JP2017102707A - Device authentication system and device authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device authentication system that makes effective utilization of the storage resource of a communication device and downsizing possible, and cuts back the authentication information storage area of a network connected device and reduces an authentication processing load.SOLUTION: When a connection request is sent from an M2M device 4, access points 1a-1n search for a MAC address indicating the physical address of the sending M2M device 4 from the connection request in S14, and transmit an authentication request including the MAC address to an M2M-PF 2 in S16. The M2M-PF 2 manages a list of M2M device 4 MAC addresses used in a system, collates the MAC address included in the authentication request with the list of MAC addresses, and thereby authenticates the connection-requesting M2M device 4 in S18, and returns the result of authentication to the authentication-requesting access points 1a-1n in S19. The access points 1a-1n establish a communication link with the connection-requesting M2M device 4 on the basis of the authentication result.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a device authentication system and a device authentication method for authenticating a device in a system in which a device that transmits data is connected to a platform via a network using, for example, M2M (Machine to Machine) communication.

  In recent years, M2M communication has become widespread with the development of information communication technology. As a system using M2M communication, for example, an M2M device containing a sensor, an actuator, or the like is connected to an M2M controller via a network. Then, the measurement data output from the sensor is transmitted from the M2M device to the M2M controller, and the M2M controller transmits a command to the actuator based on the measurement data to be operated.

By the way, in order to realize this type of system, it is necessary to authenticate an M2M device that accommodates sensors, actuators, and the like. As one method, an authentication key is distributed to each M2M device and the confirmation key is managed in a network connection device such as an access point. The network connection device uses the authentication key in response to an access request from the M2M device. A method for performing authentication has been proposed (see, for example, Non-Patent Document 1).
As another method, in a system using WiFi (registered trademark) communication, a method is also proposed in which a user interface such as a button is provided on the M2M device, and the user inputs and transmits authentication information when accessing from the M2M device. (See Non-Patent Document 2, for example).

OneM2MPartners, "ONE M2M TECHNICAL SPECIFICATION" 8.8.2.1, [online], August 1, 2014, OneM2MPartners, [Search April 23, 2015], Internet <URL: http://www.onem2m.org/ images / files / deliverables / TS-0003-Security_Solutions-V-2014-08.pdf> 2014 Wi-Fi Alliance, “Wi-Fi Simple Configuration Technical Specification Version 2.0.5”, 2014 Wi-Fi Alliance, 2014

  However, in the method described in Non-Patent Document 1, the M2M device stores the authentication key assigned to itself, and the M2M base collectively manages the authentication keys of all M2M devices. This puts pressure on the storage capacity of the M2M device. Usually, the authentication key used when authenticating the M2M device is used only for authentication at the time of connection, and is not used after authentication. M2M devices tend to be smaller and some have less storage capacity. For such an M2M device, securing a large-capacity storage area in order to hold an authentication key used only for authentication at the time of connection is a heavy burden and becomes an obstacle to effective use of storage resources.

  On the other hand, in the method described in Non-Patent Document 2, an authentication key storage area is not required in each M2M device, but a user interface must be provided. For this reason, the enlargement of the M2M device is inevitable. Further, for example, it is difficult to apply to a system that automatically transmits sensor measurement data periodically.

  Further, in both Non-Patent Documents 1 and 2, it is necessary to store all authentication keys for authentication processing of all M2M devices. For this reason, as the number of M2M devices increases, the amount of authentication information managed by the M2M infrastructure increases. For this reason, a large-capacity storage resource is required for the M2M infrastructure, and the processing load of the M2M infrastructure for authentication processing increases.

  The present invention has been made paying attention to the above circumstances, and enables effective utilization and further downsizing of storage resources of a communication device, and further reduces the authentication information storage area of the network connection device and the processing load related to authentication. A device authentication system and a device authentication method are provided.

