normal flag or a time abnormal flag is set in each of the flags F0 to F3. In the flag F0, a time normal flag N0 indicating that the local clock unit 20 is normal or a time abnormality flag E0 indicating that the local clock unit 20 is abnormal is set. In the flag F1, a time normal flag N1 indicating that the time audit is normal or a time abnormality flag E1 indicating that the time audit is abnormal is set. In the flag F2, a time normal flag N2 indicating that it is within the valid period indicated by the time audit certificate or a time abnormality flag E2 indicating that it is outside the valid period is set. As a result of the comparison between time A and time B, a time normal flag N3 indicating that the time is normal or a time abnormality flag E3 indicating that the time is abnormal is set in the flag F3.

FIG. 6 is a diagram illustrating a relationship between the expiration date set in the time audit certificate and the expiration date of the home appliance 10.
As shown in the figure, when the home appliance 10 receives a time audit certificate from the time audit bureau system 70 as an initial time audit result with respect to a time generated by the local clock unit 20 initially mounted at the time of factory shipment, The expiration date information set in the audit certificate is held and used as the expiration date information of the home appliance 10. The time audit certificate once received is stored in the time audit certificate holding unit 39 of the home appliance control processing unit 30 and when the local clock unit 20 is replaced, the local clock identification number confirmation unit of the home appliance control processing unit 30 is stored. 34 sets a power control status flag for invalidating the stored time audit certificate. When the local clock unit 20 is replaced, a time audit is further performed with respect to the time generated by the replaced local clock unit 20, and a time audit certificate is received from the time audit station system 70 as the audit result. If the expiration date of the time audit certificate received after the second time is a date earlier than the expiration date by the initial time audit, whether the time generated by the local clock unit 20 is normal for the expiration date information The expiration date in the initial time audit is continuously used as the expiration date of the home appliance 10.

The validity period set in the time audit certificate can be used as (1) the operation guarantee period of the home appliance 10 or (2) the period until the next inspection of the home appliance 10.
In the case of (1), the household electrical appliance 10 has information on the expiration date (for example, 20) set in the time audit certificate received as the audit result of the time generated by the local clock unit 20 that is first mounted at the time of factory shipment. Year) is used as information indicating the operation guarantee period of the home electric appliance 10. At this time, in the local clock unit 20, the time label corresponding to the period until the next inspection (for example, three years) is sent to the encrypted time label holding means 26a and 26b so as to generate the time until the next inspection of the home appliance 10. When this period has passed, the time information cannot be output. Therefore, by displaying the number of remaining days based on the remaining number of days label, the next inspection of the home electric appliance 10 is near to the user, and after that, the home electric appliance 10 is not usable. Then, as a result of the inspection by the supplier, if the home electric appliance 10 is normal, the new local clock unit that holds the time label corresponding to the period until the next inspection (for example, one year). Change to 20. A time audit is performed again on the time generated by the new local clock unit 20, and a time audit certificate is received from the time audit station system 70 as the audit result. However, the expiration date of the time audit certificate is not used as the expiration date of the home appliance 10.

  On the other hand, in the case of (2), the home electric appliance 10 is set in the time audit certificate received from the time auditing bureau system 70 as the audit result of the time generated by the local clock unit 20 that is first mounted at the time of factory shipment. The expiration date information is held as information (for example, three years) indicating a period until the next inspection of the home electric appliance 10. At this time, the local clock unit 20 has an expiration date for guaranteeing that the local clock unit 20 can operate correctly (for example, the period during which the independent power supply units 22a and 22b can supply power, and the oscillation units 23a and 23b have an accurate time. The time label corresponding to the period in which the oscillation signal can be generated) is held, and when this period has passed, the time information cannot be output. Therefore, by displaying the number of remaining days based on the remaining days label, the user is informed that the life of the local clock unit 20 is near and beyond that the household electrical appliance 10 becomes unusable. When the user replaces the local clock unit 20, the time generated by the new local clock unit 20 is audited again, and the time audit certificate is received from the time audit station system 70 as the audit result. However, the expiration date of the time audit certificate is not used as the expiration date of the home appliance 10.

  Then, before and after the next inspection date, the contractor inspects the home appliance 10, and as a result, if the home appliance 10 is normal, the contractor inputs a time limit extension instruction to the home appliance 10. Alternatively, if the home appliance 10 is a so-called network home appliance connected to a network, a maintenance company inspects the home appliance 10 with an inspection terminal connected via the network, and as a result, the home appliance 10 is normal. In such a case, the terminal or the like transmits a time limit extension instruction to the home appliance 10 via the network. As a result, when the home appliance 10 requests time auditing based on the time generated by the local clock unit 20, and receives the time audit certificate from the time auditing authority system 70 as the audit result, the home appliance 10 is set to the time audit certificate. The information indicating the period until the next inspection of the home electric appliance 10 is updated with the information on the expiration date (for example, one year).

Next, the operation of the home appliance 10 will be described.
FIG. 7 is a diagram showing an outline operation flow of the home appliance 10, and each flow is repeatedly executed.
First, at the factory, initial setting of time A and time B is performed in the local clock unit 20 (step S101). After the initial setting, the local clock unit 20 starts generating time A and time B, and corresponds to the generated time A every time time A is generated at a constant cycle (for example, every second). Encrypted time label corresponding to the generated time B each time the generated data A including the encrypted time label A, the identification number A, the hash value A, and the remaining number of days label A is generated. Transmission data B including information of B, identification number B, hash value B, and remaining days label B is output (step S102).

