JP2021012648A - MANAGEMENT OF RIGHT TO ACCESS TO IoT APPARATUS - Google Patents

Abstract

To provide a system that permits remote access to an IoT apparatus and maintains security while improving convenience.SOLUTION: An access management system 100 authenticates a user in a secure area, and when succeeding in the authentication, transmits, to a normal area, authority information in which an operation permitted to the user is specified. A user application monitoring processing module 12 executed in the normal area performs collation as to whether an operation the user is to perform in relation to the apparatus matches the operation specified as the authority information on the user, and when the operations do not match, disables the operation that the user is to perform. A normal area monitoring processing module 36 in the secure area monitors, while the user works on the operation, that the details of processing performed by the user application monitoring processing module 12 executed in the normal area are not changed.SELECTED DRAWING: Figure 1

Description

The present invention relates to a system and a method for managing access rights of IoT (Internet of Things) devices.

Smart factories are being developed that flexibly respond to various changes in the external environment such as market needs and distribution conditions, and optimize processes such as development, manufacturing, and production management. As a means of realization, it is being studied to connect all devices including sensors and equipment to a network to visualize the operating status and to cooperate with each other. Further, as in Patent Document 1, it is proposed to suppress cyber attacks and improve the security level against cyber attacks that create network vulnerabilities.

JP-A-2019-61538

However, connecting the equipment in the factory to the network increases the security risk, and maintenance such as regular updates is essential to maintain sufficient security functions. In this regard, in order to reduce costs, there is a need to perform maintenance remotely as much as possible. In addition, due to the complexity of work, it is expected that there will be a need to outsource maintenance work to an outside contractor in the future. In this case, it is necessary to secure a security environment when an outside contractor tries to remotely access the device. It is also necessary to ensure a security environment when allowing remote access to a plurality of external vendors.

Therefore, it is desirable to maintain security while allowing remote access to IoT devices to improve convenience.

The present invention has been made in view of the above problems, and has the following features. That is, according to one feature of the present invention, it is an access management system when a plurality of users work on a device via a network.
The normal area that runs on the first operating system,
A secure area that operates in a second operating system with a higher security level than the first operating system,
It is equipped with a hypervisor that enables communication between the normal area and the secure area.
The normal region is
The authentication information required for authentication received from the user via the network is transmitted to the secure area, and the work related to the device permitted to the user when the authentication of the user is successful in the secure area is specified. The authority information is received from the secure area, and it is collated whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match, it is checked. It has a user application monitoring processing unit that executes processing that renders the work that the user intends to perform inoperable.
The secure area is
When the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and when the authentication of the user is successful, the work permitted to the user is specified. An authentication processing unit that transmits the authority information to the normal area,
It has a normal area monitoring processing unit that monitors that the processing content of the user application monitoring processing unit executed in the normal area has not been changed during the operation of the user.
The system is provided.

In the present invention, the normal area monitoring processing unit periodically reads out the information of the user application monitoring processing unit stored in the memory area in the normal area, and the information of the user application monitoring processing unit is changed. If so, the work can be disabled.

In the present invention, the authentication processing unit is
When the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the process and the operation permitted to the user are described. The authority information associated with the resources used in the process is transmitted to the normal area, and
The user application monitoring processing unit
When the authentication of the user is successful from the secure area, when the authority information associated with the process and the resource used for the process is received as the work permitted to the user, the user performs a row regarding the device. It is checked whether or not the process to be attempted and the resource used for the process match the process associated with the authority information of the user and the resource, and if they do not match, the device is described. You can also perform a process to stop the process the user is trying to do.

In the present invention, the user application monitoring processing unit acquires a list of processes in operation or scheduled to be operated for each user of the plurality of users as the authority information, and obtains a list of resources in use or scheduled to be used for each process. It is also possible to acquire and collate whether or not each process and each resource for each user matches the process and the resource associated with the authority information.