  In order to solve the above problems, a first aspect of the present invention is a device authentication system comprising a network connection device for connecting a communication device to a network and an information processing device connected to the network, or this system In the device authentication method executed by the method, when a connection request is received from the communication device, the network connection device extracts identification information indicating the physical address of the communication device from the connection request, and the extracted An authentication request including identification information is transmitted to the information processing apparatus via the network. The information processing apparatus that has received the authentication request collates the identification information included in the authentication request with a list of identification information stored in advance, and checks the validity of the communication terminal corresponding to the identification information included in the authentication request. The presence / absence is determined, and authentication result information indicating the determination result is returned to the network connection device via the network. When the network connection apparatus receives the authentication result information returned from the information processing apparatus, the network connection apparatus establishes a communication link between the communication device that has transmitted the connection request and the network.

  According to a second aspect of the present invention, when the network connection apparatus is notified of authentication result information indicating the validity of the communication device from the information processing apparatus, identification information indicating a physical address of the corresponding communication device is provided. When the connection request is received from the communication device and stored in the memory, it is determined whether or not the identification information indicating the physical address of the communication device extracted from the connection request is stored in the memory. In the case where it is determined that the connection request is transmitted, a process for establishing a communication link between the communication device that has transmitted the connection request and the network is further executed.

  According to a third aspect of the present invention, the network connection device further executes a process of deleting the identification information stored in the memory from the memory when the predetermined condition is not satisfied. It is.

  According to the first aspect of the present invention, the authentication process is performed using the identification information indicating the physical address when the communication device communicates. This eliminates the need to store the authentication key in the communication device and eliminates the need for a user interface for inputting the authentication key. Accordingly, it is possible to effectively use the storage resources of the communication device, and it is possible to further reduce the size of the device. Further, the authentication process using the identification information is performed in the information processing apparatus instead of the network connection apparatus. This eliminates the need to manage the identification information of the communication device in the network connection apparatus, thereby reducing the storage capacity of the network connection apparatus and reducing the processing load related to the authentication process.

  According to the second aspect of the present invention, the identification information indicating the physical address of the communication device whose validity has been confirmed by the information processing apparatus is stored as cache data in the network connection apparatus. For this reason, for example, due to the influence of the network environment, it takes time until the response information is returned from the information processing apparatus after the network connection apparatus transmits the authentication request, so that the connection request transmitted from the communication device is timed out. Even when the communication becomes invalid, it is possible to establish a communication link in response to a reconnection request transmitted from the communication device thereafter.

  According to the third aspect of the present invention, when the cache data stored in the network connection device does not satisfy a preset condition, for example, when the storage time of the cache data exceeds a certain time, or a certain number of connections If it exceeds, it is automatically deleted. For this reason, when the list of identification information is updated in the information processing apparatus, it is possible to prevent a problem that a communication link is established using old cache data before update.

  That is, according to the present invention, device authentication that enables effective use and further downsizing of storage resources of the communication device, and further reduces the authentication information storage area of the network connection device and the processing load related to authentication. A system and device authentication method can be provided.

1 is a block diagram showing a configuration of an M2M data transmission system including a device authentication system according to a first embodiment of the present invention. The block diagram which shows the structure of the principal part in the system shown in FIG. The sequence diagram which shows the operation | movement procedure and operation | movement content of the system shown in FIG. The block diagram which shows the structure of the M2M data transmission system containing the device authentication system which concerns on 2nd Embodiment of this invention. The block diagram which shows the structure of the principal part in the system shown in FIG. The sequence diagram which shows the operation | movement procedure and operation | movement content of the system shown in FIG. FIG. 5 is a diagram showing an example of MAC address information held in a cache holding unit of the system shown in FIG. 4. The block diagram which shows the structure of the M2M data transmission system containing the device authentication system which concerns on 3rd Embodiment of this invention. The block diagram which shows the structure of the principal part in the system shown in FIG. The sequence diagram which shows the operation | movement procedure and operation | movement content of the system shown in FIG. The figure which shows an example of the MAC address information hold | maintained at the cache holding | maintenance part of the system shown in FIG.

