JP2014115868A - Apparatus control system, network adapter, control terminal, and server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain an apparatus control system which can exchange authentication keys without attracting user's attention.SOLUTION: An apparatus control system comprises: a control terminal 3 for controlling an air conditioner 2 via a local network 61 and an external network 62; a network adapter 21 for connecting the air conditioner 2 to the local network 61; an access point 4 for connecting the control terminal 3 to the local network 61; and a server 5 connected with the control terminal 3 via the external network 62 for performing communication with an access point 4. Each time the control terminal 3 controls the air conditioner 2 in the local network 61, the network adapter 21 generates an authentication key and transmits the generated authentication key to the control terminal 3 and the server 5. The control terminal 3 and the server 5 perform authentication in the external network 62 by using the received authentication key.

Description

  The present invention relates to a device control system.

  Conventionally, in a control terminal, when exchanging operation information with a control target device via a server, it is common to perform authentication with the server using an ID, a password, a common key, and the like. Here, when the user himself / herself sets the key, specialized knowledge such as encryption is required, and it is necessary to set the same key for both devices every time. In addition, when the key is automatically generated, the key is exchanged using a common radio wave, so that the confidentiality of the key itself is reduced. Even after a key is exchanged without being intercepted, the key may be intercepted in communication with the server, which may allow an operation from a third party.

  In order to reduce the possibility of eavesdropping and to exchange keys, a technology that mutually authenticates the control terminal and the controlled device with a short-range link, and authenticates the control terminal on the external network using the authentication information Has been proposed. For example, in Patent Document 1 below, device authentication is performed by communication using a short range wireless link (here, Bluetooth (registered trademark)), and predetermined authentication information (here, an authentication key, a password, etc.) is input to each device in advance. Keep it. Next, a device that accesses a device that has already been authenticated in a network outside the short range wireless link automatically exchanges authentication information when the authentication is successful between the devices. As a result, a technique is disclosed in which users can authenticate each other and communicate without inputting authentication information for each access.

  Further, in Patent Document 2 below, by issuing a short-term ID with a limited number of uses / usable periods in advance on the server side, even if the short-term ID leaks, the number of uses / usable periods is limited. A technique that makes it difficult to exploit is disclosed.

Japanese translation of PCT publication No. 2004-501459 JP 2006-243984 A

  However, according to the conventional technique (Patent Document 1), if authentication is not performed in the home (short range), communication is not permitted even if accessed from outside the home via another network, but authentication is successful in the home. If the authentication information is intercepted even once, there is a problem that a third party can access it.

  Further, according to the conventional technique (Patent Document 2), since user authentication is performed on the server side, the identification information of the short-term ID given to the user needs to match the identification information used by the user for authentication. . Therefore, it is necessary to transmit the identification information at least twice when the identification information is given from the server to the user and when the identification information is authenticated from the user to the server. If the identification information is intercepted during this communication, There was a problem that a third party could access.

  The present invention has been made in view of the above, and an object thereof is to obtain a device control system capable of exchanging an authentication key without being conscious of a user.

  In order to solve the above-described problems and achieve the object, the present invention provides a control terminal that controls a control target device of the local network from a local network and an external network outside the local network, and the control target device. A network adapter for connecting to the local network, an access point for connecting to the control terminal in the local network, an access point for connecting the control terminal to the local network, a connection to the control terminal for the external network, and the access point The network adapter generates an authentication key every time the control terminal controls the control target device in the local network, and the generated authentication key is transmitted via the access point. Transmits to the control terminal and the server, the control terminal and the server, the outside network performs authentication, it is characterized by using the authentication key received.

  According to the present invention, there is an effect that an authentication key can be exchanged without the user being aware of it.

FIG. 1 is a diagram illustrating a configuration example of a device control system when a control terminal is connected to a local network. FIG. 2 is a diagram illustrating a configuration example of a device control system when a control terminal is connected to an external network via a server.

  Embodiments of a device control system according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment.
In the present embodiment, as a specific example of the device control system, the device to be controlled is an air conditioner, and as an authentication key generation method, information on buttons pressed during operation of the control terminal for the air conditioner is used. The case of generating will be described.

  FIG. 1 is a diagram illustrating a configuration example of a device control system when a control terminal is connected to a local network. In FIG. 1, only the configuration of the main part related to the operation of the present embodiment is shown, and various configuration units normally provided in each device are omitted.

  The device control system 1 includes an air conditioner 2, a control terminal 3, an access point 4, and a server 5. The air conditioner 2 includes a network adapter 21 for connecting to the local network 61.

