JP2021013094A - Ip equipment remote control operation system - Google Patents

Abstract

To obtain an IP equipment remote control operation system which allows an operator to perform remote control operation without using a domain name by DDNS, and is less susceptible to illegal access.SOLUTION: An IP equipment remote control operation system has: an administrative server 1 placed on a network N; an access information notification apparatus 3 connected with communication equipment 5 for connected with the network N together with operation object IP equipment 2, and notifying the administrative server of address information required for the operator to access the operation object IP equipment; and an operation terminal 4 used by the operator for remote controlling the operation object IP equipment 2. Access information notification equipment 3 periodically transmits an IP packet, including a Port number for enabling access to the operation object IP equipment 2 by the operation terminal 4 and association information of the operator and the operation object IP equipment, to the administrative server 1. The operation terminal 4 can access the operation object IP equipment 2 directly by procuring the information for accessing the operation object IP equipment 2 from the administrative server 1.SELECTED DRAWING: Figure 5

Description

The present invention relates to an IP device remote control system for operating an IP device via a network.

In recent years, with the shift to IP devices that can be connected to mobile terminals such as smartphones and networks of home appliances, network + IOT (Internet of Things) technology has been used from the functions unique to each unit as seen in conventional analog products (for example, TV). Products equipped with video on-demand via networks such as smartphones and recorders, remote control such as turning on / off lighting from the outside), and convenient functions that have never existed before are becoming widespread.
The core of this IOT technology is a network that uses IP communication technology (representative network: the Internet), and without this network, the expansion of various services and functions cannot be utilized in a global environment. It is a situation.

The Internet network is a network that can be used on a global scale as a function that can be used from anywhere as long as the IOT technology is used for a public network and the operator can connect to the network. The communication method between each device in this network is IP communication, and the address (address) used to identify the most important communication device in IP communication is the IP address (equivalent to a telephone number in the case of a telephone). ).

There are fixed IP address and dynamic IP address in this IP address, and the operator selects whether to use the fixed IP address or the dynamic IP address, and the IP address method that can be used between the contracted provider and the operator Although it is decided, most Internet network operators do not need IP address management knowledge and use the Internet network using dynamic IP address contracts with low provider contract fees.

However, with this dynamic IP address, if you want to perform remote control from the outside even with a network compatible device (IP device) that can be connected to the network, the assigned IP address will change dynamically, so specify the IP address. There is a problem that it cannot be connected and operated remotely.

As one of the solutions, there is a technology called DDNS (Dynamic Domain Name Service) that links a dynamic IP address with a host name + domain name, and this technology enables remote connection and operation using the dynamic IP address. It is possible.
For example, in Patent Document 1, communication is performed between a control device that controls an IP device and a server that functions as a DDNS server, and when the DDNS server collates the MAC address received from the control device, the terminal device transfers to the control device. Access is possible, and if access is made within a predetermined time, the electronic device can be controlled by the terminal device via the control device.

Japanese Unexamined Patent Publication No. 2011-142519

However, in the technology of linking a dynamic IP address with a host name + domain name, domain management is indispensable for the host name and domain name for linking, and it takes several hours to 72 hours to penetrate DNS to the Internet network. Since penetration delay occurs, there is a problem that there is a period when connection is not possible even if a domain name is used.

Further, the technology of Patent Document 1 aims to prevent unauthorized access by using the technology of DDNS by setting a limit on the time that the terminal device can access the control device, but the Internet that can be used all over the world. By using the host name + domain name, the situation where you can access from anywhere does not change.
In addition, since the dynamic IP address used can be easily identified (identifiable by commands such as nslookup / Ping), security problems that enable unauthorized access by a malicious third party continued to occur. ..

Therefore, in view of such a problem, an object of the present invention is to provide an IP device remote control system that can be remotely controlled by an operator without using a domain name by DDNS and is less susceptible to unauthorized access.

In order to solve the above problem, the IP device remote operation system according to the invention of claim 1 is operated by an operator and a management server arranged on a network for managing the operation target IP device and its operator. An access information notification device that notifies the management server of address information for accessing the target IP device, an operation terminal for the operator to remotely operate the operation target IP device via the network, an access information notification device and an operation target. It has a communication device that is connected to the IP device and notifies the management server of the dynamic IP address information for accessing the operation target IP device via the network, and the access information notification device is the operator. In addition to the association information with the operation target IP device, an IP packet having a Port number for enabling the operation terminal to access the operation target IP device is transmitted to the management server, and the communication device is assigned to itself. The obtained dynamic IP address information is added to the IP packet and transmitted to the management server, and the management server uses the received IP packet to provide dynamic IP address information and Port number information, as well as the operator and the operation target IP device. An operation terminal that has an operation target IP device information storage unit that reads and stores the association information and an operation terminal permission information storage unit that stores a password for permitting access from the operation terminal, and has received permission from the management server. However, the dynamic IP address information and the Port number information for accessing the operation target IP device are obtained from the management server, and the operation target IP device can be operated.
According to this configuration, the access information notification device registers the dynamic IP address information and the like necessary for accessing the operation target IP device in the management server. Then, by first accessing the management server from the operation terminal and indexing the information, it is possible to access and operate the operation target IP device from the operation terminal.
Therefore, remote control can be performed without using a domain name by DDNS, and the dynamic IP address used cannot be easily grasped by a third party, so that unauthorized access to the operation target IP device can be prevented. In addition, since the domain name by DNSS is not used, the problem of DNS penetration time can be solved.