Embodiments according to the present invention will be described below with reference to the drawings.
[First Embodiment]
(Constitution)
FIG. 1 is a block diagram showing a configuration of an M2M data transmission system including a device authentication system according to the first embodiment of the present invention.
In the device authentication system according to the first embodiment, communication is performed between a plurality of access points 1a to 1n having a function as a network connection apparatus and the access points 1a to 1n via a network (not shown). M2M-PF (Machine to Machine-Platform) 2 and a supplier apparatus 3 capable of communicating with the M2M-PF2 via the network, and a plurality of M2M devices at the access points 1a to 1n. 4 is connected. The access points 1a to 1n constitute an M2M base, and the M2M-PF 2 and the supplier apparatus 3 constitute an information processing apparatus.

  The M2M device 4 is composed of a terminal or a set top box, for example, and includes an M2M infrastructure communication unit 41. The M2M-based communication unit 41 outputs sensor data output from a plurality of sensors (not shown) together with sensor identification information (sensor ID) and information indicating measurement date and time via a local network (not shown) at a constant cycle. Transmit to access points 1a-1n.

  As the sensor, for example, a weather sensor for observing temperature, humidity, atmospheric pressure or the like is used. However, an image sensor such as an infrared camera or a visible camera, an electric energy sensor, a heart rate sensor, a step sensor, a position sensor, 3 It is also possible to use a dimensional acceleration sensor or the like. As the local network, a communication interface adopting a short-range wireless data communication standard such as a wireless LAN or Bluetooth (registered trademark) is used.

  Each of the access points 1a to 1n includes an M2M device communication unit 11 and an authentication information acquisition unit 12.

  The M2M device communication unit 11 receives the connection request and sensor data transmitted from the M2M device 4 via the local network. When a connection request is received, a function of extracting identification information indicating the physical address of the transmission source M2M device, for example, a MAC address from the connection request, and notifying this to the authentication information acquisition unit 12 as device information is provided. Have.

  When the connection request transmitted from the M2M device 4 is received by the M2M device communication unit 11, the authentication information acquisition unit 12 transmits an authentication request to the M2M-PF 2 and, according to the authentication result, the M2M device 4 establishes a communication link between the network 4 and the network, and is configured as follows. FIG. 2 shows the functional configuration.

  That is, the authentication information acquisition unit 12 includes a CPU (Central Processing Unit) and a program memory. As processing functions necessary to implement the first embodiment, an authentication inquiry processing unit 121 and a network establishment control unit (NW) Establishment control unit) 122.

  When the MAC address of the connection request source M2M device is notified from the M2M device communication unit 11, the authentication inquiry processing unit 121 creates an authentication request including the MAC address and transmits the request to the M2M-PF2.

  Whether the NW establishment control unit 122 recognizes the validity of the connection request source M2M device 4 when the response information indicating the authentication result is returned from the M2M-PF2 in response to the transmission of the authentication request. If it is determined that the validity is acceptable, the M2M device communication unit 11 is instructed to establish a communication link.

  M2M-PF2 consists of a cloud server, for example, and is provided with the device information management part 21 and the device information storage part 22. FIG. The device information storage unit 22 is used to store a list of MAC addresses of each M2M device 4 transmitted from the supplier apparatus 3.

The device information management unit 21 performs M2M device authentication processing and is configured as follows. FIG. 2 shows the functional configuration.
That is, the device information management unit 21 includes a CPU (Central Processing Unit) and a program memory. As processing functions necessary for implementing this embodiment, a device information registration control unit 211, an ID authentication processing unit 212, an authentication And a result response unit 213.

  The device information registration control unit 211 receives a list of MAC addresses of each M2M device 4 transmitted from the supplier apparatus 3, and stores the received list of identification information as device information in the device information storage unit 22. Do.

  When an authentication request is sent from the access points 1a to 1n, the ID authentication processing unit 212 stores the MAC address of the connection request source M2M device included in the authentication request in the device information storage unit 22. A process for checking the validity of the M2M device that is the connection request source is performed by comparing with the list of identification information.