  The power supply control processing unit 30 checks the validity of the transmission data each time it receives transmission data A and transmission data B from the local clock unit 20, and transmits the time A from the encrypted time label A of the transmission data A. Time B is obtained from the encryption time label B of data B (step S111). The power supply control processing unit 30 compares the obtained time A and time B to determine whether the time is normal, and holds a power control status flag indicating the determination result as permission information (step S112). ).

  The power supply control processing unit 30 sends a time audit request in which the information on the time A obtained in step S111 and the device authentication certificate of the household electrical appliance 10 are set, when the local clock unit 20 is attached or when a time limit extension instruction is issued. At the time of input, it is transmitted to the time audit bureau system 70. Thereby, the time audit certificate indicating the time audit result is received from the time audit station system 70 (step S121). The power supply control processing unit 30 determines whether a time audit certificate indicating that the time is an error within the normal time is received, and holds a power supply control status flag indicating the determination result as permission information. Further, when the power supply control processing unit 30 receives a time audit certificate indicating that the time is an error within the normal time, the time audit certificate is the first time audit certificate or the time limit is extended. When the time audit certificate is a result of time audit performed by inputting an instruction, the expiration date information of the time audit certificate is held as the expiration date information of the home appliance 10.

  The power supply control processing unit 30 holds the received time audit certificate, and the time A notified from the local clock unit 20 every predetermined time (for example, every time reception data is received or once a day). Checks whether or not the expiration date indicated by the held time audit certificate has been exceeded (step S122). The power supply control processing unit 30 holds the received time audit certificate until the next time audit certificate is received.

  When the user turns on the power switch 60 of the home appliance 10, the power control processing unit 30 receives a power ON request as an execution request for the main function unit 62 from the first power control unit 61. Based on the permission information (power control status flag), the power control processing unit 30 determines that the time based on the comparison between the time A and the time B is normal in step S112, and the time from the time audit certificate received in step S121. Is determined to be a normal error, and it is confirmed that the current time is determined to be within the expiration date of the home appliance 10, the main function unit 62 is transferred to the first power supply control unit 61. As a permission for execution, power ON permission is returned (step S131).

  Next, the detailed operation of the home appliance 10 will be described. Here, it is assumed that the oscillating means 23a and 23b output an oscillation signal having a period of 1 second.

FIG. 8 is a detailed flow of the time initial setting process in step S101 of FIG. Here, a case where the initial setting of time A is performed will be described.
The time setting unit 21 of the local clock unit 20 determines whether a flag indicating that the time A has been initialized is set in the storage unit provided in the time setting unit 21 (step S201). When the time setting means 21 determines that the flag indicating that the time A has been initialized is not set (step S201: YES), the time setting means 21 receives a time label based on the time output from the TA from an external time setting device. Then, the reception timing of the time label is synchronized with the oscillation signal A generated by the oscillation means 23a (step S202). The time setting means 21 determines whether or not the synchronization error resulting from the synchronization in step S202 is smaller than a predetermined specified value (step S203). If it is determined that the value is equal to or greater than the predetermined specified value (step S203: NO), the process returns to step S202 and the synchronization process is performed again.

When it is determined that the synchronization error resulting from the synchronization in step S202 is smaller than the predetermined specified value (step S203: YES), the time control unit 24a displays the time label indicating the acquired time A as time A temporary. The time setting means 21 sets the flag indicating that the time A has been initialized (step S205) in the storage means included in the time setting means 21 (step S205).
If it is determined in step S201 that the flag indicating that the time A has been initially set is set (step S201: NO), the process ends.

  Although the initial setting process for time A has been described above, the same applies to the initial setting for time B. In the case of the initial setting process for time B, the oscillating means 23a, the time control means 24a, the time A temporary holding means 25a, the oscillation signal A, and the time A are respectively set to the oscillating means 23b, the time control means 24b, the time B temporary holding means 25b, The oscillation signal B and time B may be replaced.

FIG. 9 is a detailed flow of the time generation transmission process in step S102 of FIG. Here, the case of performing time generation transmission processing at time A will be described.
The time control unit 24a obtains a time A ′ that is a past time A held in the time A temporary holding unit 25a based on the oscillation rising timing of the oscillation signal A output from the oscillation unit 23a (oscillation unit A). Then, a new time A is generated by adding 1 second to the time A ′, and is set in the time A temporary holding means 25a (step S301). The time control unit 24a reads the information of the encrypted time label A, the identification number A, the hash value A, and the remaining number of days label A corresponding to the time A from the encrypted time label holding unit 26a (step S302). The time control unit 24a determines whether or not the information has been successfully read from the encrypted time label holding unit 26a based on whether the read data is 0 (step S303). If it is determined that the information has been successfully read (step S303: YES), the signal transmission unit 27 reads the encrypted time label A, the identification number A, the hash value A, and the read value from the encrypted time label holding unit 26a. Then, the transmission data A including the information of the remaining number of days label A is transmitted to the power control processing unit 30 (step S304), and the processing from step S301 is repeated again. If it is determined that reading of information from the encrypted time label holding unit 26a has failed (step S303: NO), the process ends.