The invention according to claim 2 is characterized in that, in the configuration according to claim 1, the access information notification device periodically transmits an IP packet to the management server.
According to this configuration, even if the dynamic IP address for accessing the operation target IP device is changed, the latest information is always registered in the management server, so that the operation target IP device can be accessed from the operation terminal. Can be operated.

According to the invention of claim 3, in the configuration according to claim 1 or 2, the access information notification device recognizes when the dynamic IP address assigned to the communication device changes, and receives the change to generate an IP packet. It is characterized by sending to the management server.
According to this configuration, if the dynamic IP address assigned to the communication device changes, that is, if the dynamic IP address required to access the operation target IP device changes, the registered contents of the management server at that time Since it is rewritten, the operation target IP device can be reliably accessed from the operation terminal.

According to the present invention, the access information notification device registers the dynamic IP address information and the like necessary for accessing the operation target IP device in the management server. Then, by first accessing the management server from the operation terminal and indexing the information, it is possible to access and operate the operation target IP device from the operation terminal.
Therefore, remote control can be performed without using a domain name by DDNS, and the dynamic IP address used cannot be easily grasped by a third party, so that unauthorized access to the operation target IP device can be prevented. In addition, since the domain name by DNSS is not used, the problem of DNS penetration time can be solved.

It is a block diagram which shows an example of the IP device remote control system which concerns on this invention. It is a functional block diagram of the access information notification device. It is explanatory drawing of the IP Ket output by the access information notification device. It is explanatory drawing of the IP packet output by the router to which the operation target IP device is connected which receives the IP packet output from the access information notification device. It is a figure which shows the operation flow of the management server which received the IP packet. It is a sequence diagram which shows the flow of the process of operating the operation target IP device by the operation terminal.

Hereinafter, embodiments embodying the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration diagram showing an example of a remote control system according to the present invention, in which 1 is a management server that manages the operation target IP device 2 and its operator, and 3 is an operator accessing the operation target IP device 2. The access information notification device 4 that notifies the management server 1 of the address information for the purpose is an operation terminal for the operator to remotely control the operation target IP device 2.

The management server 1 is a device for notifying the operator of information necessary for the operator to operate the IP device, and is arranged on the network N. Then, the operation target IP device information storage unit 1a and the operation terminal permission information storage unit 1b, which will be described later, are provided, and the information necessary for accessing the operation target IP device 2 is obtained from the access information notification device 3.

The access information notification device 3 is connected to the network N via the communication device 5, performs Internet communication with the management server 1 on the network N, and transmits information about the operator and the operation target IP device 2 to the management server 1. Send. Reference numeral 6 denotes a router for connecting the management server 1 to the network N.

The communication device 5 is a device to which a WAN side dynamic IP address (dynamic IP address) is assigned by the provider when communicating with the device on the network N, and performs Internet communication with the management server 1. For example, a router can be used as the communication device 5.

The operation target IP device 2, the access information notification device 3, and the communication device 5 are arranged in a common area E such as in a house, and the operation target IP device 2 and the access information notification device 3 are networked via the same communication device 5. It is connected to N.

The operation target IP device 2 is a Web server-equipped IP device that can be operated by an external device via the network N, and is, for example, a measuring device, a security device, an air conditioner, a hot water supply device, or the like.

The operation terminal 4 has an operation unit capable of inputting a password and an ID, a display displaying various information, a communication unit connected to the network N, and the like, and can be used in a mobile terminal such as a smartphone or a network N such as a tablet terminal. An information device that is wiredly connected to a network N such as a device that connects wirelessly or a personal computer is applied. The operation terminal 4 shown in FIG. 1 shows a smartphone, and 4a is a display that also serves as an operation unit.

