JP2019057788A - Communication device, communication system, and communication control method - Google Patents

Abstract

To provide a communication device, a communication system, and a communication control method that can prevent theft for diversion with a simple configuration.SOLUTION: A communication device 10 includes: a transmission/reception unit 101 having a function to transmit and receive data to/from another communication device 11 connected with a network 30; an acquisition unit 102 for acquiring information to authenticate a network management device 20 from the network management device 20 managing a network 30; and a control unit 103 for stopping the function of the transmission/reception unit 101 when the information cannot be received during prescribed time after the communication device is turned on.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication device, a communication system, and a communication control method.

  Wireless communication devices located in towns and wilderness are at risk of theft. There is a problem that a device in operation is stolen and resold, and the device is reused at the destination. For this reason, there is a need to prevent theft of a stolen device for the purpose of suppressing theft. Therefore, there is a need for a mechanism for preventing theft from being used for diversion to other networks.

  Such a technique is described in Patent Document 1, for example. The mobile router described in Patent Document 1 is connected to a mobile communication terminal by NFC communication (Near Field Communication) and performs authentication by collating a terminal identifier or the like. When the authentication fails, the mobile router described in Patent Document 1 prohibits communication with the mobile communication terminal via wireless LAN communication and communication with the business server via wide area communication.

  In addition, the base station disclosed in Patent Document 2 stores the power-off information that the power-off is determined to be abnormal when the power-off is not performed through a predetermined procedure at the time of power-off. Specifically, the base station disclosed in Patent Document 2 receives a power-off instruction signal from the base control station or the maintenance terminal, and sets a power supply circuit to stop power supply to each part in the base station. When controlled, it is recognized as a legitimate power-off process.

  Further, when the power is turned on again, the base station disclosed in Patent Document 2 acquires base station information of neighboring base stations, and shifts to an unauthorized use prevention mode when it is not equal to the pre-registered base station information. To do.

  In addition, when a radio base station disclosed in Patent Literature 3 receives a signal indicating permission from a higher-level device, the radio base station enters a controllable state and starts executing call processing. The host device disclosed in Patent Document 3 does not transmit a signal indicating permission to the radio base station when receiving a signal indicating a request for permission to start up at an unexpected time.

  Specifically, the host device disclosed in Patent Document 3 displays base station identification information such as a base station number and a base station name of a wireless base station that has requested startup permission on the display unit of the monitoring console. The maintenance center monitor confirms the display on the monitoring console and, if it determines that the start-up of the radio base station is permitted, operates the monitoring console and gives an instruction to permit the startup. input.

JP 2014-215802 A JP 2008-035213 A JP 2005-159783 A

  However, in the configuration disclosed in Patent Document 1, the mobile router is connected to the mobile communication terminal by NFC communication and performs authentication by collating the terminal identifier or the like. Therefore, it is difficult to realize the communication device installed away from the terminal by the technique of Patent Document 1.

  The configuration disclosed in Patent Document 2 is based on the premise that the power is turned off through a procedure of receiving a power-off instruction signal from the base control station or the maintenance terminal for power-off. The technique of Patent Document 2 is predicated on special authentication for power-off in this way, and is difficult to realize.

  In the configuration disclosed in Patent Document 3, the base station identification information such as the base station number and base station name of the radio base station that requested the start-up permission is displayed on the monitoring console display unit. Is displayed on the monitoring console operated by the operator, and when the monitor determines that the start-up of the radio base station may be permitted, an instruction to permit the start-up is input.

In the technique of Patent Document 3, a special configuration for such authentication is premised when a start permission is requested. Therefore, when it is difficult for any communication device to transmit a startup permission request so that it can be anticipated by the host device, it is difficult to realize.
[Object of the invention]
An object of the present invention is to provide a communication device, a communication system, and a communication control method capable of suppressing theft for diversion purposes with a simple configuration.

  According to an aspect of the present invention, there is provided a communication device that receives information for authenticating the network management device from a transmission / reception unit that transmits / receives data to / from another communication device connected to the network and a network management device that manages the network. An acquisition unit for acquiring, and a control unit for stopping the function of the transmission / reception unit when the information cannot be acquired within a predetermined time from power-on.

  A communication system according to one aspect of the present invention includes the communication device and a network management device that transmits information for authentication.

  According to another aspect of the present invention, there is provided a control method for connecting to a network managed by the network management apparatus when information for authenticating the network management apparatus cannot be acquired from the network management apparatus during a predetermined time from power-on. Data transmission / reception with the communication device is stopped.