In the present invention, when the plurality of users working on the device include a first user and a second user, the authority information includes a first authority information and a second authority information.
The first authority information is specified so that the first user has authority over one or more resources used for one or more processes as work related to the device.
The second authority information is specified so that the second user has authority over one or more resources used for one or more processes as work related to the device.
The user application monitoring processing unit collates whether or not the work to be performed by the first user matches the first authority information permitted to the first user, and then the second user application monitoring processing unit collates. It can also be configured to match whether or not the work that the user is trying to perform matches the second authority information granted to the second user.

Further, according to another feature of the present invention, it is a method of managing access when a plurality of users work on a device via a network.
Communication is performed via a hypervisor between the normal area operating in the first operating system and the secure area operating in the second operating system having a higher security level than the first operating system.
In the normal area, a step of transmitting the authentication information required for authentication received from the user via the network to the secure area, and
In the secure area, when the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the user is permitted. A step of transmitting the authority information for which work is specified to the normal area, and
In the normal area, a step of receiving authority information from the secure area in which work related to a device permitted to the user when the user is successfully authenticated is received from the secure area.
In the normal area, the user application monitoring processing unit collates whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match. Is a step that disables the work that the user is trying to do,
Provided is a method including a step of monitoring that the processing content of the user application monitoring processing unit executed in the normal area has not been changed in the secure area during the operation of the user. ..

Further, according to still another feature of the present invention, between the normal area operating in the first operating system and the secure area operating in the second operating system having a higher security level than the first operating system. A program for managing access when multiple users work on a device over a network using communication.
On the computer
In the normal area, a step of transmitting the authentication information required for authentication received from the user via the network to the secure area, and
In the secure area, when the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the user is permitted. The step of transmitting the authority information for which the work is specified to the normal area, and
In the normal area, a step of receiving the authority information from the secure area in which work related to a device permitted to the user when the user is successfully authenticated is specified.
In the normal area, the user application monitoring processing unit collates whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match. Is a step that disables the work that the user is trying to do,
In the secure area, a program for executing a step of monitoring that the processing content of the user application monitoring processing unit executed in the normal area has not been changed during the operation of the user is provided. ..

According to the present invention, it is possible to maintain security while allowing remote access to an IoT device to improve convenience.

It is a figure which shows the structure of the access control system 100 which concerns on one Embodiment of this invention. It is a figure which shows an example of the operation flow of the access management system 100 which is one Embodiment of this invention. It is a figure which shows an example of the data which is sent and received between the user application monitoring processing module and the authentication module at the time of the user (contractor) authentication processing. It is a figure which shows an example of the data structure of the authentication information and authority information stored in a secure data memory. It is a figure which shows the detail of the operation flow of steps 200 to 210 of FIG.

[System configuration]
FIG. 1 shows the configuration of the access management system 100 according to the embodiment of the present invention.

The access management system 100 is connected to the external terminal device 200 used by the user (trader) via the network 1.

In the access management system 100, a plurality of virtually separated execution environments are provided by the hypervisor 51 that realizes the virtualization technology. In FIG. 1, two execution environments are illustrated. One execution environment is a normal area 10 (also referred to as a normal execution environment or a normal domain), and the other execution environment is a secure area 30 (also referred to as a secure execution environment or a secure domain).

That is, the hypervisor 51 operates on the CPU 50, and the virtual computer in the normal area 10 and the virtual computer in the secure area 30 are constructed on the access management system 100. A memory space, an input / output device, and the like are separated between the normal area 10 and the secure area 30.

The normal area 10 is an execution environment of an OS that is widely and generally used, and is an execution environment that has no particular functional restrictions other than restricting access to the secure area 30.

The secure area 30 is, for example, an independent execution environment provided separately from the normal area 10 on a system using one CPU for the purpose of isolating the security function. Access to the secure area 30 from the normal area 10 is restricted.

As described above, since the access to the secure area 30 is restricted from the normal area 10, the hypervisor 51 is used to call the process to be executed from the normal area 10 to the secure area 30.

[Structure of normal area 10]
In the normal area 10, the normal OS 11, the application 13, the application 14, and the user application monitoring processing module 12 are present. Although not shown, there is also a predetermined memory for storing these. The user application monitoring processing module 12 monitors applications such as application 13 and application 14 that the user executes on the IoT device. The user application monitoring processing module 12 is stored in a non-volatile memory such as a ROM, and is configured to be able to monitor from the secure area 30 whether or not its contents have been modified.