FIG. 2 is a functional block diagram of the access information notification device 3. As shown in FIG. 2, the access information notification device 3 determines the operator ID storage unit 31 for identifying the operator, the IP device ID storage unit 32 for specifying the operation target IP device 2, and the operation target IP device 2. It is provided with a port storage unit 33 for storing a port number for storage, an access information notification device CPU 34 for controlling an access information notification device 3, an access information notification device communication IF35 for communicating with a management server 1, and the like. However, the IP device ID and the used Port number are associated with each other, and when a plurality of IP devices are registered, the used Port number is registered for each IP device.
Then, in the access information notification device 3, the access information notification device CPU 34 periodically transmits an IP packet, which will be described later, to the management server 1 via the communication device 5 at regular time intervals such as every 3 minutes.

Here, the IP packet sent from the access information notification device 3 and the IP packet received by the IP packet and transmitted by the communication device 5 to the management server 1 will be specifically described.
FIG. 3 shows an IP packet output by the access information notification device 3 to the management server 1. As shown in FIG. 3, the IP packet is composed of a header unit, a data unit, and a trailer unit. The header portion includes a destination IP address, a source IP address (private IP address of the access information notification device 3), a destination port, a source port, and the like.
The data unit contains information such as a registered operator ID (operator ID), an ID of the operation target IP device 2 (IP device ID), and a port number used by the operation target IP device 2.

FIG. 4 shows an IP packet that the communication device 5 outputs to the network N toward the management server 1 in response to the IP packet transmitted from the access information notification device 3. As shown in FIG. 4, the data part of the IP packet received from the access information notification device 3 by the communication device 5 remains unchanged as it was transmitted from the access information notification device 3, but the communication device 5 sends the management server 1 to the management server 1. The dynamic global IP address (dynamic IP address) assigned to the communication device 5 is added to the IP header of the IP packet to be output.

The management server 1 that has received the IP packet transmitted from the access information notification device 3 via the communication device 5 identifies and reads the following information from the received IP packet, and performs an operator matching process using a dynamic IP address. To do.
FIG. 5 is a flowchart showing a flow in which the management server 1 grasps the dynamic IP address, the Port number information, and the like related to the operator, and the flow of grasping with reference to FIG. 5 will be described.
When the management server 1 receives the IP packet (S1), it analyzes the content of the IP packet (S2) and grasps the following items (S3).
(1) Specify the operator ID from the data part of the IP packet (2) Specify the dynamic IP address related to the operator (dynamic IP address of the passed communication device 5) from the header part (3) Remote control from the data part Specify the device ID you want to use (4) Specify the port number of the device you want to remotely control from the data section

The operator is identified from the specified information (S4), and if the operator is registered from the operator ID information, the following is specified by the operator match and the data is saved in the operation target IP device information storage unit 1a. Update (S6).
(1) Identification of the operator (2) Identification of the dynamic IP address used by the operator (3) Identification of the IP device to be remotely controlled If it is not registered and cannot be specified, the packet is discarded (S5). , Return to the standby state (S8).

Further, after the identification by the operator match, the database is updated (S7) according to the specified information, the latest information is maintained, and the standby state is returned (S8).
In this way, in order for the management server 1 to analyze the transmitted IP packet and grasp the unique ID of the operator and the source IP address (dynamic IP address), which operator accesses and uses the dynamic It is possible to manage what the IP address is and what the operation target IP device 2 is.

FIG. 6 shows a sequence diagram showing a flow of processing for operating the operation target IP device 2 by the operation terminal 4. With reference to FIG. 6, the flow of newly registering the operator, the flow of specifying the remote control terminal by the login of the operator, and the flow of the remote control by the operator will be described below.

<Registration of operator>
The unregistered operator first registers the operator information such as the name in the management server 1 (S11). Upon registration, the operator ID and password are issued as a license sheet (S12). The issued password is associated with the operator ID and stored in the operation terminal permission information storage unit 1b.
If the operator ID and password described in the license sheet are input from the predetermined login screen of the operation terminal 4, the input data is transmitted to the management server 1 (S13). At this time, the serial ID, device name, and the like of the operation terminal 4 that has been input and operated are also added and transmitted.

The management server 1 checks the user ID, password, and operation terminal 4 based on the data transmitted from the operation terminal 4, and in the case of new registration, the operation terminal is registered.
When the operator ID / password is authenticated by this series of processes, it is stored in the management server 1 in order to determine that it is a legitimate operator and identify the operator / operator terminal.

After the registration of the operator and the operation terminal 4 with the management server 1 is completed, the user ID, the operation target IP device ID, the port number used, and the like are registered in the access information notification device 3 (S14). Although the registration operation from the operation terminal 4 is shown here, the access information notification device 3 may be operated for direct input, or an input means such as a personal computer may be connected to the access information notification device 3. May be carried out.

The access information notification device 3 for which registration has been completed starts periodic transmission of 1P packets to the management server 1 at regular time intervals. S101 and S102 indicate the transmission of the IP packet, S101 indicates the transmission of the IP packet shown in FIG. 3, and S102 indicates the transmission of the IP packet shown in FIG.