  The authentication result response unit 213 returns the determination result by the ID authentication processing unit 212 to the access points 1a to 1n as response information of the authentication result.

  The supplier device 3 includes a terminal or a server device operated by an M2M service provider, and includes an M2M infrastructure communication unit 31 and a device information storage unit 32. The M2M-based communication unit 31 communicates with the M2M-PF2 for device information registration processing via the network. The device information storage unit 32 manages the MAC addresses of all M2M devices used by the system as device information.

(Operation)
Next, the operation of the device authentication system configured as described above will be described. FIG. 3 is a sequence diagram showing an operation procedure and operation contents of the system shown in FIG.
(1) Registration of device information Prior to system operation, an operator operating the system distributes and installs M2M devices to, for example, each department or individual in the office.
The supplier device 3 lists the MAC addresses indicating the physical addresses of the plurality of distributed M2M devices 4 and manages them as device information in the device information storage unit 32. The device information managed in the device information storage unit 32 is read out in step S11 before the system operation is started and updated, and is transmitted from the M2M base communication unit 31 to the M2M-PF2 via the network in step S12. To do.

  On the other hand, the M2M-PF 2 receives the device information transmitted from the supplier apparatus 3 under the control of the device information registration control unit 211 of the device information management unit 21, and stores the received device information in step S13. The new device information is stored in the unit 22 or the old device information stored in the device information storage unit 22 is updated to the newly received device information.

(2) Authentication of M2M Device When the M2M device 4 is installed and activated, a connection request is transmitted from the M2M device 4 by the M2M infrastructure communication unit 41. On the other hand, when the M2M device communication unit 11 receives the connection request, the access points 1a to 1n detect the MAC address indicating the physical address of the transmission source M2M device from the received connection request in step S14. The address is notified to the authentication information acquisition unit 12 in step S15.

  When the MAC address is notified, the authentication information acquisition unit 12 creates an authentication request including the notified MAC address in step S16 under the control of the authentication inquiry processing unit 121, and transmits the authentication request to the M2M-PF2. .

  On the other hand, when the M2M-PF2 receives the authentication request, under the control of the ID authentication processing unit 212, the M2M-PF2 reads a list of MAC addresses from the device information storage unit 22 in step SW17. The MAC address included in the request is checked against the list of read MAC addresses. If the MAC address included in the received authentication request is registered in the MAC address list as a result of the verification, the validity of the connection request source M2M device is recognized. The authentication result response unit 213 includes in the response information of the authentication result that the validity of the request source M2M device is not recognized, and returns it to the authentication request source access points 1a to 1n via the network in step S19.

  When the response information of the authentication result is received from the M2M-PF2, the access points 1a to 1n determine whether or not the returned response information is valid under the control of the NW establishment control unit 122. In step S20, the M2M device communication unit 11 is instructed to establish a communication link. As a result, a communication link is established between the connection request source M2M device 4 and the access points 1a to 1n. Thereafter, the M2M device 4 can transmit sensor data to the M2M-PF2 via the network.

  On the other hand, if the returned response information does not recognize validity, the connection request transmitted from the M2M device 4 is discarded without giving a communication link establishment instruction to the M2M device communication unit 11.

(effect)
As described above in detail, in the first embodiment, when a connection request is transmitted from the M2M device 4, the access points 1a to 1n use the MAC address indicating the physical address of the source M2M device 4 from the connection request. Upon detection, an authentication request including the MAC address is transmitted to M2M-PF2. The M2M-PF 2 manages the MAC address list of the M2M device 4 used in the system, and collates the MAC address included in the authentication request sent from the access points 1a to 1n with the MAC address list. Thus, the M2M device 4 as the connection request source is authenticated, and response information indicating the authentication result is returned to the access points 1a to 1n as the authentication request source. The access points 1a to 1n establish a communication link with the M2M device 4 that is the connection request source based on the response information of the authentication result.