The application 13 and the application 14 are processes that the user executes for the resources of the IoT device, for example, a process in which the user updates resources such as firmware related to the IoT device.

(Configuration of User Application Monitoring Processing Module 12)
The user application monitoring processing module 12 mediates all communication to the access management system 100 from the outside. That is, in the access management system 100, the port for connecting to other than the user application monitoring processing module 12 is basically closed.

The user application monitoring processing module 12 is a process performed by an application such as application 13 or application 14 that the user intends to execute when the user intends to execute an application such as application 13 or application 14 in the normal area 10. Monitor whether the user has permission for the resources used by the process.

Specifically, the user application monitoring processing module 12 acquires the authentication information input by the user (trader) who remotely accesses through the user interface of the external terminal device 200, and communicates with the authentication module 32 on the secure area 30 side. Then, make an authentication request for the user (trader). If the authentication is successful, a whitelist is obtained that shows the resources that the user (trader) can access and the processes that are allowed to work on the resources. Then, based on the whitelist acquired at the time of authentication, access to the resource is monitored, and when an access violation is detected, actions such as warning, communication interruption, and restart are executed as predetermined actions. Based on the whitelist obtained at the time of authentication, access to the resource is monitored, and if no access violation is detected, the user (trader) can actually work. In this case, the user (trader) Since the process permitted as the work performed by is communication to the access management system 100 from the outside, it is realized by relaying by the user application monitoring processing module 12.

Further, the user application monitoring processing module 12 may be configured to store all the communication contents with the user (trader) transmitted / received via the user application monitoring processing module 12 as evidence.

By using the user application monitoring processing module 12 executed in the normal area 10, it is possible to utilize the conventional software assets running on the normal OS 11 which is a normal OS. However, if the user application monitoring processing module 12 is vulnerable, the authentication function may be bypassed or security measures may be circumvented. Therefore, it is necessary to confirm the software signature at startup or in memory. It is configured to take measures such as monitoring the data of the executable format of the user application monitoring processing module 12 deployed in.

[Configuration of secure area 30]
The secure area 30 includes a secure OS 31, an authentication module 32, a secure data memory 33, a normal area monitoring processing module 36, and the like.

The secure data memory 33 stores authentication information / authority information 34, 35 as information of a user (trader) who can access the IoT device. The authentication information is information such as a combination of ID and password, and the authority information is a white list listing resources and processes that the user (trader) can access. Further, the secure data memory 33 may store key information (for example, a private key, a common key) in addition to the authentication information for authenticating the user via the user interface of the external terminal device 200.

The secure OS 31 has a stricter account management function and access control function than a general OS such as the normal OS 11. For example, a MAC (Mandatory Access Control) controls forced access to files and devices. .. In a general OS, a user who has been given access authority can change the access authority for an access target that can be managed by himself / herself. However, in forced access control, only the security administrator has the access authority, and the access authority cannot be changed by the user or system administrator who has the access authority. With regard to account management, the owner of a facility such as a factory has the greatest privilege and can add or delete other users.

(Configuration of authentication module 32)
The authentication module 32 receives a user (trader) authentication request from the user application monitoring processing module 12 in the normal area 10, collates it with the authentication information in the secure data memory 33, and if the authentication is successful, the user (the user (trader)). The authority information of the vendor) is returned to the user application monitoring processing module 12.

Specifically, the authentication module 32 receives the authentication information from the user application monitoring processing module 12 that has received the user (trader) authentication information input via the external terminal device 200, for example. In this case, the user application monitoring processing module 12 may be configured to transmit information (data) encrypted with a key (for example, a public key or a common key) to the authentication module 32.

The authentication module 32 can obtain a session key by decrypting the received information with a key (for example, a private key). When the authentication module 32 decrypts the acquired information with a predetermined key (for example, a private key or a common key) to acquire the authentication information, the authentication module 32 collates the acquired authentication information with the authentication information stored in the secure data memory 33. When both authentication information match, it can be determined that the authentication information acquired from the user application monitoring processing module 12 is valid. If both authentication information do not match, it can be determined that the authentication information acquired from the user application monitoring processing module 12 is not valid. When both authentication information match, the authority information 34, 35 corresponding to each user (trader) stored in the secure data memory 33 is transmitted to the user application monitoring processing module 12. With the above configuration, after authenticating each user (trader), the authority information corresponding to each user (trader) is provided, and it is possible to prevent a cyber attack that invades from the network.