  Although the time generation / transmission process at time A has been described above, the same applies to the time generation / transmission process at time B. In the case of time generation transmission processing at time B, the oscillation means 23a, time control means 24a, time A temporary holding means 25a, encrypted time label holding means 26a, oscillation signal A, time A, time A ', transmission data A, encryption Oscillating means 23b, time control means 24b, time B temporary holding means 25b, encrypted time label holding means 26b, oscillation signal B, time B, respectively. , Time B ′, transmission data B, encrypted time label B, identification number B, hash value B, remaining number of days label B.

FIG. 10 is a detailed flow of the time setting process in step S111 of FIG. Here, the case where the time setting process of time A is performed will be described.
The signal receiving means 31 of the power supply control processing unit 30 receives the transmission data A from the local clock unit 20 (step S401). The decryption means 32 determines whether the encryption time label A set in the transmission data A is not all 0 (a series of 0s) and does not match the encryption time label A received before. It is determined whether label A is invalid (step S402). When it is determined that the encryption time label A is valid (step S402: YES), the decryption means 32 obtains the decryption time label A corresponding to the encryption time label A from the encryption time label holding means 33a. Read (step S403). At this time, processing is performed by sequentially searching the rows after the row from which the previous decoding time label A is read, or by searching only the rows near the row from which the previous decoding time label A is read. Can be speeded up. The decoding unit 32 acquires the time A ′ that is the past time A held in the current time A holding unit 35a, and the time indicated by the read decoding time label A, that is, the time A is the time A It is determined whether the time is ahead of '(step S404).

  When it is determined that the time A is a time advanced from the time A ′ (step S404: YES), the local clock identification number confirmation unit 34 confirms the validity by the clock identification (step S405). Details of this processing will be described later.

  When the local clock identification number confirmation means 34 determines that the clock identification is valid, the decryption means 32 stores the decryption time label A in the time A holding means 35a (step S406), and the power control means 36 The clock normal flag N0 is set in the storage means provided (step S407). When the remaining number of days label A set in the transmission data A is a negative value (step S408: YES), the decrypting means 32 repeats the processing from step S401 again, and the remaining number of days label A is a positive value. If this is the case (step S408: NO), the remaining number of days is displayed on the display means 52, or a warning is output by a warning means (not shown) (for example, a device that informs the user that the local clock replacement time is near) ( Step S409), the processing from step S401 is repeated again.

  When it is determined in step S402 that the encrypted time label A is invalid (step S402: NO), or when it is determined in step S404 that the time A is not a time advanced from the time A ′ (step S402). (S404: NO), the decoding unit 32 sets the clock abnormality flag E0 in the storage unit included in the power supply control unit 36 (step S410), and ends the process.

  Although the time setting process when the transmission data A is received has been described above, the same applies to the time setting process when the transmission data B is received. In the case of time setting processing when transmission data B is received, encrypted time label holding means 33a, time A holding means 35a, time A, time A ′, transmission data A, encrypted time label A, and decryption time label A , Identification number A, identification number A ′, hash value A, remaining number of days label A are encrypted time label holding means 33b, time B holding means 35b, time B, time B ′, transmission data B, encrypted time label, respectively. B, decryption time label B, identification number B, identification number B ′, hash value B, and remaining number of days label B may be replaced.

FIG. 11 is a detailed flow of the time comparison process in step S112 of FIG.
The time comparison unit 40 acquires the time A information from the time A holding unit 35a and the time B information from the time B holding unit 35b (step S501), and the time error between the time A and the time B is a predetermined rule. It is determined whether it is smaller than the value (step S502). When it is determined that the time difference between the time A and the time B is smaller than the predetermined specified value (step S502: YES), the time comparison unit 40 sets the clock normal flag N3 in the storage unit included in the power control unit 36. (Step S503), the process returns to Step S501. On the other hand, when it is determined that the time difference between the time A and the time B is equal to or greater than a predetermined specified value (step S502: NO), the time comparison unit 40 stores the clock abnormality flag in the storage unit included in the power supply control unit 36. E3 is set (step S504), and a warning is output by the display means 52 or a warning means (not shown) to prompt the exchange of the local clock (step S505).

FIG. 12 is a detailed flow of the time audit process in step S121 of FIG. 7 executed when the local clock unit 20 is attached. The attachment of the local clock unit 20 can be recognized, for example, by detecting that the identification information A set in the transmission data A is different from the identification information A received so far.
The time audit control unit 37 detects the mounting of the local clock unit 20 or receives a time audit instruction from the time audit station system 70 (step S601). The time audit control unit 37 receives the TA device authentication certificate from the time audit station system 70 (step S602) and confirms the validity (step S603). Further, by transmitting the device authentication certificate of the home electric appliance 10 acquired from the signature key / certificate holding means 38 to the time inspection authority system 70, the time inspection authority system 70 confirms that the electric home appliance 10 is correct ( In step S603: YES), the communication unit 50 establishes communication with the time audit station system 70 by encrypted communication using SSL (Secure Socket Layer) or the like. The time audit control unit 37 acquires the time A from the time A holding unit 35a, and transmits a time audit request in which the acquired time A is set to the time audit station system 70 (step S604).

