JP2023056740A - Routing control system, routing control device, device management device, routing control method, and program - Google Patents

Abstract

To prevent unauthorized use of a SIM-equipped device.SOLUTION: A route control system includes a first authentication unit that performs first authentication on a device subject to route control, a second authentication unit that performs second authentication on the device, and a route control unit that connects the device to the second authentication unit through the first route when the first authentication is successful, and connects the device to a target server through the second route when the second authentication by second authentication unit is successful.SELECTED DRAWING: Figure 1

Description

The present invention relates to technology for authenticating devices.

With the arrival of the 5G/IoT era, efforts to promote DX in IoT (Internet of Things) using mobile (eg, LTE/5G) lines are becoming active. In particular, 5G, which has the characteristics of high speed, large capacity, low latency, high reliability, and multiple simultaneous connections, is expected to create new value in each field by analyzing big data collected from various IoT devices with AI for each industry. ing.

On the other hand, it is necessary to manage a huge number of IoT devices installed in various places, and in particular, to protect them from information leaks due to security incidents and attacks on IoT devices and servers.

Japanese Patent Application Laid-Open No. 2020-137100

Mobile (LTE/5G) lines are said to have higher security than Wi-Fi (registered trademark), which is widely used as a wireless line, because wireless lines are connected by authentication using a tamper-resistant SIM. ing.

However, since IoT devices are installed in places that are difficult for people to manage, there is a risk that IoT devices and SIMs will be illegally replaced and used illegally. It should be noted that such unauthorized use is a problem that can occur not only in IoT devices.

SUMMARY OF THE INVENTION The present invention has been made in view of the above points, and an object of the present invention is to provide a technique for preventing unauthorized use of a device equipped with a SIM.

According to the disclosed technique, a first authentication unit that performs first authentication regarding a device to be route-controlled;
a second authentication unit that performs a second authentication on the device;
If the first authentication is successful, the device is connected to the second authentication unit through a first route, and if the second authentication by the second authentication unit is successful, the device is connected through a second route. A routing control system is provided comprising: a routing control unit for connecting to a server of;

According to the disclosed technique, a technique for preventing unauthorized use of a SIM-equipped device is provided.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure for demonstrating the outline|summary of embodiment. It is a figure which shows the structural example of a system. FIG. 4 is a sequence diagram for explaining the operation of the system; 3 is a functional configuration diagram of a route control device; FIG. 3 is a functional configuration diagram of a device management apparatus; FIG. 1 is a functional configuration diagram of an IoT device; FIG. It is a figure which shows the hardware configuration example of an apparatus.

An embodiment (this embodiment) of the present invention will be described below with reference to the drawings. The embodiments described below are merely examples, and embodiments to which the present invention is applied are not limited to the following embodiments.

In the following description, an IoT device is used as a device to be authenticated, and SIM authentication and device authentication are used as authentication methods, but these are examples. The technology according to the present invention can also be applied to devices other than IoT devices. Also, the technology according to the present invention can be applied to authentication methods other than SIM authentication and device authentication.

(Overview of Embodiment)
In this embodiment, in order to solve the above-mentioned problems, authentication is performed by combining authentication by the SIM installed in the IoT device and device authentication of the device (example: authentication using IMEI). is a correct combination, the IoT device is connected to the network through a specific connection path (which may be called a logical path) corresponding to the combination.

A system outline and an operation outline in this embodiment will be described with reference to FIG. As shown in FIG. 1, the routing control system according to this embodiment includes a routing control section 21, a first authentication section 22, and a second authentication section 23. FIG.

For example, the first authentication unit 22 performs SIM authentication based on information on the SIM 11 installed in the IoT device 10 . The second authentication unit 23 performs device authentication based on the device number of the IoT device 10 .

As shown in FIG. 1, if both SIM authentication and device authentication are OK for the IoT device 10 with the SIM 11 installed, the route control unit 21 connects the IoT device 10 to the NW1. Execute control.