  The control terminal 3 can be connected to either the local network 61 or the external network 62. In the local network 61, the control terminal 3 is connected to the local network 61 by authenticating with the access point 4 and can access the air conditioner 2 connected to the local network 61 via the network adapter 21. The control terminal 3 can access the air conditioner 2 connected to the local network 61 via the network adapter 21 via the access point 4 by authenticating with the server 5 in the external network 62. it can.

  Here, in order to operate the air conditioner 2 and change the settings, the control terminal 3 needs to authenticate the device. Therefore, the control terminal 3 accesses the network adapter 21 via the access point 4 connected to the local network 61, and performs device authentication based on the device information of the control terminal 3 with the network adapter 21.

  The communication between the control terminal 3 and the access point 4 is assumed to be transmission by wireless communication, but is not limited to this, and may be transmission by infrared, transmission by wired communication, or the like.

  The control terminal 3 is assumed to be a smartphone, but is not limited to this. For example, a personal computer, a tablet terminal, a dedicated remote controller, or the like may be used.

  As a device authentication method between the control terminal 3 and the network adapter 21, a secure authentication method of WPS (Wi-Fi Protected Setup) established by the Wi-Fi Alliance is assumed, but WPA2 (Wi-Fi Other secure authentication methods such as Fi Protected Access) or EAP (Extensible Authentication Protocol) may be used.

  As the device information, for example, an individual identification number, a PIN (Personal Identification Number) code, or an ESSID (Extended Service Set IDentifier) is assumed, but even the MAC (Media Access Control) address of the control terminal 3 may be used. Good.

  The control terminal 3 that has completed device authentication with the network adapter 21 can operate and change the settings of the air conditioner 2 when connected to the local network 61, that is, within the local network 61.

  The operation of the air conditioner 2 by the control terminal 3 includes, for example, changes in the operating state, set temperature, set humidity, wind direction, wind speed, air volume, etc. The setting of the air conditioner 2 by the control terminal 3 includes an outdoor unit Compressor ON / OFF, operation frequency setting, time setting, etc.

  At the time of operation / setting of the air conditioner 2 by the control terminal 3, the air conditioner 2 transmits to the control terminal 3 acquirable information such as the operating state, power consumption, operating time, room temperature, and the like. 3 may display these pieces of information received from the air conditioner 2.

  Next, a method for generating and exchanging an authentication key in the device control system 1 will be described.

  When the control terminal 3 executes the operation / setting of the air conditioner 2, the network adapter 21 generates an authentication key based on the information of the button pressed at the operation / setting in the control terminal 3. For example, the network adapter 21 can acquire a hash value from a random number generated internally. The network adapter 21 sets the acquired hash value to, for example, “ABC” if the button pressed when operated on the control terminal 3 increases the set temperature, “789” if the operation mode is changed, etc. The character string with the character added is used as the authentication key.

  Note that the above-described algorithm for generating an authentication key is merely an example, and it is only necessary to generate a unique authentication key using a button pressed during operation on the control terminal 3, and the present invention is not limited to this.

  In addition, the control terminal 3 transmits information at the time of operation (here, information of a button pressed at the time of operation on the control terminal 3) to the network adapter 21 via the access point 4.

  As shown in FIG. 1, the network adapter 21 transmits the authentication key generated in response to the operation of the control terminal 3 to the control terminal 3 and the server 5 via the access point 4. Thereafter, the network adapter 21 generates a new authentication key each time the control terminal 3 operates / sets the air conditioner 2 in the local network 61, and the authentication key newly generated via the access point 4 is used as the control terminal. 3 and server 5. When there is an old authentication key received in the past when the new authentication key is received, the control terminal 3 discards the old authentication key and uses the newly received authentication key.

  With the above operation, the device authentication of the control terminal 3 is performed, and a unique authentication key is exchanged according to the operation of the control terminal 3.

  Next, an operation in which the control terminal 3 operates / sets the air conditioner 2 from the external network 62 in the device control system 1 will be described.

  FIG. 2 is a diagram illustrating a configuration example of a device control system when a control terminal is connected to an external network via a server. As in FIG. 1, FIG. 2 shows only the configuration of the main part related to the operation of the present embodiment, and omits various configuration units that are normally provided in each device.

  In FIG. 2, unlike FIG. 1, the control terminal 3 shows a state in which the server 5 connected to the external network 62 is accessed.

  Here, as shown in FIG. 1, in the device control system 1, when the control terminal 3 operates / sets the air conditioner 2 in the local network 61 and the network adapter 21 generates an authentication key, The network adapter 21 transmits the generated authentication key to the control terminal 3 via the access point 4 and also to the server 5 of the external network 62 via the access point 4.

  The server 5 registers the authentication key received from the network adapter 21 via the access point 4. Similar to the control terminal 3, when there is an old authentication key received in the past when the new authentication key is received, the server 5 discards the old authentication key and uses the newly received authentication key.