Since the authentication module 32 executed in the secure area 30 authenticates the user, the cyber attack that has invaded the normal area 10 can be stopped in the secure area 30, and the cyber attack can be suppressed to improve the security. it can.

(Configuration of normal area monitoring processing module 36)
As described above, the user application monitoring processing module 12 is configured to mediate all communications to the access management system 100 from the outside, and whether or not it has authority over the work contents of the user (contractor). Is to monitor. Therefore, considering its function, it is essential that the user application monitoring processing module 12 guarantees that the processing content is authentic.

In this regard, the normal area monitoring processing module 36 reads and monitors the data in the execution format of the user application monitoring processing module 12 expanded on the memory, and when it detects tampering with the data, it re-executes as a predetermined operation. Execute startup etc. The monitoring of the user application monitoring processing module 12 is performed at least once, preferably from the user (trader) login to logout, in order to detect data tampering at any time from the user (trader) login to logout. It can be configured to be performed regularly according to the time until.

Since the normal area monitoring processing module 36 exists in the secure area 30 and is an application having read authority of the memory in the normal area 10, as described above, the data in the execution format of the user application monitoring processing module 12 Can be read.

[Operation flow]
FIG. 2 shows an example of the operation flow of the access management system 100 according to the embodiment of the present invention.

In step 100, when the user (trader) intends to work on the device via the network, the user (trader) requests to log in to the device via the external terminal device 200. For example, the user (trader) can make a login request via the user interface of the external terminal device 200, and the login request data input by the user (trader) is transmitted to the user application monitoring processing module 12. .. The login request data may be configured to include specifying the device to be accessed by the user (trader) and the work for the device.

In step 105, the normal area monitoring processing module 36 starts monitoring the executable data of the user application monitoring processing module 12. This monitoring is started in response to a login request of a user (trader), for example, and is periodically performed at an arbitrary timing until log-out. By this monitoring, a user application that performs user (trader) authentication processing, which will be described later, monitoring processing of whether the user (trader)'s work content has authority, relay processing of the actual work of the user (trader), etc. It is possible to guarantee that the processing content itself of the monitoring processing module 12 has not been tampered with. If it is detected that the processing content of the user application monitoring processing module 12 itself has been changed by an unauthorized third party, the operation of the user application monitoring processing module 12 is stopped by restarting or the like as a predetermined operation. It is configured so that the work of the user (contractor) can be interrupted.

In step 110, the user application monitoring processing module 12 receives the login request of the user (trader) and requests the user (trader) for authentication information via the external terminal device 200.

In step 120, the user (trader) is urged to input the authentication information via the external terminal device 200, and the user (trader) is made to input the authentication information.

In step 130, when the user application monitoring processing module 12 receives the authentication information input by the user (trader), the user application monitoring processing module 12 makes an authentication request to the authentication module 32. In this case, the transmission of the authentication request signal from the user application monitoring processing module 12 to the authentication module 32 is performed via the hypervisor 51 because the access is from the normal area 10 to the secure area 30. Further, the user application monitoring processing module 12 may be configured to transmit information (data) encrypted with a key (for example, a public key or a common key) to the authentication module 32.

In step 140, when the authentication module 32 receives the authentication request signal, the received authentication information is collated with the authentication information in the secure data memory 33. The authentication module 32 can obtain a session key by decrypting the received information with a key (for example, a private key). In this case, when the authentication module 32 decrypts the acquired information with a predetermined key (for example, a private key or a common key) and acquires the authentication information, the acquired authentication information and the authentication information stored in the secure data memory 33 are combined. Match.

In step 150, if the acquired authentication information and the authentication information stored in the secure data memory 33 match, it is determined that the authentication information acquired from the user application monitoring processing module 12 is valid (corresponding to the case where the drawing is OK). .. If the authentication information of both does not match, a signal for determining that the authentication information acquired from the user application monitoring processing module 12 is not valid is transmitted to the user application monitoring processing module 12 (corresponding to the case of NG in the drawing).