  According to the present invention, there is an effect that it is possible to prevent the diversion theft of the communication device with a simple configuration.

FIG. 1 is a block diagram showing the configuration of the first embodiment. FIG. 2 is a flowchart showing an operation of stopping the transmission / reception function of the communication apparatus of FIG. FIG. 3 shows an operation when information for authentication is received from the network management apparatus of FIG. FIG. 4 is a block diagram illustrating a configuration of the second embodiment. FIG. 5 is a flowchart showing the operation of FIG. FIG. 6 is a block diagram illustrating a configuration of the third embodiment. FIG. 7 is a flowchart showing the operation of permitting transmission / reception of specific data in FIG.

  Hereinafter, embodiments of the present invention will be described. FIG. 1 is a block diagram showing the configuration of the first embodiment.

  The communication device 10 according to the first embodiment is connected to a network 30 managed by the network management device 20. Further, another communication device 11 is connected to the network 30. The communication device 11 is a switch, server, client computer, or the like.

  The communication device 10 acquires authentication information from the network management device 20, for example, identification information of the network management device 20, confirms whether the network management device 20 is assumed, and responds to the network management device 20. As a result, the network management apparatus 20 is authenticated. The authentication is not limited to the case where the communication device 10 authenticates the network management device 20, and the network management device 20 and the communication device 10 may authenticate each other.

  As illustrated in FIG. 1, the communication device 10 includes a transmission / reception unit 101, an acquisition unit 102, and a control unit 103. The transmission / reception unit 101 has a function of transmitting / receiving user data to / from another communication device 11.

  The acquisition unit 102 transmits / receives information for authentication to / from the network management device 20 as described above. In order to prevent impersonation, the acquisition unit 102 uses a known security mechanism such as SSL (Secure Sockets Layer) / TLS (Transport Layer Security) or IPsec (IP security) to communicate with the network management apparatus 20. Communicate. When acquiring the information for authentication from the network management device 20, the acquisition unit 102 checks whether the network management device 20 is assumed, and responds to the network management device 20 if it is assumed.

  Further, the acquisition unit 102 measures a non-communication time when there is no communication with the network management device 20 since the power is turned on. The acquisition unit 102 starts measuring the no-communication time when the communication device 10 is powered on. The acquisition unit 102 stores a non-communication time when there is no communication with the network management apparatus 20 as information indicating a communication state with the network management apparatus 20.

  The information indicating the communication state may include a threshold of no communication time when there is no communication with the network management device 20 as information indicating a predetermined time for determining whether the communication device 10 has been stolen. This no-communication time threshold may be set by a user operation, for example, and stored in the nonvolatile memory of the acquisition unit 102.

  The control unit 103 stops the function of the transmission / reception unit 101 when the information for authentication cannot be acquired from the network management apparatus 20 during a predetermined time after the power is turned on. For example, the control unit 103 acquires the no-communication time from the acquisition unit 102, and when the acquired no-communication time exceeds the above-mentioned no-communication time threshold, the control unit 103 determines that the theft has been made and stops the function of the transmission / reception unit 101. To do.

  Even if the function of the transmission / reception unit 101 that performs transmission / reception with another communication device 11 is stopped, the function of the acquisition unit 102 that transmits / receives information for authentication with the network management device 20 is not stopped. Therefore, even when the function of the transmission / reception unit 101 is stopped, when the acquisition unit 102 acquires information for authentication from the network management apparatus 20, the control unit 103 uses this as a trigger to stop the function of the transmission / reception unit 101. To release.

[Description of operation]
Next, the operation of the communication apparatus of FIG. 1 will be described using the drawings. FIG. 2 is a flowchart showing an operation of stopping the transmission / reception function of FIG. The acquisition unit 102 measures the non-communication time when there is no communication of information for authentication with the network management device 20. The acquisition unit 102 starts measuring the non-communication time when the communication device 10 is powered on (step S1).

  The control unit 103 acquires the non-communication time for communication with the network management device 20 from the acquisition unit 102 (step S2). The control unit 103 determines whether or not the acquired no-communication time exceeds the above-described no-communication time threshold (step S3). If the acquired no-communication time exceeds the threshold, the control unit 103 determines that the theft has been stolen and stops the function of the transmission / reception unit 101. (Step S4).

  FIG. 3 is a flowchart showing an operation when information for authentication is acquired from the network management apparatus of FIG. First, when the acquisition unit 102 acquires information for authentication from the network management device 20 (step S5), the network management device 20 responds to the network management device 20 that the network management device 20 is assumed (step S6).