  In FIG. 2, first, the control terminal 3 accesses the server 5 and transmits authentication information for connecting to the external network 62 and an authentication key for authenticating whether communication to the air conditioner 2 is possible to the server 5. To do.

  The authentication information is assumed to be, for example, an ID, a password, and an authentication key, but may be an individual identification ID, a MAC address of the control terminal 3, or the like.

  The server 5 performs authentication processing for connecting the control terminal 3 to the external network 62 using the authentication information received from the control terminal 3. After authenticating the connection between the control terminal 3 and the external network 62, the server 5 next checks whether the authentication key received from the control terminal 3 matches the authentication key received from the network adapter 21 via the access point 4. judge. If they match, the server 5 determines that the control terminal 3 can be authenticated, and transmits the operation / setting information of the air conditioner 2 received from the control terminal 3 to the air conditioner 2 via the access point 4 and the network adapter 21. If they do not match, it is determined that the control terminal 3 cannot be authenticated, and the operation / setting information of the air conditioner 2 received from the control terminal 3 is not transmitted to the air conditioner 2 side.

  The control terminal 3 that has been authenticated with the server 5 can operate and change the settings of the air conditioner 2 when connected to the external network 62, that is, within the external network 62.

  Here, since the authentication key is automatically updated to a new authentication key whenever the control terminal 3 operates / sets the air conditioner 2 in the local network 61, the operation is performed from the external network 62. Even security can be ensured.

  Even if the authentication key is leaked while the control terminal 3 is operating from the external network 62, the authentication key is changed when the control terminal 3 returns to the local network 61 from the external network 62 and operates / sets the air conditioner 2. Will occur. Therefore, even if the authentication key is leaked once, it can be prevented that the authentication key is misused by a third party and continues to be operated illegally for a long period of time.

  Further, since the authentication key is changed based on the operation at that time when it is generated, it is difficult for the third party to estimate the authentication key.

  Further, after the authentication key is generated, restrictions such as the number of times it can be used and a usable period may be provided.

  Specifically, after generating an authentication key, if you can authenticate with that authentication key up to three times, set the usable period as one day, set the usable time zone, set the usable day of the week In such a case, even if a valid authentication key and authentication information are leaked, the number and period of unauthorized access can be limited to prevent a situation in which unauthorized operation continues for a long time. be able to. In addition, about these restrictions, you may use one each, respectively, and you may use combining several restrictions.

  Although the case where information of “button pressed at the time of operation on the control terminal 3” is used as an authentication key generation method has been described here, this is an example and the present invention is not limited to this. For example, the network adapter 21 performs authentication based on information such as the time when the control terminal 3 is operated, the position when the control terminal 3 is operated, the tilt of the control terminal 3 when the control terminal 3 is operated, as information when the control terminal 3 is operated. A key may be generated, or an authentication key may be generated based on the plurality of pieces of information. Furthermore, the network adapter 21 may generate an authentication key using information such as the IP address and MAC address of the control terminal 3. Note that the control terminal 3 sends information such as the time at the time of operation, the position at the time of operation, the tilt at the time of operation to the network adapter 21 via the access point 4 as in the case of the button pressed at the time of operation on the control terminal 3. I will send it.

  In addition, although the operation has been described with the device to be controlled as the air conditioner 2 here, any device connected to the local network 61 and operable from the control terminal 3 may be used. For example, a hot water supply system, a wall floor heating system, an electric fan , TV, lighting, etc. In this case, information that can be controlled from the control terminal 3 is changed depending on the target device, such as ON / OFF of driving and luminance.

  In addition, although the operation in wireless communication is described here, the radio field strength may be intentionally reduced when exchanging the authentication key. Specifically, if a third party illegally accesses the local network 61 from the external network 62 and performs an operation on the controlled device, the radio wave intensity is intentionally reduced by transmitting an authentication key. Thus, since only the control terminal 3 existing within the range of the local network 61 can receive the authentication key, it becomes difficult for a third party to obtain the authentication key.

  As described above, according to the present embodiment, in the device control system, the network adapter 21 and the control terminal 3 perform secure device authentication within the local network 61 where the objects to be connected are limited, and the device By exchanging the authentication key generated under the unique generation condition at the time of operation / setting execution, the risk of leakage of authentication information at the time of device authentication and authentication key exchange can be reduced. Furthermore, a new authentication key is generated and exchanged every time operation / setting is executed by the control terminal 3 in the local network 61. As a result, the authentication key can be exchanged without being conscious of the user, and even if the authentication key is intercepted by the external network 62, the authentication key is updated to the latest authentication key by an operation performed every day by the user. The risk of misuse by the three parties can be reduced.