In step 160, when the acquired authentication information and the authentication information stored in the secure data memory 33 match, the authority information stored in the secure data memory 33 is referred to.

In step 170, when it is determined that the authentication information acquired from the user application monitoring processing module 12 is not valid, the user application monitoring processing module 12 transmits a signal to the external terminal device 200 that the authentication has failed.

In step 180, when it is determined that the authentication information acquired from the user application monitoring processing module 12 is valid, the authority information corresponding to each user stored in the secure data memory 33 is returned to the user application monitoring processing module 12. .. The authority information is a white list for each user (trader) about information associated with a process and resources used in the process as work permitted to the user (trader).

In step 190, the user application monitoring processing module 12 acquires authority information which is a white list listing combinations of users (traders), resources, and processes for each user (trader).

In step 200, the process of monitoring the work that the user (trader) intends to perform is started based on the whitelist whether or not the resources and processes are authorized to the user (trader). Step 200 is performed for each resource and each process for each logged-in user, as will be described later.

Specifically, the resources and processes for the work that the user (trader) intends to perform are as follows. That is, for example, when the "user (contractor)" is a contractor such as a camera manufacturer that outsources the maintenance of the camera itself, the "resource" is, for example, the firmware of the camera, the application unique to the manufacturer, or the like. The "process" corresponds to, for example, a process such as an update. Further, for example, when the "user (contractor)" is a contractor such as a security company that outsources security operations such as monitoring intruders into the factory, the "resource" is, for example, video data acquired by a camera. And so on, the "process" corresponds to, for example, an access such as reading video data.

Here, FIG. 3 shows an example of data transmitted and received between the user application monitoring processing module 12 and the authentication module 32 during the authentication processing of the user (trader). FIG. 3A shows an example of data sent from the user application monitoring processing module 12 to the authentication module 32 via the hypervisor 51 when an authentication request is made by the user (trader) in the above step 130. FIG. 3B shows an example of the data sent from the authentication module 32 to the user application monitoring processing module 12 in the above step 180.

Further, FIG. 4 shows an example of the data structure of the authentication information and the authority information stored in advance in the secure data memory 33. FIG. 4A shows a state in which a password corresponding to a user ID is registered as authentication information. FIG. 4B shows how the processes, resources, and access conditions permitted to the user are linked and registered as the authority information. In step 140 described above, it is collated whether or not the user ID and password sent at the time of the authentication request in FIG. 3A match the registered user ID and password in FIG. 4A. In step 160 above, the registered authorization process, authorization resource, and access condition of FIG. 4B are read and referred to as the authority information corresponding to the authenticated user (trader) of FIG. 3A. That is, in this example, as the authority information for the user ID "0123456", the authorization process "updater", the authorization resource "firmware" and the access condition "writable", and the authorization process "updater", the authorization resource "application01" and the access Refer to the condition "Writable". After that, in step 180 described above, with reference to FIG. 4B, the permission process “updater”, the permission resource “firmware”, the access condition “writable”, and the permission are used as the authority information for the user ID “0123456”. Returns the process "updater", the authorized resource "application01" and the access condition "writable".

After the start of the monitoring process in step 200, the work to be performed by the user (contractor) is used by the user (contractor), the process authorized to the user (contractor), and the process. If a resource is on the whitelist, the user (trader) is allowed to perform the work of performing the process on the resource. Therefore, in step 210, the user (contractor) is notified of the start of operation acceptance of the work so that the actually permitted work can be performed. As a notification of the start of operation acceptance, the information of the set in which the user (trader), the process, and the resource are linked may be transmitted to the external terminal device 200. On the other hand, if the process given as authority to the user (trader) and the resources used by the process do not exist in the whitelist, the process is disabled by stopping the process. ..

The details of the process of monitoring resources and processes for each user (trader) in steps 200 to 210 will be described later.

In step 220, in the external terminal device 200, the user (trader) can instruct the user (trader) to actually start a process for the resource for the work permitted.