  In addition, the control unit 103 determines whether the function of the transmission / reception unit is stopped (step S7). If the function is stopped, the control unit 103 cancels the stop of the function of the transmission / reception unit 101 (step S8).

  As described above, according to the present embodiment, when a communication device is stolen and power is turned on in the diversion destination network, the communication device is stolen if authentication information cannot be acquired from the network management device within a predetermined time. And the function of transmission / reception with other communication devices is stopped. With such a configuration, the communication device itself can detect theft with high accuracy and prevent reuse at the theft destination.

  Further, according to the present embodiment, even when information for authentication is acquired from the network management apparatus even during a period in which the transmission / reception function is stopped, the suspension of the transmission / reception function is canceled when this information is acquired. With such a configuration, the wireless communication path or network is not stolen but the communication apparatus is removed and reinstalled, or the communication path with the network management apparatus is interrupted or there is a malfunction of the network management apparatus. If the management device recovers, it is possible to automatically cancel the stop of the transmission / reception function of the communication device without trouble. With this configuration, it is possible to suppress the diversion theft of the communication device with a simple configuration.

  Next, a second embodiment will be described. FIG. 4 is a block diagram showing the configuration of the second embodiment. As shown in FIG. 4, the communication device 15 according to the present embodiment includes a transmission / reception unit 151 including a transmission / reception processing unit 1511 and a communication port 1512 that connects the transmission / reception processing unit 1511 to the network 30, and an acquisition unit 152 includes an acquisition processing unit 1521. A communication port 1522 for connecting the network 30 and the acquisition processing unit 1521 is provided.

  In addition, the control unit 153 stops the function of the communication port 1512 when the information for authentication cannot be acquired from the network management device 20 during a predetermined time after the power is turned on. The communication ports 1512 and 1522 may have either a physical or logical configuration. Different physical ports (MAC (Media Access Control) addresses) in the case of physical, and VLAN IDs (Virtual LAN IDentifier) in the case of logical, etc.

  The acquisition unit 152 stores information indicating a communication state with the network management apparatus 20 in a non-illustrated nonvolatile memory.

  In the present embodiment, the control unit 153 acquires the communication state stored in the non-volatile memory of the acquisition unit 152 when the power supplied to the communication device 15 is turned off, and then turns on the power. If it is over, it is detected that it has been stolen. In this embodiment, when the no-communication time read from the nonvolatile memory at the time of power-on does not exceed the above threshold, the measurement of the no-communication time is started. When the total of the no-communication time read at power-on and the no-communication time measured after power-on exceeds the above-mentioned no-communication time threshold, the control unit 153 determines that the communication device 15 has been stolen, and the communication port The function of 1512 is stopped.

  Next, the operation of this embodiment will be described. FIG. 5 is a flowchart showing the operation of FIG. First, the acquisition unit 152 measures the non-communication time when there is no communication with the network management device 20 as in the first embodiment. In the present embodiment, the acquisition unit 152 stores the measured no communication time in the nonvolatile memory (step S11).

  And the control part 153 acquires the no-communication time from a non-volatile memory at the time of the power supply supplied to the communication apparatus 15 being cut | disconnected after that, and (step S12). The control unit 153 determines whether the acquired no-communication time exceeds the above-described no-communication time threshold (step S13). If the acquired no-communication time exceeds the threshold, the control unit 153 determines that the communication port 1512 has been stolen. Perform (step S14).

  If the threshold is not exceeded in step S13, the acquisition unit 152 starts measuring the non-communication time of communication with the network management device 20 (step S15). Thereafter, the control unit 153 acquires the total of the no-communication time measured after the power-on by the acquisition unit 152 and the no-communication time at the time of power-on (step S16). It is determined whether or not the time threshold has been exceeded (step S17), and if it has exceeded, the process returns to step S14 to determine that it has been stolen and stop the function of the communication port 1512.

  The operation of canceling the transmission / reception stop after the function of the communication port 1512 is stopped is substantially the same as that of the first embodiment shown in FIG. Even if the function of the communication port 1512 of the transmission / reception unit 151 that performs transmission / reception with another communication device 11 is stopped, the function of the communication port 1522 of the acquisition unit 152 that performs transmission / reception with the network management device 20 is not stopped. As illustrated in FIG. 3, the acquisition unit 152 first responds to the network management device 20 when acquiring information for authentication from the network management device 20.

  In addition, when the acquisition unit 152 acquires information for authentication from the network management device 20, the control unit 153 determines whether the function of the communication port 1512 of the transmission / reception unit 151 is stopped. The stop of the function of the communication port 1512 is released.