  Therefore, the authentication process is performed using the MAC address representing the physical address of the M2M device 4. For this reason, in the M2M device 4, it is not necessary to store the authentication key, and a user interface for inputting the authentication key is also unnecessary. Accordingly, the storage resources of the M2M device 4 can be effectively used, and the M2M device can be further downsized.

  Further, the authentication process using the MAC address is performed in the M2M-PF2 instead of the access points 1a to 1n. This eliminates the need to manage the MAC address of the M2M device 4 at the access points 1a to 1n, thereby reducing the storage capacity of the access points 1a to 1n and reducing the processing load related to the authentication process. Become.

[Second Embodiment]
In the second embodiment of the present invention, when the access point returns the authentication result response information returned from the M2M-PF as validating the M2M device, the access point receives the MAC address of the M2M device from the cache holding unit. Save to. When a reconnection request transmitted from the M2M device is received in this state, the MAC address detected from the reconnection request is checked against the MAC address stored in the cache holding unit. A communication link is established with the M2M device.

  4 is a block diagram showing a configuration of an M2M data transmission system including a device authentication system according to the second embodiment of the present invention, and FIG. 5 is a functional configuration of an access point and M2M-PF of the data authentication system shown in FIG. FIG. 4 and 5, the same parts as those in FIGS. 1 and 2 are denoted by the same reference numerals, and detailed description thereof is omitted.

  Each of the access points 5a to 5n includes a cache holding unit 53 in addition to the M2M device communication unit 51 and the authentication information acquisition unit 52.

  The M2M device communication unit 51 receives the connection request and sensor data transmitted from the M2M device 4 via the local network. When receiving a connection request, the function extracts the identification information indicating the physical address of the source M2M device 4 from the connection request, for example, the MAC address, and notifies this to the authentication information acquisition unit 52 as device information. Have

  The authentication information acquisition unit 52 includes a CPU (Central Processing Unit) and a program memory. As processing functions necessary to implement the second embodiment, an authentication inquiry processing unit 521 and an NW establishment control unit 522 are provided. Have.

  When the MAC address of the M2M device that is the connection request source is notified from the M2M device communication unit 51, the authentication inquiry processing unit 521 determines whether or not the MAC address is stored in the cache holding unit 53, and is stored. If not, an authentication request including the MAC address is generated and transmitted to M2M-PF2. If the MAC address is stored in the cache holding unit 53, the authentication inquiry processing unit 521 notifies the NW establishment control unit 522 of an authentication result indicating that the M2M device 4 that is the connection request source is authorized.

  Whether the NW establishment control unit 522 acknowledges the validity of the connection request source M2M device 4 when response information indicating the authentication result is returned from the M2M-PF2 in response to the transmission of the authentication request. If it is determined that the validity has been accepted, the MAC address of the connection request source M2M device 4 is stored in the cache holding unit 53, and the M2M device communication unit 51 is instructed to establish a communication link. In addition, when the NW establishment control unit 522 receives an authentication result indicating that the M2M device 4 as the connection request source is recognized from the authentication inquiry processing unit 521, the NW establishment control unit 522 instructs the M2M device communication unit 51 to establish a communication link. To do.

(Operation)
Next, the operation of the device authentication system configured as described above will be described. FIG. 6 is a sequence diagram showing an operation procedure and operation contents of the system shown in FIG. In FIG. 6, the same parts as those in FIG.

  When the access points 5a to 5n receive the response information indicating the authentication result from the M2M-PF 2 in step S19, the response information of the returned authentication result confirms the validity under the control of the NW establishment control unit 522. If the validity is recognized, the cache holding unit 53 stores the MAC address of the M2M device 4 for which the validity is confirmed in step S21. FIG. 7 shows an example of the MAC address stored in the cache holding unit 53.

  Then, the NW establishment control unit 522 instructs the M2M device communication unit 51 to establish a communication link. As a result, a communication link is established between the connection request source M2M device 4 and the access points 5a to 5n. Thereafter, the M2M device 4 can transmit sensor data to the M2M-PF2 via the network.