In response to the start instruction in step 220, a predetermined process is performed on a predetermined resource as a work permitted to the user (contractor). In step 230, the process is performed via the user application monitoring processing module 12, which stores all log information about the work that the user (trader) intends to perform, and also regarding the work. Notify the application stored in the normal area 10 that the work can be executed.

In step 300, the application related to the work stored in the normal area 10 responds, and the work can be actually performed.

[Details of Step 200 and Step 210 (Resource Monitoring and Operation Acceptance Start Processing)]
FIG. 5 shows the details of the processes of steps 200 to 210 of FIG. Each step in FIG. 5 is an internal process of the user application monitoring process module 12.

Here, as shown in FIG. 4B, in a situation where the users (traders) "0123456" and "1234567" and the whitelist for each user (trader) are already registered, these users (traders) ) Explains the flow of monitoring whether or not the work to be performed is authorized. That is, specifically, the user (trader) "0123456" performs "updater (data update)" as a process for the resource "firmware", and the resource "application01 (application 01)". Monitors when performing "updater (data update)" as a process for "", and the user (trader) "1234567" is the process "camera_viewer (camera video data)" for the resource "camera". (Access to) ”is performed.

First, in step 10, a list of logged-in users (traders) is acquired. In this example, "0123456" and "01234567" are acquired as users (traders).

In step 12, one of the users is identified. In this example, first, "0123456" is specified as the first user.

In step 14, a list of processes (processes that are already running if they are already running due to an operation of another user or the like) that the user specified in step 12 is scheduled to run as work is acquired. In this example, "updater (data update)" is acquired for the user "0123456" as a process scheduled to be operated.

In step 16, one process is specified from the list of processes acquired in step 14. In this example, the process for the user "0123456" is only "updater (data update)", and "updater (data update)" is specified as the process, and the process proceeds to step 18.

In step 18, a list of resources in use for one process identified in step 16 is acquired. In this example, "firmware" and "application01" are acquired as a list as resources to be used (in use) for the process "updater (data update)" of the user "0123456".

In step 20, one of the resources acquired in step 18 is specified. In this example, "firmware" is identified as the first resource.

In step 22, the combination of one user identified by step 12, step 16 and step 20, the process performed by the user, and the resources used for the process is shown in the authority information acquired in step 190 of FIG. It is determined whether or not it exists in the list of resources and processes that the (trader) can access. If the combination is not in the list, the process proceeds to step 24, and if the combination is present in the list, the process proceeds to step 26.

In step 24, when the combination does not exist in the list in step 22, a default operation such as stopping the corresponding process is executed. As a result, if the logged-in user (trader) is not authorized to perform the work, the work can be prevented from being performed.

In step 26, when the combination is present in the list in step 22, the process proceeds to steps 26, 28, 30 and 32 so that the actual work can be performed on the combination. In addition, if there are other resources, the process of returning to step 20 is performed.

Regarding steps 22 to 26, in this example, the combination of the user "0123456", the process "updater", and the resource "firmware" is listed as a whitelist as shown in FIG. 4B. , Step 26 will be taken. In step 26, since “application01” exists as the next resource, the process returns to step 20. Returning to step 20, "application01" is specified as a resource, and the process proceeds to step 22. In step 22, since the combination of the user “0123456”, the process “updater”, and the resource “application01” is listed as a white list as shown in FIG. 4 (b), the actual work related to the combination is performed. Steps 26, 28, 30 and 32 to make it possible to do this. In this example, step 26 does not return to step 16 because there are no more resources.

In step 28, if there is another process, the process returns to step 16, and in parallel with this, the process proceeds to step 30. In this example, there is no further process for user "0123456", so there is no return to step 16.

In step 30, if there is another user (trader), the process returns to step 12, and if there is no other user (trader), the process proceeds to step 32. In this example, since the user "1234567" exists as another user (trader), the process returns to step 12. In steps 12 to 20, the combination of the user "12345467", the process "camera_viewer", and the resource "camera" is specified. In step 22, since the combination is listed as a white list as shown in FIG. 4 (b), steps 26 and 28 are made so that the actual work can be performed on the combination. , 30 and 32. As for the user "1234567", since there are no other resources or other processes, the user does not return from step 26 to step 20 or from step 28 to step 16. In step 30, in this example, since there is no other user (trader), the process does not return to step 12, but only proceeds to step 32.