  When an abnormality such as a communication error does not occur and the transmission of the time audit request is successful (step S605: YES), the time audit control unit 37 receives the time audit certificate from the time audit station system 70. The time audit control unit 37 writes the received time audit certificate and the identification number A in the transmission data A in the time audit certificate holding unit 39 (step S606). The time audit control unit 37 determines that the time audit is successful if a normal value (positive value) is set in the expiration date information of the received time audit certificate (step S607: YES), and It is determined whether an initial time audit certificate has been received in the past (step S608). This can be determined, for example, based on whether or not the expiration date information of the household electrical appliance 10 has already been set in the storage unit included in the power control unit 36. When the initial time audit certificate has not been received (step S608: NO), information on the expiration date of the time audit certificate is set in the storage unit included in the power control unit 36, and the clock normal flags N1 and N2 are set. Is set (step S609).

  On the other hand, if the initial time audit certificate has already been received (step S608: YES), the validity period of the home appliance 10 is set in the storage means included in the power control means 36 within the validity period of the initial time audit certificate. Then, the clock normal flags N1 and N2 are set (step S609). That is, the expiration date information of the home appliance 10 held in the storage unit included in the power supply control unit 36 is compared with the expiration date information of the received time audit certificate, and the expiration date held in the storage unit is compared. If the expiration date is shorter, the expiration date stored in the storage means is kept as it is. If the expiration date of the received time audit certificate is shorter, the expiration date information set in the time audit certificate is used. Then, the expiration date information of the home appliance 10 held in the storage unit is updated (step S610).

  After setting the expiration date of the home appliance 10 in step S609 or S610, the time comparison unit 40 acquires the audit time in the time audit certificate, the time A acquired from the time A holding unit 35a, and the time B holding unit 35b. Based on the information of time B, the time error of time B with respect to the audit time in the time audit certificate is calculated (step S611). When the time error of the calculated time B with respect to the TA time is smaller than a predetermined specified value (step S612: YES), the process ends.

  If it is determined in step S603 that the TA device authentication certificate is not correct (step S603: NO), if the time audit request transmission fails in step S605 (step S605: NO), the processing is performed as it is. finish. In step S607, if the time expiration date information in the time audit certificate is not positive (step S607: NO), or the time error of the calculated time B with respect to the TA time is greater than or equal to a predetermined specified value. In the case (step S612: NO), the clock abnormality flag E1 is set in the storage means provided in the power supply control means 36 (step S613). At this time, a warning may be output by the display means 52 or a warning means (not shown) to prompt the exchange of the local clock.

  FIG. 13 is a detailed flow of the time audit process in step S121 of FIG. 7 that is executed when the home appliance 10 receives a time limit extension instruction. In FIG. 13, the processing from step S651 to S657 is the same as the processing from step S601 to S607 in FIG. In FIG. 13, the process of determining whether the initial time audit certificate is received in step S <b> 608 in FIG. 12 is not performed, and the storage unit included in the power supply control unit 36 stores the time in the same manner as in step S <b> 609. The information on the expiration date of the audit certificate is set as the expiration date of the home electric appliance 10, and the clock normal flags N1 and N2 are set (step S608). The subsequent steps S659 to S661 are the same as the steps S611 to S613 in FIG.

FIG. 14 is a detailed flow of the validity check process for the time audit certificate in step S122 of FIG.
When the time normal flag N1 is set in the power supply control unit 36 (step S701), the time audit control unit 37 reads the information on the time A from the time A holding unit 35a (step S702). When the read time A is within the expiration date set in the time audit certificate held in the time audit certificate holding means 39 (step S703: YES), the time audit control means 37 is a power control means. The time normal flag N2 is set in the storage means provided in 36 (step S704). Further, the time audit control unit 37 determines whether or not the expiration date set in the time audit certificate comes after the specified number of days (or time) (step S705). If it is determined that the expiration date is not yet reached after the specified number of days (or time), the processing from step S701 is repeated. On the other hand, if it is determined that the expiration date will be reached after the specified number of days (or time), the number of remaining days or remaining time is displayed on the display means 52 or warning means (not shown) to warn that the time audit certificate is nearing its expiration date. (Step S706), and the processing from Step S701 is repeated.

The time audit control unit 37 ends the process when the time normal flag N1 is not set in the power supply control unit 36 (step S701: NO).
In step S703, if the read time A exceeds the expiration date set in the time audit certificate (step S703: NO), the time abnormality flag E2 is set in the storage unit included in the power control unit 36. (Step S707).

FIG. 15 is a detailed flow of the power supply function control process in step S131 of FIG.
When the user operates the power switch 60 to turn on the power, the first power control unit 61 receives a power on request from the power switch 60 and outputs the power on request to the power control processing unit 30. Thereby, the power supply control means 36 of the power supply control processing unit 30 receives the power supply ON request (step S801). When the clock normal flag N0 is set in the storage means included in the power supply control unit 36 (step S802: YES) and the time normal flag N3 is set by time comparison (step S803: YES), Information on the time A, which is the current time, is acquired from the time A holding means 35a (step S804). The power supply control means 36 refers to the storage means provided in itself, the time A is within the validity period of the home appliance 10, and the validity indicated by the time audit certificate held in the time audit certificate holding means 39. When it is determined that the time is within the time limit and the time normal flags N1 and N2 have been set (step S805: YES), the power supply ON permission is output to the first power supply control unit 61. When receiving the power ON permission, the first power control unit 61 supplies power from the external power source to the main function unit 62.