<Identify the remote control terminal by logging in using the operator>
When the operation target IP device 2 is operated by the operation terminal 4, an authentication operation (login) is first performed (S15). In a predetermined authentication operation of the operation terminal 4, authentication data (device-specific information such as an operator ID, a password, and a serial ID of the operation terminal) is transmitted to the management server 1 via the network N.
The management server 1 that has received the authentication data performs user authentication by collating with the data registered in the operation terminal permission information storage unit 1b.

As a result of collation, if they match, they are authenticated and the operator ID is used as a matching key to acquire the device information (information of the operation target IP device 2) of the operator to be remotely controlled from the operation target IP device information storage unit 1a and log in. The name of the device that can be remotely controlled and the remote control link PATH are fed back to the operator's operation terminal 4 (S16).
The link PATH is data in which the operator's dynamic IP address (dynamic IP address assigned to the communication device 5) + the port number used + the PATH portion are linked.

<Remote control of operator>
The operation terminal 4 to which the name of the device that can be remotely controlled from the management server 1 and the remote control link PATH is fed back displays the fed-back information on the display 4a. When the operation target IP device 2 which is the device to be operated is selected from the displayed device name and the access operation is performed, the remote control link PATH is transmitted to the operation target IP device 2 via the network N, and the remote control becomes possible. (S17).
As a result, for example, when the operation target IP device 2 is a camera or a sensor and the operation for displaying the captured image is performed, the captured image is displayed on the display 4a of the operation terminal 4.

In this way, the access information notification device 3 registers the dynamic IP address information and the like necessary for accessing the operation target IP device 2 in the management server 1. Then, by first accessing the management server 1 from the operation terminal 4 and indexing the information, it is possible to access and operate the operation target IP device 2 from the operation terminal 4.
Therefore, remote control can be performed without using a domain name by DDNS, and since the dynamic IP address used cannot be easily grasped by a third party, unauthorized access to the operation target IP device 2 can be prevented. In addition, since the domain name by DNSS is not used, the problem of DNS penetration time can be solved.
Further, even if the dynamic IP address for accessing the operation target IP device 2 is changed, the registration information of the management server 1 is rewritten periodically so that the latest information is always registered and the rewriting can be supported. The operation target IP device 2 can be accessed from the terminal 4.

In the above embodiment, the access information notification device 3 periodically transmits an IP packet to the management server 1, but the WAN side dynamic IP address assigned to the communication device 5 itself changes, that is, it is dynamic. When the IP address changes, the access information notification device 3 may transmit an IP packet at that time. By providing the communication device 5 with a function of notifying the access information notification device 3 of the change of the dynamic IP address, it is possible to carry out the transmission at this timing.
In this way, when the dynamic IP address assigned to the communication device 5 is converted, the IP packet is transmitted at that time, so that the registered contents of the management server 1 are surely rewritten to the latest information. Therefore, the operation target IP device 2 can be reliably accessed by the operation terminal 4 that obtains the information at the stage of remote control.

1 ... Management server, 1a ... Operation target IP device information storage unit, 1b ... Operation terminal permission information storage unit, 2 ... Operation target IP device, 3 ... Access information notification device, 4 ... Operation terminal, 5・ ・ Communication equipment.

Claims (3)

A management server located on the network to manage the operation target IP device and its operator,
An access information notification device that notifies the management server of address information for the operator to access the operation target IP device, and
An operation terminal for the operator to remotely control the operation target IP device via the network, and
The access information notification device and the operation target IP device are connected to each other, and a communication device for notifying the management server of dynamic IP address information for accessing the operation target IP device via the network. Have and
The access information notification device includes an IP packet having a Port number for enabling the operation terminal to access the operation target IP device in addition to the association information between the operator and the operation target IP device. Send to the management server and
The communication device adds the dynamic IP address information assigned to itself to the IP packet and transmits it to the management server.
The management server reads and stores the dynamic IP address information, the Port number information, and the association information between the operator and the operation target IP device from the received IP packet, and an operation target IP device information storage unit.
It has an operation terminal permission information storage unit that stores a password for permitting access from the operation terminal.
The operation terminal that has obtained the permission of the management server obtains the dynamic IP address information and the Port number information for accessing the operation target IP device from the management server, and can operate the operation target IP device. An IP device remote control system characterized by The IP device remote control system according to claim 1, wherein the access information notification device periodically transmits the IP packet to the management server. Claim 1 or 2 characterized in that the access information notification device recognizes a change in the dynamic IP address assigned to the communication device and transmits the IP packet to the management server in response to the change. The IP device remote control system described.

Images