The NW1 is, for example, a network connected to a server to which information collected by the IoT device 10 is uploaded, a network connected to a server that transmits control information to the IoT device 10, or the like. Also, in a system that employs network slicing technology, the NW1 may be a network slice with characteristics (eg, low latency) suitable for the IoT device 10. FIG.

If any one of SIM authentication and device authentication for the IoT device 10 is OK, the route control unit 21 performs route control for connecting the IoT device 10 to the NW2. NW2 is, for example, a network (which may be called a quarantine network) that connects to a server for performing authentication, whichever of SIM authentication and device authentication has not been confirmed as OK. The connection may be forcibly cut off when either one of SIM authentication and device authentication for the IoT device 10 is OK (that is, when both are not OK).

With this technology, it is possible not only to prevent "spoofing" due to switching IoT devices, which was not possible with conventional SIM alone, but also to prevent "information leakage due to transfer to another server".

(System configuration example)
FIG. 2 shows a system configuration example in this embodiment. The example shown in FIG. 2 is an example in which the technology according to the present invention is applied to a local 5G system. This is just an example, and the technology according to the present invention is applicable not only to local systems but also to global systems. Also, the technology according to the present invention is applicable without being limited to 5G networks. For example, it is applicable to 3G, 4G (LTE), and 6G.

In the system shown in FIG. 2, a local 5G system is configured within the factory. A local 5G system comprises a local 5G base station and a 5GC (5G core network). The 5GC includes the route control device 100 and UPF1-3.

The route control device 100 is a device for establishing and controlling data connection routes (also called paths, sessions, etc.) of IoT 10 devices. The route control device 100 also includes an authentication function. Note that the authentication function may be provided outside the route control device 100 . In 5G, the route control device 100 is composed of AMF, SMF, UDM, etc., for example. A UPF is a device that performs data transfer and the like. A UPF may be called a forwarder.

The route control device 100 may be composed of one device (computer) or may be composed of a plurality of devices.

Also, as an example of the IoT device 10, an AGV (automated guided vehicle) 10A and a camera 10B are shown. The AGV 10A and the camera 10B are each equipped with a SIM.

Further, a device management device 200, an AGV control server 300, an image storage server 400, and a control device 500 are provided. Note that the device management apparatus 200 may be called a DMS (Device Management System).

In the example of FIG. 2, the AGV control server 300 is in the factory and the video storage server 400 is in the cloud, but this arrangement is just an example. For example, both the AGV control server 300 and the video storage server 400 may be in the factory, or both the AGV control server 300 and the video storage server 400 may be on the cloud.

The device management apparatus 200 has a function of managing the device number (for example, IMEI) of each IoT device 10 and the IMSI of the SIM, and checking the authenticity of the IoT device 10 . Each IoT device 10 is loaded with an application capable of exchanging device numbers with the device management apparatus 200 .

In the present embodiment, when the SIM authentication of the IoT device 10 is OK, the IoT device 10 is connected to the device management apparatus 200, and the device management apparatus 200 performs authentication using the device number of the IoT device 10 (device authentication). )I do.

When the device authentication is OK, the IoT device 10 is connected to the target server. In the example of FIG. 2, the AGV 10A connects to the AGV control server 300, and the camera 10B connects to the video storage server 400. FIG. The AGV control server 300 transmits control instructions to the AGV 10A, for example, based on sensor information received from the AGV 10A. The video storage server 400 stores video data received from the camera 10A. The control device 500, for example, makes settings for each device.

(Example of system operation)
An operation example of the system according to the present embodiment will be described with reference to FIG. The system shown in FIG. 3 may be a 5G system as shown in FIG. 2, a system other than 5G (eg, 3G, 4G, 6G), or a system other than these may be A wireless base station exists between the route control device 100 and the IoT device 10, and the IoT device 10 communicates with the route control device 100 via the wireless base station.

In S<b>101 , the IoT device 10 transmits a connection request signal including a SIM unique ID (eg, IMSI) to the route control device 100 . The route control device 100 holds user information (including the SIM unique ID) of each user (IoT device). Authentication (SIM authentication) of the IoT device 10 is performed by matching with the unique ID (S102).