  According to the present embodiment described above, as in the first embodiment, it is possible to obtain the effect that it is possible to suppress theft of the purpose of diversion of the communication device with a simple configuration. In this embodiment, the non-communication time measured in the non-volatile memory is stored, and if the non-communication time acquired from the non-volatile memory exceeds the threshold when the communication device is turned on, the communication port is determined to have been stolen. The function of 1512 is stopped. With such a configuration, when the device is stolen, the communication device can quickly detect the theft and stop the function.

  Next, a third embodiment will be described. The present embodiment is configured to permit transmission / reception of specific data even when the transmission / reception function is stopped.

  FIG. 6 is a block diagram illustrating a configuration of the third embodiment. The communication device 16 of the present embodiment includes a specific data identification unit 161 that identifies whether data received by the transmission / reception unit 151 is specific data when the function of the transmission / reception unit 151 is stopped. For example, the specific data identification unit 161 extracts information indicating the destination from the received data, and determines whether the data is for a communication device that relays communication. In addition, when the data received by the transmission / reception unit 151 is determined to be specific data, the control unit 163 according to the present embodiment controls the transmission / reception unit 151 to perform transmission / reception operations as usual.

  FIG. 7 is a flowchart showing the operation of permitting transmission / reception of specific data in FIG. As shown in FIG. 7, first, the specific data identification unit 161 identifies whether the data received by the transmission / reception unit 151 is specific data when the function of the transmission / reception unit 151 is stopped. For example, the specific data identification unit 161 extracts information indicating the destination from the received data, and determines whether the data is addressed to a communication device that relays communication (step S21).

  If the specific data identification unit 161 determines that the data is addressed to a communication device that relays communication, the control unit 163 controls the transmission / reception unit 151 to perform transmission / reception as usual (step S22). If it is determined in step S21 that the data is not addressed to a communication device that relays communication, the control unit 163 controls the transmission / reception unit 151 not to perform user data transmission / reception (step S23).

  With such a configuration, it is possible to suppress theft for diversion purposes with a simple configuration, and a large-scale communication failure occurs even if the stolen communication device is used in another network. The fear can be reduced.

  The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

10, 11, 15, 16 Communication device 20 Network management device 101, 151 Transmission / reception unit 102, 152 Acquisition unit 103, 153, 163 Control unit 1511 Transmission / reception processing unit 1521 Acquisition processing unit 1512, 1522 Communication port 161 Specific data identification unit

Claims (10)

A transmission / reception unit having a function of transmitting / receiving data to / from other communication devices connected to the network;
An acquisition unit that acquires information for authenticating the network management device from a network management device that manages the network;
A control unit that stops the function of the transmission / reception unit when the information cannot be acquired from the network management device during a predetermined time from power-on;
A communication device comprising: When the acquisition unit acquires the information from the network management device during a period when the function of the transmission / reception unit is stopped, the control unit cancels the stop of the function of the transmission / reception unit.
The communication apparatus according to claim 1. The acquisition unit measures a non-communication time when there is no communication with the network management device,
When the non-communication time exceeds the predetermined time, the control unit stops the function of the transmission / reception unit,
The communication apparatus according to claim 1 or 2. The acquisition unit stores the no-communication time in a nonvolatile memory,
The control unit reads the nonvolatile memory at power-on, and stops the function of the transmission / reception unit when the no-communication time exceeds the predetermined time,
The communication apparatus according to claim 3. The control unit stops the function of the transmitting / receiving unit when the total of the no-communication time read at power-on and the no-communication time measured after power-on exceeds the predetermined time,
The communication apparatus according to claim 4. A data identification unit for identifying whether the data received from the other communication device is specific data when the function of the transmission / reception unit is stopped;
The communication device according to claim 1, wherein the control unit permits the transmission / reception unit to transmit and receive the data when the data is the specific data.   The communication device according to claim 6, wherein the data identification unit extracts information indicating a destination from the data, and identifies the specific data when the destination is a communication device that relays communication. The transceiver unit has a communication port connected to the network,
8. The communication according to claim 1, wherein the control unit stops the function of the communication port when the information cannot be acquired from the network management apparatus during the predetermined time from power-on. 9. apparatus. The communication device according to any one of claims 1 to 8,
A network management device for transmitting information for authentication;
A communication system comprising:   Stop transmission / reception of data to / from other communication devices connected to the network managed by the network management device when information for authenticating the network management device cannot be acquired from the network management device within a predetermined time after power-on A communication control method.

Images