In step 32, the user who is sequentially recognized as being on the whitelist in step 22, the process performed by the user, and the combination of resources used in the process are sequentially subjected to work for each user. Notify the start of accepting work operations. Further, it temporarily waits until a new user logs in, and when the new user logs in, the process returns to step 10.

As described above, according to the above steps 10 to 32, first, the user (trader) "0123456" monitors the case where the process "updater" is performed on the resource "firmware", and then the user. Monitoring when the (trader) "0123456" performs the process "updater" for the resource "application01", then the user (trader) "1234567" performs the process "camera_viewer" for the resource "camera". It is possible to realize the process of monitoring when performing. Each user (trader) was pre-registered by sequentially monitoring whether each user, process, and resource combination had authority for each task that each user was trying to perform on the device. Access to resources within the device can be reliably restricted so that only work can be performed.

As described above, with respect to step 200 and step 210 (resource monitoring and operation acceptance start processing) of FIG. 2, each user (contractor) has authority for each work to be performed on the device according to the detailed flow of FIG. If it is recognized that, each user can actually perform each work on the device through steps 210 to 220, 230, and 300 in FIG.

Further, as described above, by the monitoring process by the user application monitoring processing module 12 in steps 10 to 32 of FIG. 5, each user (contractor) can perform the work other than the pre-registered work to the resource related to the device. Although access can be reliably restricted, the monitoring process itself by the user application monitoring processing module 12 is further monitored by step 105 of FIG. The secure area 30 is designed with the functions minimized in order to maintain a high security level, and the user application monitoring processing module 12 exists in the normal area 10 instead of the secure area 30. That is, the monitoring process of the user application monitoring process module 12 is performed in the normal area 10, and the security level is not sufficient. However, the present invention determines whether the content of the monitoring process has been tampered with in the secure area. The security level is improved by adopting a system for further monitoring from 30.

The processing in the access control system according to the present invention can be realized by using a general computer terminal and its peripheral devices, and a computer program executed on the computer terminal. The central role of this system is the software part related to access control consisting of computer programs. The software may be separate for each function regarding the processing in the normal area 10 and the secure area 30, but in that case, the software is configured to cooperate with each other in response to each processing in the above operation flow. Will be done.

Further, although the above example has described monitoring when there are two users (traders), it can also be applied to cases where there are three or more users. For example, it is possible to assume that the surveillance camera (IP camera) is allowed remote access to the camera manufacturer (contractor 1), the security company (contractor 2), and the operation status monitoring contractor (contractor 3) as three vendors. is there. In this case, the camera maker (contractor 1) is entrusted with the maintenance of the camera itself, and work such as updating the camera firmware and the maker's own application may be permitted. The security company (contractor 2) is entrusted with security operations such as monitoring intruders into the factory, and operations such as monitoring by accessing the video data acquired by the camera may be permitted. The operation status monitoring contractor (contractor 3) is entrusted with the work of monitoring whether the camera is operating normally, and the work of checking the network status and the process status may be permitted.

As described above, an embodiment and an embodiment of access control of the IoT device in the factory according to the present invention have been described, but the present invention is not limited to the above-mentioned embodiment, and various examples thereof. It is easily understood that the above can be changed and, for example, it can be applied to access control of IoT devices installed in apartment houses and the like. And, as long as they are within the scope of the matters stated in each claim of the claims and the matters equivalent thereto, they are naturally included in the technical scope of the present invention. The above embodiment has been made for access control in the case of a specific work for a surveillance camera, but this is only an example, and the present invention is not limited to this specific specific example.

The present invention can be used to monitor remote access to IoT devices.