  On the other hand, due to the deterioration of the network environment, it takes time until the response information is received from the M2M-PF2 after the authentication request is transmitted from the access points 5a to 5n to the M2M-PF2, and during that time, the connection request source M2M It is assumed that the connection request transmitted from the device 4 is invalidated due to timeout.

  However, when a reconnection request is transmitted after the connection request is transmitted from the connection request source M2M device 4, the authentication inquiry processing unit 521 of the access points 5a to 5n is notified from the M2M device communication unit 51 in step S22. It is determined whether or not the MAC address of the connection request source M2M device 4 is stored in the cache holding unit 53. If it is stored, the NW establishment control unit 522 is notified of an authentication result indicating that the validity of the M2M device 4 that is the connection request source is recognized.

  When the NW establishment control unit 522 receives an authentication result indicating that the M2M device 4 as the connection request source is recognized from the authentication inquiry processing unit 521, the NW establishment control unit 522 instructs the M2M device communication unit 51 to establish a communication link in step S23. To do. As a result, a communication link is established between the M2M device 4 that is the reconnection request source and the access points 5a to 5n, and thereafter, the M2M device 4 can transmit sensor data to the M2M-PF2 via the network.

(effect)
As described above, in the second embodiment, when the access points 6a to 5n recognize that the response information of the authentication result returned from the M2M-PF2 confirms the validity of the M2M device 4, the M2M device 4 Are stored in the cache holding unit 53. When a reconnection request transmitted from the M2M device 4 is received in this state, the MAC address detected from the reconnection request is checked against the MAC address stored in the cache holding unit 53, and if they match, A communication link is established with the M2M device 4 that is the reconnection request source.

  Therefore, for example, due to deterioration of the network environment, it takes time until the response information is received from the M2M-PF2 after the authentication request is transmitted from the access points 5a to 5n to the M2M-PF2, and during that time, the connection request source M2M Even if the connection request transmitted from the device 4 becomes invalid due to timeout, a communication link can be established with the requesting M2M device 4 in response to the reconnection request transmitted from the M2M device 4 thereafter. It becomes possible.

  For the M2M device once validated by the authentication process by the M2M-PF2, authentication is confirmed based on the MAC address stored in the cache holding unit 53, and a communication link is established. For this reason, it is not necessary to perform an authentication procedure between the access points 5a to 5n and the M2M-PF 2 for all connection requests from the M2M device 4, thereby suppressing an increase in network traffic. .

[Third Embodiment]
In the third embodiment of the present invention, at the access point, the acquisition date is added to the MAC address stored in the cache holding unit, and the storage time of the MAC address stored in the cache holding unit is preset from the acquisition date. When the cache time limit is exceeded, the MAC address is deleted from the cache holding unit at that time.

  FIG. 8 is a block diagram showing a configuration of an M2M data transmission system including a device authentication system according to the third embodiment of the present invention, and FIG. 9 is a functional configuration of an access point and M2M-PF of the data authentication system shown in FIG. FIG. 8 and 9, the same parts as those in FIGS. 4 and 6 are denoted by the same reference numerals, and detailed description thereof is omitted.

  As with the second embodiment, each of the access points 6a to 6n includes a cache holding unit 63 in addition to the M2M device communication unit 61 and the authentication information acquisition unit 62.

  The M2M device communication unit 61 receives the connection request and sensor data transmitted from the M2M device 4 via the local network. When receiving a connection request, the function extracts the identification information indicating the physical address of the source M2M device 4 from the connection request, for example, the MAC address, and notifies this to the authentication information acquisition unit 62 as device information Have

  The authentication information acquisition unit 62 includes a CPU (Central Processing Unit) and a program memory, and in addition to the authentication inquiry processing unit 621 and the NW establishment control unit 622 as processing functions necessary to implement the third embodiment, A cache management unit 623 is included.

  When the MAC address of the M2M device that is the connection request source is notified from the M2M device communication unit 61, the authentication inquiry processing unit 621 determines whether or not the MAC address is stored in the cache holding unit 63, and is stored. If not, an authentication request including the MAC address is generated and transmitted to M2M-PF2. If the MAC address is stored in the cache holding unit 63, the authentication inquiry processing unit 621 notifies the NW establishment control unit 622 of an authentication result indicating that the M2M device 4 that is the connection request source is authorized.