  When the clock normal flag N0 is not set in the storage unit included in the power supply control unit 36 (step S802: NO), or when the time normal flag N3 is not set (step S803: NO), the time A is home appliance. 10 or when the time audit certificate is not within the expiration date, or when the time normal flags N1 and N2 are not set in the storage means (step S805: NO), the power supply control means 36 sets the power ON non-permission. The power is output to one power supply control unit 61 (step S807). The first power supply control unit 61 does not supply power from the external power supply to the main function unit 62 when receiving the power ON non-permission.

FIG. 16 is a flowchart of the time audit certificate presence / absence confirmation process, which is executed at predetermined time intervals before the time audit certificate expiration date check process of FIG.
The time audit control unit 37 determines whether or not the time audit certificate holding unit 39 holds the time audit certificate (step S901). When the time audit certificate is held, the time audit certificate expiration date check process shown in FIG. 14 is executed (step S902), and the processes from step S901 are repeated. On the other hand, when the time audit certificate is not held in the time audit certificate holding means 39, the clock abnormality flags E1 and E2 are set in the storage means provided in the power supply control means 36, and the processing from step S901 is repeated (step S901). S903).

FIG. 17 is a detailed flow of the clock identification confirmation process in step S405 of FIG.
The local clock identification number confirmation unit 34 uses the SHA1 that is the same algorithm as the hash algorithm held in the local clock unit 20 from information obtained by combining the encrypted time label A and the identification number A set in the transmission data A. A hash value α is calculated using an algorithm (step S1001). If the first 20 digits of the calculated hash value α are the same as the hash value A set in the transmission data A (step S1002: YES), the local clock identification number confirmation unit 34 determines the time audit certificate holding unit 39. Is acquired (step S1003), and it is determined whether it matches the identification number A acquired from the transmission data A (step S1004). When the identification number A ′ and the identification number A match (step S1004: YES), the local clock identification number confirmation unit 34 terminates the processing. When the identification number A ′ and the identification number A do not match (step S1004: NO), the local clock identification number confirmation unit 34 Abnormal flags E1 and E2 are set (step S1005).

  If it is determined in step S1002 that the calculated hash value α does not match the hash value A set in the transmission data A, the local clock identification number confirmation unit 34 stores the time audit certificate holding unit 39. The stored time audit certificate is erased (step S1006), and the clock abnormality flag E0 is set in the storage means included in the power supply control means 36 (step S1007).

  In the above, the clock identification confirmation process when the transmission data A is received has been described, but the same applies to the clock identification confirmation process when the transmission data B is received. In the case of the clock identification confirmation processing when the transmission data B is received, the transmission data A, the encryption time label A, the identification number A, the hash value A, and the identification number A ′ are respectively set to the time B, the transmission data B, and the encryption time. The label B, the identification number B, the hash value B, and the identification number B ′ may be replaced.

As described above, the home appliance control processing unit 30 receives a time audit certificate in the past by including the unique identification number for identifying the local clock unit 20 and the hash value in the transmission data transmitted from the local clock unit 20. Compared with the identification number of the watch, if there is a change, the time audit certificate received in the past is invalidated. Although the hash value is generated from the encrypted time label and the identification number, the home appliance control processing unit 30 stores the hash value because there is no need to create the encrypted time label for each local clock unit 20. Power decoding data can be reduced. Further, it is possible to prevent the time audit certificate from being used continuously by inputting a new local clock unit 20 and a fake identification number (because it is fixed).
Therefore, as long as the time audit certificate is within the validity period, even when the power of the home appliance 10 is turned off, it is not necessary to receive a new time audit again at the time of startup, and power control can be performed.

FIG. 18 shows an example of the hardware configuration of the home appliance 10.
18, the home appliance 10 includes a CPU 111, a ROM 112, a RAM 113, a storage unit 114, a hardware security unit 115, a communication control unit 116, an input / output I / F 117, a display unit 118, a first power supply control unit 61, and a main function unit. 62 is connected by a bus 119.
The CPU 111 reads a system program from the ROM 112 and controls each unit. The RAM 113b includes a work area when the CPU 111 executes various programs. The storage unit 114 is a hard disk or the like, and stores various programs as well as data. The hardware security unit 115 implements the home appliance control processing unit 30. The communication control unit 116 controls the output and input of data to the outside by the input / output I / F 117, thereby realizing the communication unit 50. The display unit 118 is a display device such as a display, and implements the display unit 52.

  The hardware security unit of the local clock unit 20 includes a CPU (central processing unit) 101a, an EEPROM (Electronically Erasable and Programmable Read Only Memory) 102a, a RAM (Random Access Memory) 103a, a power supply unit 104a, a clock 105a, and an input I / F. (Interface) 106a and output I / F 107a are connected by bus 108a, and CPU 101b, EEPROM 102b, RAM 103b, power supply unit 104b, clock 105b, input I / F (interface) 106b, and output I / F 107b are buses It consists of the structure connected by 108b.