1 network 10 normal area 11 normal OS
12 User application monitoring processing module 13 14 Application 30 Secure area 31 Secure OS
32 Authentication module 33 Secure data 34 35 Authentication information / authority information 36 Normal area monitoring processing module 50 CPU
51 Hypervisor 200 User (trader) External terminal

Claims (7)

An access management system for multiple users to work on devices over a network.
The normal area that runs on the first operating system,
A secure area that operates in a second operating system with a higher security level than the first operating system,
It is equipped with a hypervisor that enables communication between the normal area and the secure area.
The normal region is
The authentication information required for authentication received from the user via the network is transmitted to the secure area, and the work related to the device permitted to the user when the authentication of the user is successful in the secure area is specified. The authority information is received from the secure area, and it is collated whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match, it is checked. It has a user application monitoring processing unit that executes processing that disables the work that the user intends to perform.
The secure area is
When the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and when the authentication of the user is successful, the work permitted to the user is specified. An authentication processing unit that transmits the authority information to the normal area,
It has a normal area monitoring processing unit that monitors that the processing content of the user application monitoring processing unit executed in the normal area has not been changed during the operation of the user's work.
system. The normal area monitoring processing unit periodically reads out the information of the user application monitoring processing unit stored in the memory area in the normal area, and when the information of the user application monitoring processing unit is changed, the information is changed. The system according to claim 1, which makes the work infeasible. The authentication processing unit
When the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the process and the operation permitted to the user are described. The authority information associated with the resources used in the process is transmitted to the normal area, and
The user application monitoring processing unit
When the authentication of the user is successful from the secure area, when the authority information associated with the process and the resource used for the process is received as the work permitted to the user, the user performs a row regarding the device. It is checked whether or not the process to be attempted and the resource used for the process match the process associated with the authority information of the user and the resource, and if they do not match, the device is described. Performs a process to stop the process the user is trying to do,
The system according to claim 1 or 2. The user application monitoring processing unit acquires a list of processes in operation or scheduled to be operated for each user of the plurality of users as the authority information, and acquires a list of resources in use or scheduled to be used for each process. The system according to claim 3, wherein each process and each resource for the user collates whether or not the process and the resource associated with the authority information match. When the plurality of users working on the device include a first user and a second user, the authority information includes a first authority information and a second authority information.
The first authority information is specified so that the first user has authority over one or more resources used for one or more processes as work related to the device.
The second authority information is specified so that the second user has authority over one or more resources used for one or more processes as work related to the device.
The user application monitoring processing unit collates whether or not the work to be performed by the first user matches the first authority information permitted to the first user, and then the second user application monitoring processing unit collates. Is configured to match whether the work that the user is trying to do matches the second authorization information granted to the second user.
The system according to claim 4. A way to manage access when multiple users work on a device over a network.
Communication is performed via a hypervisor between the normal area operating in the first operating system and the secure area operating in the second operating system having a higher security level than the first operating system.
In the normal area, a step of transmitting the authentication information required for authentication received from the user via the network to the secure area, and
In the secure area, when the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the user is permitted. The step of transmitting the authority information for which the work is specified to the normal area, and
In the normal area, a step of receiving the authority information from the secure area in which work related to a device permitted to the user when the user is successfully authenticated is specified.
In the normal area, the user application monitoring processing unit collates whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match. Is a step that disables the work that the user is trying to do,
A method including a step of monitoring during the operation of the user that the processing content of the user application monitoring processing unit executed in the normal area has not been changed in the secure area. Using communication between the normal area operating in the first operating system and the secure area operating in the second operating system having a higher security level than the first operating system, a plurality of users can use the communication over the network. A program for managing access when working on a device
On the computer
In the normal area, a step of transmitting the authentication information required for authentication received from the user via the network to the secure area, and
In the secure area, when the authentication information transmitted from the normal area is received, the user is authenticated based on the authentication information, and if the authentication of the user is successful, the user is permitted. The step of transmitting the authority information for which the work is specified to the normal area, and
In the normal area, a step of receiving the authority information from the secure area in which work related to a device permitted to the user when the user is successfully authenticated is specified.
In the normal area, the user application monitoring processing unit collates whether or not the work that the user intends to perform with respect to the device matches the work specified as the authority information of the user, and if they do not match. Is a step that disables the work that the user is trying to do,
A program for executing a step of monitoring in the secure area that the processing content of the user application monitoring processing unit executed in the normal area has not been changed during the operation of the user.

Images