  If the NW establishment control unit 622 returns response information indicating the authentication result from the M2M-PF2 in response to the transmission of the authentication request, does the NW establishment control unit 622 recognize the validity of the M2M device 4 that is the connection request source? If it is determined that the validity is confirmed, the cache holding unit 63 stores the MAC address of the connection request source M2M device 4 and instructs the M2M device communication unit 61 to establish a communication link. When the NW establishment control unit 622 receives an authentication result indicating that the M2M device 4 as the connection request source is valid from the authentication inquiry processing unit 621, the NW establishment control unit 622 instructs the M2M device communication unit 61 to establish a communication link. To do.

  When the MAC address is stored in the cache holding unit 63, the cache management unit 623 adds the acquisition date and time to the MAC address. Then, when the storage time of the MAC address stored in the cache holding unit 63 exceeds a preset cache time limit from the acquisition date and time, a process of deleting the MAC address from the cache holding unit 63 is performed.

(Operation)
Next, the operation of the device authentication system configured as described above will be described. FIG. 10 is a sequence diagram showing an operation procedure and operation contents of the system shown in FIG. In FIG. 10, the same parts as those of FIG.

  When the access points 6a to 6n receive the response information indicating the authentication result from the M2M-PF 2 in step S19, the response information of the returned authentication result is valid under the control of the NW establishment control unit 622. In step S30, the MAC address of the M2M device 4 for which the validity is recognized is stored in the cache holding unit 63. At this time, information indicating the acquisition date and time of the MAC address is stored in the cache holding unit 63 in association with the MAC address. FIG. 11 shows an example of the MAC address and acquisition date information stored in the cache holding unit 63.

  When the MAC address is stored in the cache holding unit 63, in step S31, the cache management unit 623 measures the storage time for each MAC address stored in the cache holding unit 63, starting from the acquisition date and time. When the storage time exceeds a preset cache time limit, the MAC address is deleted from the cache holding unit 63 at that time.

  Therefore, even if a reconnection request is transmitted from the M2M device 4 after the cache expiration date and the MAC address of the M2M device 4 that is the connection request source is notified from the M2M device communication unit 61 in step S32, the authentication inquiry processing unit 621 Since the MAC address is not stored in the cache holding unit 63, the NW establishment control unit 622 is not notified of an authentication result indicating that the reconnection request source M2M device 4 is valid. Instead, in step S33, an authentication request including the MAC address notified from the M2M device communication unit 61 is created and transmitted to the M2M-PF2.

(effect)
As described above, in the third embodiment, when the cache management unit 623 exceeds the preset cache expiration time for each MAC address stored in the cache holding unit 63, the storage time starting from the acquisition date and time is exceeded. At that time, the MAC address is deleted from the cache holding unit 63.

  For this reason, the MAC address held in the cache holding unit 63 of the access points 6a to 6n prevents a problem that a communication link can be established semipermanently for the M2M device 4. Therefore, for example, when an arbitrary M2M device 4 is excluded from the authentication target in the supplier device 3 and the MAC address of the arbitrary M2M device 4 is deleted from the list from the device information storage unit 22 of the M2M-PF2 accordingly. No communication link is established for the corresponding M2M device 4.

[Other Embodiments]
In each of the above embodiments, the case where the M2M-PF 2 and the supplier apparatus 3 are separate apparatuses has been described. However, one information processing apparatus may have the functions of both apparatuses. In each of the above embodiments, the case where an access point used in a wireless LAN is applied as a network connection device has been described as an example. However, other wireless base stations of a public mobile communication system, low power such as Bluetooth (registered trademark) A communication device that operates as a master in a wireless data communication system, a parent device of another local mobile communication system, a parent device of a system that employs a multi-hop communication method, a provider server, and the like can also be applied.