The CPU 101a is a central processing unit that performs calculation and control, and implements the time setting means 21 and the time control means 24a of FIG. The EEPROM 102a stores the programs of the time setting unit 21 and the time control unit 24a, and realizes the encrypted time label holding unit 26a. The RAM 103a is a readable / writable memory, and includes a work area when the CPU 101a executes various programs, and implements the time A temporary holding means 25a. The power supply unit 104a implements the independent power supply unit 22a, and the timepiece 105a implements the oscillation unit 23a.
Similarly, the CPU 101b realizes the time setting means 21 and the time control means 24b, and the EEPROM 102b stores the programs of the time setting means 21 and the time control means 24b, and the time setting means 21 and the encrypted time label holding means 26b. Realize. The RAM 103b includes a work area when the CPU 101b executes various programs, and implements the time B temporary holding unit 25b. The power supply unit 104b implements the independent power supply unit 22b, and the timepiece 105b implements the oscillation unit 23b.
The input I / Fs 106 a and 106 b enable data reception from the outside, realize the time setting means 21, and the output I / Fs 107 a and 107 b enable data transmission to the power supply control processing unit 30. Thus, the signal transmission means 27 is realized.

The hardware security unit 115 of the home appliance control processing unit 30 includes a CPU 121, a ROM 122, a RAM 123, and an EEPROM 124, and is connected to the output I / Fs 107a and 107b of the local clock unit 20 through communication lines.
The CPU 121 reads the program from the ROM 122 and realizes the decryption means 32, the local clock identification number confirmation means 34, the power supply control means 36, the time audit control means 37, and the time comparison means 40. The RAM 123 implements time A holding means 35a, time B holding means 35b, and time audit certificate holding means 39, and the EEPROM 124 implements encrypted time label holding means 33a and 33b and signature key / certificate holding means 38. .

  FIG. 19 is a diagram showing an appearance of a tamper-resistant local timepiece used as the local timepiece unit 20. The tamper-resistant local timepiece has an internal module case in which internal modules consisting of CPU, RAM, EEPROM, oscillator, battery, etc. are packaged with resin, and a signal transmission terminal for inputting external signals to the internal module (initial time setting) And a terminal X and a terminal Y connected to a terminal of a coil wound around the internal module case.

  FIG. 20 is a diagram illustrating a module configuration of the local clock unit 20. 20A shows the shape of the coil 1, and FIG. 20B shows the shape of the coil 2. Each of the coil 1 and the coil 2 is one electric wire, and the coil 1 is wound around the inner module, and the coil 2 is wound around the coil 1 in a direction perpendicular to the coil 1. Then, the coil terminal X is connected to one terminal of the coil 1, the other terminal of the coil 1 is connected to one terminal of the coil 2, and the other terminal of the coil 2 is connected to the coil terminal Y. The coil terminal X and the coil terminal Y act as one electric wire. After the coils 1 and 2 are wound in this way, the resin is packaged in an external module case as shown in FIG. 20C, resulting in a module configuration as shown in FIG.

  FIG. 21 is a diagram for explaining unauthorized operation detection of the tamper resistant local timepiece. As shown in the figure, the tips of the coils are respectively connected to two terminals of a switch connected to the CPU. In such a configuration, when the coil is broken, the CPU detects the disconnection and erases the data of the encrypted time label stored in the EEPROM.

Specifically, when the coil is connected from the outside of the internal module in the manufacturing process, the initial disconnected state is 0, the coil connected state is 1, and the coil is broken, and the RAM is 2 Above, the initial state 0 is set, and the EEPROM data is protected. Next, when the coil is connected, the CPU detects the connection and sets state 1 on the RAM. If the CPU detects a break in the state where the state 1 is set on the RAM, the state 2 is set and the data on the EEPROM is erased.
With the above mechanism, when the external resin is destroyed for the purpose of unauthorized operation and the coil is destroyed, the encrypted time data on the EEPROM is erased, so the encrypted time label cannot be taken out illegally. It becomes possible to do so.

According to this embodiment, it is possible to set the time only at the time of shipment, and thereafter, since it is not subjected to calibration / correction from the external time, it can be safely used by electrical equipment using the time by a local clock that is not subject to tampering. It can be determined whether it is within the expiration date that guarantees that it can be performed, and the function as a home appliance can be performed. In addition, the expiration date of this electrical device depends on the time auditing organization. Therefore, it is not possible to operate the electric device by changing the time, and it is possible to prevent the electric device from being used illegally beyond the expiration date.
In addition, since the time label output from the local clock is encrypted, it is possible to prevent the future time from being entered in the electric device. Then, by encrypting the time label in advance and holding it in the local clock, it is not necessary to provide a complicated cryptographic processing device in the local clock. Furthermore, it is not possible to receive the time received in the past again, and it is possible to block replay attacks (observing encrypted data and transmitting the same contents later).
Further, even when the local clock is significantly deviated after the time audit, it is possible to prevent the electric device from being controlled at an incorrect time by checking the time of the two clocks.