  As described above, the device control system according to the present invention is useful for device control, and is particularly suitable for controlling home devices from outside the home via a server.

  1 device control system, 2 air conditioner, 21 network adapter, 3 control terminal, 4 access point, 5 server, 61 local network, 62 external network.

Claims (15)

A control terminal that controls a control target device of the local network from a local network and an external network outside the local network;
A network adapter for connecting the control target device to the local network;
An access point for connecting to the control terminal in the local network and connecting the control terminal to the local network;
A server that connects to the control terminal in the external network and communicates with the access point;
With
The network adapter generates an authentication key every time the control terminal controls the control target device in the local network, and transmits the generated authentication key to the control terminal and the server via the access point,
The control terminal and the server authenticate in the external network using the received authentication key.
A device control system characterized by that. When the control terminal receives the authentication key, if there is a previously received authentication key, the control terminal discards the authentication key and newly receives it as an authentication key, and is used for authentication with the server in the external network,
When the server receives the authentication key, if there is an authentication key received before, the server discards the authentication key and newly receives it as an authentication key, and is used for authentication with the control terminal.
The device control system according to claim 1. The network adapter includes one or more pieces of information selected from a button pressed on the control terminal, a time when the control terminal is operated, a position when the control terminal is operated, and a tilt of the control terminal when the control terminal is operated. Generating the authentication key based on:
The device control system according to claim 1, wherein the device control system is a device control system. The network adapter further generates the authentication key using one or more information of an IP address of the control terminal and a MAC address of the control terminal.
The apparatus control system according to claim 3. The authentication key includes one or more of a restriction on the number of times of use, a usable time limit, a usable time zone, and a usable day of the week.
The device control system according to any one of claims 1 to 4, wherein When the control target device is an air conditioner,
The air conditioner performs air conditioning control by operation from the control terminal, operation from a remote controller, or autonomous determination.
The device control system according to any one of claims 1 to 5, wherein The air conditioner changes the setting of one or more items among the operation state, set temperature, set humidity, wind direction, wind speed, air volume, outdoor unit compressor, time setting as the air conditioning control.
The device control system according to claim 6. A control terminal that controls a control target device of the local network from a local network and an external network outside the local network;
A network adapter for connecting the control target device to the local network;
An access point for connecting to the control terminal in the local network and connecting the control terminal to the local network;
A server that connects to the control terminal in the external network and communicates with the access point;
A network adapter in a device control system comprising:
Generating an authentication key every time the control terminal controls the control target device in the local network, and transmitting the generated authentication key to the control terminal and the server via the access point;
A network adapter characterized by that. The authentication key based on one or more information among a button pressed in the control terminal, a time when the control terminal is operated, a position when the control terminal is operated, and a tilt of the control terminal when the control terminal is operated Generate
The network adapter according to claim 8. Further, the authentication key is generated using one or more pieces of information among an IP address of the control terminal and a MAC address of the control terminal.
The network adapter according to claim 9. The authentication key includes one or more of a restriction on the number of times of use, a usable time limit, a usable time zone, and a usable day of the week.
The network adapter according to claim 8, 9 or 10. A control terminal that controls a control target device of the local network from a local network and an external network outside the local network;
A network adapter for connecting the control target device to the local network;
An access point for connecting to the control terminal in the local network and connecting the control terminal to the local network;
A server that connects to the control terminal in the external network and communicates with the access point;
A control terminal in a device control system comprising:
When the network adapter generates an authentication key every time the control terminal controls the control target device in the local network, and transmits the generated authentication key to the control terminal and the server via the access point. ,
When the authentication key is received, if there is a previously received authentication key, this is discarded and the newly received authentication key is used for authentication with the server in the external network,
A control terminal characterized by that. The authentication key includes one or more of a restriction on the number of times of use, a usable time limit, a usable time zone, and a usable day of the week.
The control terminal according to claim 12. A control terminal that controls a control target device of the local network from a local network and an external network outside the local network;
A network adapter for connecting the control target device to the local network;
An access point for connecting to the control terminal in the local network and connecting the control terminal to the local network;
A server that connects to the control terminal in the external network and communicates with the access point;
A server in a device control system comprising:
When the network adapter generates an authentication key every time the control terminal controls the control target device in the local network, and transmits the generated authentication key to the control terminal and the server via the access point. ,
When the authentication key is received, if there is a previously received authentication key, this is discarded and used as an authentication key, and used for authentication with the control terminal,
A server characterized by that. The authentication key includes one or more of a restriction on the number of times of use, a usable time limit, a usable time zone, and a usable day of the week.
The server according to claim 14.

Images