  In addition, the types and configurations of the M2M device, the network connection device and the information processing device, and the operation procedure and operation procedure in the network connection device and the information processing device can be variously modified and implemented without departing from the gist of the present invention. It is.

  In short, the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the components without departing from the scope of the invention in the implementation stage. Moreover, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above embodiments. For example, some components may be deleted from all the components shown in each embodiment. Furthermore, you may combine suitably the component covering different embodiment.

  1a to 1n, 5a to 5n, 6a to 6n ... access point, 2 ... M2M-PF, 3 ... supplier device, 4 ... M2M device, 11, 51, 61 ... M2M device communication unit, 12, 52, 62 ... authentication information Acquisition unit, 21 ... Device information management unit, 22 ... Device information storage unit, 31 ... M2M infrastructure communication unit, 32 ... Device information storage unit, 41 ... M2M infrastructure communication unit, 53, 63 ... Cache holding unit, 121, 521 621 ... Authentication inquiry processing unit, 122, 522, 622 ... NW establishment control unit, 211 ... Device information registration control unit, 212 ... ID authentication processing unit, 213 ... Authentication result response unit, 623 ... Cache management unit.

Claims (6)

A network connection device for connecting a communication device to a network, and an information processing device connected to the network,
The network connection device is:
When a connection request is received from the communication device, identification information indicating the physical address of the communication device is extracted from the connection request, and an authentication request including the extracted identification information is sent to the information processing apparatus via the network. Means for transmitting;
Means for establishing a communication link between the communication device that transmitted the connection request and the network when authentication result information indicating the validity of the communication device is returned from the information processing apparatus in response to the authentication request; With
The information processing apparatus includes:
Means for storing a list of identification information indicating a physical address of the communication device;
When the authentication request transmitted from the network connection device is received, the identification information included in the authentication request is checked against the stored list of identification information, and communication corresponding to the identification information included in the authentication request Means for determining the validity of the terminal;
A device authentication system comprising: means for returning authentication result information representing a result of determination of the presence / absence of validity to the network connection device via the network. The network connection device is:
Means for storing identification information representing a physical address of a corresponding communication device in a memory when authentication result information representing the validity of the communication device is notified from the information processing apparatus;
When a connection request is received from the communication device, it is determined whether or not identification information indicating the physical address of the communication device extracted from the connection request is stored in the memory. The device authentication system according to claim 1, further comprising: means for establishing a communication link between the communication device that has transmitted the connection request and the network.   3. The device authentication system according to claim 2, wherein the network connection device further comprises means for deleting the identification information stored in the memory from the memory when the preset condition is not satisfied. . A device authentication method executed by a system comprising a network connection device for connecting a communication device to a network and an information processing device connected to the network,
When the network connection apparatus receives a connection request from the communication device, the network connection device extracts identification information indicating the physical address of the communication device from the connection request, and sends an authentication request including the extracted identification information via the network. Transmitting to the information processing apparatus,
When the information processing device receives the authentication request transmitted from the network connection device, the identification information included in the authentication request is checked against a list of identification information stored in advance, and is included in the authentication request. A process of determining the validity of the communication terminal corresponding to the identification information;
A process in which the information processing apparatus returns authentication result information representing the determination result of the validity to the network connection apparatus via the network;
A step of establishing a communication link between the communication device that has transmitted the connection request and the network when the network connection device receives the authentication result information returned from the information processing device. A device authentication method. When the network connection device receives the authentication result information returned from the information processing device, a process of storing identification information representing a physical address of a corresponding communication device in a memory;
When the network connection apparatus receives a connection request from the communication device, the network connection apparatus determines whether or not identification information indicating the physical address of the communication device extracted from the connection request is stored in the memory. 5. The device authentication method according to claim 4, further comprising a step of establishing a communication link between the communication device that has transmitted the connection request and the network when it is determined that the connection request is received.   6. The device authentication according to claim 5, further comprising: a step of deleting the identification information stored in the memory from the memory when the network connection device no longer satisfies a preset condition. Method.