It is a figure which shows the structure of the apparatus control system by one embodiment of this invention. It is a functional block diagram of the household appliances by the embodiment. It is a figure which shows the example of the data which the encryption time label holding | maintenance means of the local timepiece part by the embodiment hold | maintains. It is a figure which shows the example of the data which the encryption time label holding | maintenance means of the power supply control processing part by the embodiment hold | maintains. It is a figure which shows the example of the power supply control status flag which the power supply control means by the embodiment hold | maintains. It is a figure which shows the relationship between the expiration date set to the time audit certificate by the embodiment, and the expiration date of a household appliance. It is a figure which shows the outline | summary processing flow of the household appliances by the embodiment. It is a figure which shows the time initial setting process flow of the household appliances by the embodiment. It is a figure which shows the time generation transmission process flow of the household appliances by the embodiment. It is a figure which shows the time setting process flow of the household appliances by the embodiment. It is a figure which shows the time comparison processing flow of the household appliances by the embodiment. It is a figure which shows the time audit process flow of the household appliances by the embodiment. It is a figure which shows the time audit process flow of the household appliances by the embodiment. It is a figure which shows the time audit certificate expiration date check processing flow of the household appliances by the embodiment. It is a figure which shows the power supply function control processing flow of the household appliances by the embodiment. It is a figure which shows the time audit certificate presence / absence confirmation processing flow of the household appliances by the embodiment. It is a figure which shows the timepiece identification confirmation processing flow of the household appliances by the embodiment. It is a figure which shows the hardware structural example of the household appliances by the embodiment. It is a figure which shows the structural example of the tamper resistant local timepiece by the embodiment. FIG. 20 is a module configuration diagram of the tamper resistant local timepiece shown in FIG. 19. FIG. 20 is a diagram for explaining unauthorized operation detection of the tamper resistant local timepiece shown in FIG. 19.

Explanation of symbols

10 ... Household appliances 20 ... Local clock part (clock part)
21 ... Time setting means (time setting unit)
22a, 22b ... Independent power supply means (power supply)
23a, 23b ... oscillating means (oscillator, first oscillator, second oscillator)
24a, 24b ... time control means (time control unit, first time control unit, second time control unit)
25a ... Time A temporary holding means 25b ... Time B temporary holding means 26a, 26b ... Encrypted time label holding means (encrypted time holding section)
27: Signal transmission means (signal transmission unit)
30: Power control processing unit (device control processing unit)
31 ... Signal receiving means (signal receiving section)
32: Decoding means (time acquisition unit)
33a, 33b ... Encryption time label holding means (decryption time holding unit)
34 ... Local clock identification number confirmation means (detection unit)
35a ... Time A holding means 35b ... Time B holding means 36 ... Power supply control means (control unit)
37. Time audit control means (time audit control unit)
38 ... Signature key / certificate holding means 39 ... Time audit certificate holding means 40 ... Time comparison means 50 ... Communication means 52 ... Display means (output unit)
60: Power switch 61: First power control unit (power control unit)
62 ... Main function part (function part)
70 ... Time Auditing Bureau System

Claims (18)

A device control device provided in a device having a functional unit having a predetermined function, and comprising a clock unit and a device control processing unit,
The clock unit is
Power supply,
An oscillating unit that receives power supplied from the power source and generates an oscillation signal having a constant period;
A time control unit that generates a time from an oscillation signal generated by the oscillation unit;
A time setting unit that sets the time only once in the time control unit and prohibits the setting of the time thereafter,
A signal transmission unit that outputs transmission data including time information generated by the time control unit at regular intervals, and
The device control processing unit
A signal receiving unit for receiving transmission data output at regular intervals from the signal transmitting unit;
A time acquisition unit for acquiring time information from transmission data received by the signal reception unit;
A time audit control unit for transmitting the time information acquired by the time acquisition unit to the time auditing authority system and receiving time audit certificate data for the transmitted time information;
The execution request for the predetermined function is received, and the time acquired by the time acquisition unit when the execution request is received is within the validity period obtained from the time audit certificate data received by the time audit control unit. A control unit that outputs an execution permission of the predetermined function in the function unit.
A device control apparatus characterized by that. The time audit control unit holds the expiration date set in the first received time audit certificate data in the storage unit as the device expiration date,
The device control processing unit receives the execution request for the predetermined function, information indicating that the time is normal is set in the time audit certificate data received immediately before by the time audit control unit, and When the time acquired by the time acquisition unit when the execution request is received is within the expiration date of the device stored in the storage unit, the execution permission of the predetermined function in the function unit is output. To
The apparatus control apparatus according to claim 1.   The time audit control unit transmits the time information acquired by the time acquisition unit to the time audit bureau system when an instruction to extend the validity period is input, and the time audit certificate for the transmitted time information The device control apparatus according to claim 2, wherein an expiration date set in the data is stored in the storage unit as an expiration date of the device. The oscillating unit includes a first oscillating unit and a second oscillating unit that generate an oscillating signal having a constant period.
The time controller is
A first time control unit for generating time from an oscillation signal generated by the first oscillation unit;
A second time control unit that generates time from the oscillation signal generated by the second oscillation unit,
The time setting unit performs time setting only once for each of the first time control unit and the second control unit, and thereafter prohibits time setting,
The signal transmission unit includes, as the transmission data, first transmission data including time information generated by the first time control unit, and time information generated by the second time control unit. Output the second transmission data including at regular intervals,
The time acquisition unit acquires time information from each of the first transmission data and the second transmission data received as the transmission data,
The device control processing unit further includes an error between a time obtained from the first transmission data and a time obtained from the second transmission data by the time acquisition unit when the execution request is received within a normal range. If there is, the execution permission of the predetermined function in the function unit is output.
The apparatus control apparatus according to any one of claims 1 to 3, wherein   The device control apparatus according to claim 1, wherein the timepiece unit and the device control processing unit have tamper resistance.   The device control apparatus according to claim 1, wherein the clock unit and the device control processing unit are detachable. When a new clock unit is attached to the device control processing unit,
The time audit control unit transmits the time information acquired from the transmission data output from the new clock unit to the time audit station system by the time acquisition unit. Equipment control device. The device control processing unit further includes a detection unit that sets, in the device control information storage unit, information indicating that the received time audit certificate data is invalid when the replacement of the clock unit is detected,
When the information indicating that the time audit certificate data is invalid is set in the device control information storage unit, the control unit regulates output of permission to execute the predetermined function. The device control apparatus according to claim 6 or 7. The signal transmission unit outputs transmission data including encrypted time information that is the encrypted time,
The time acquisition unit decrypts information of an encryption time set in the transmission data;
The device control apparatus according to any one of claims 6 to 8, wherein The clock unit is
An encryption time holding unit that holds information in which the time and the encryption time of the time are associated with each other;
The signal transmission unit reads the encryption time information corresponding to the time generated by the time control unit from the encryption time holding unit, and outputs transmission data including the read encryption time information.
The apparatus control apparatus according to claim 9. The device control processing unit
A decryption time holding unit that holds information in which the encryption time and the decrypted time are associated with each other;
The time acquisition unit reads the decrypted time corresponding to the encryption time set in the transmission data received by the signal receiving unit from the decryption time holding unit;
The apparatus control apparatus according to claim 9 or 10, characterized in that   The time acquisition unit transmits the transmission data when the encryption time information set in the transmission data received by the signal reception unit is not the encryption time information set in the transmission data received in the past. The device control apparatus according to any one of claims 9 to 11, wherein it is determined that is valid.   The said apparatus control processing part is further provided with the output part which notifies that an expiration date is near, when it becomes a predetermined period until the expiration date of the said clock part. The apparatus control apparatus as described in the said section.   The time setting unit receives the time setting request, and sets the time to the time control unit when information indicating that the initial setting of the time has been performed is not set in the storage unit included in the clock unit. The device control apparatus according to any one of claims 1 to 13, wherein information indicating that the time is initially set is written in the storage unit.   The time acquisition unit determines that the acquired time information is correct when the acquired time information is a time advanced from a previously acquired time. The device control apparatus according to any one of the items.   The device control processing unit outputs permission for power supply to the function unit to a power control unit that controls power supply to the function unit in the device as permission to execute the predetermined function. The apparatus control apparatus according to any one of claims 1 to 15. A function unit having a predetermined function, a power control unit for controlling power supply to the function unit, a clock unit for generating time, and controlling the operation of the function unit using the time generated by the clock unit An electrical device including a device control processing unit,
The clock unit is
Power supply,
An oscillating unit that receives power supplied from the power source and generates an oscillation signal having a constant period;
A time control unit that generates a time from an oscillation signal generated by the oscillation unit;
A time setting unit that sets the time only once in the time control unit and prohibits the setting of the time thereafter,
A signal transmission unit that outputs transmission data including time information generated by the time control unit at regular intervals, and
The device control processing unit
A signal receiving unit for receiving transmission data output at regular intervals from the signal transmitting unit;
A time acquisition unit for acquiring time information from transmission data received by the signal reception unit;
A time audit control unit for transmitting the time information acquired by the time acquisition unit to the time auditing authority system and receiving time audit certificate data for the transmitted time information;
The execution request for the predetermined function is received, and the time acquired by the time acquisition unit when the execution request is received is within the validity period obtained from the time audit certificate data received by the time audit control unit. A controller that outputs permission of power supply to the functional unit to the power controller, and
The power control unit receives permission from the device control processing unit to supply power to the function unit, and supplies power to the function unit;
Electrical equipment characterized by that. A device control method provided in a device including a functional unit having a predetermined function, and used in a device control device including a clock unit and a device control processing unit,
In the watch part,
The oscillation unit receives power supplied from a power source included in the clock unit and generates an oscillation signal having a constant period,
The time control unit generates a time from the oscillation signal generated by the oscillation unit,
The time setting unit sets the time only once in the time control unit, and thereafter prohibits the time setting,
The signal transmission unit outputs transmission data including time information generated by the time control unit at regular intervals,
In the device control processing unit,
The signal receiving unit receives transmission data output at regular intervals from the signal transmitting unit,
The time acquisition unit acquires time information from the transmission data received by the signal reception unit,
The time audit control unit receives the execution request for the predetermined function, and the time acquired by the time acquisition unit when the execution request is received is obtained from the time audit certificate data received by the time audit control unit. Output the permission for execution of the predetermined function in the functional unit when it is within the valid period
A device control method.

Images