If the SIM authentication in S102 fails, the route control device 100 cuts off the connection by sending a connection rejection signal to the IoT device 10 . In the example of FIG. 3, it is assumed that the SIM authentication in S102 has succeeded.

The route control device 103 authorizes the connection of the IoT device 10 to the quarantine network, sets up the route, and returns a connection response signal indicating the authorization of the quarantine network connection to the IoT device 10 in S103. The connection response signal includes, for example, a connection destination identifier (eg, an address indicating the device management apparatus 200, etc.), connection destination network information (eg, tunnel identifier, slice identifier), and the like.

In the example of FIG. 3, the transfer device 1 is a device for transferring data to the device management device 200 (eg, UPF connected to the device management device 200). In S<b>104 and S<b>105 , the IoT device 10 temporarily connects to the quarantine network (transfer device 1 ) according to the route setting, and transmits the unique ID (device number) of the IoT device 10 to the device management apparatus 200 .

In S<b>106 , the device management apparatus 200 performs device authentication for the IoT device 10 . For example, the device management apparatus 200 holds the device number of each IoT device, and by comparing the device number of the corresponding IoT device 10 with the device number received from the IoT device 10 in S104 and S105, the IoT device 10 authentication (device authentication) can be performed.

Further, in S104 and S105, the device number and the unique ID of the SIM may be transmitted from the IoT device 10 to the device management apparatus 200. FIG. The device management apparatus 200 holds the device number and SIM unique ID of each IoT device, and the device number and SIM unique ID of the corresponding IoT device 10, and the device number and SIM received from the IoT device 10 in S104 and S105. Authentication of the IoT device 10 (device authentication) may be performed by collating it with the unique ID of the SIM.

If the device authentication in S106 fails, the device management apparatus 200 cuts off the connection by, for example, transmitting a connection rejection signal to the IoT device 10 . In the example of FIG. 3, it is assumed that the device authentication in S106 has succeeded. As a result, both the SIM and the IoT device 10 can be determined to be legitimate, and the authenticity of the IoT device 10 is confirmed.

In S<b>107 , the device management apparatus 200 transmits to the route control apparatus 100 a route update instruction including route control information for setting a correct route for communication of the IoT device 10 and a temporary connection release instruction. A specific example of S107 is as follows.

The device management apparatus 200 holds, for example, device type, application type, or service type information for each IoT device. Here, the device type, the application type, and the service type are collectively referred to as "service type".

In S<b>107 , for example, the device management apparatus 200 transmits to the route control apparatus 100 a route update instruction including, as route control information, the service type of the IoT device 10 that has successfully passed “SIM authentication+device authentication”.

In addition, in S107, the device management apparatus 200 routes the identifier of the slice to which the IoT device 10 that has successfully passed the "SIM authentication + machine authentication" or the identifier of the tunnel (which may be called a logical path) to be connected is routed. A route update instruction included as information may be transmitted to the route control device 100 .

Upon receiving the route update instruction and the temporary connection release instruction, the route control device 100 releases the temporary connection route and notifies the IoT device 10 of the temporary connection solution in S108.

Also, the route control device 100 sets an appropriate route corresponding to the service type of the IoT device 10 based on the route control information included in the route update instruction. The route setting here is, for example, connecting a tunnel (logical path) or slice corresponding to the service type of the IoT device 10 to the IoT device 10 (or a wireless base station to which the IoT device 10 is connected) and the communication destination. It is to set between a transfer device (eg UPF) connected to a server.

Regarding slices, for example, if the service type is related to a service that requires low delay (e.g. autonomous driving control), set a low-delay slice, and if the service type is a service that requires large-capacity transmission (e.g. video distribution) ), set a large slice.

The IoT device 10 whose temporary connection has been released requests connection by transmitting a connection request signal again in S109. In S110, the route control device 100 authenticates with the SIM unique ID (IMSI). Assume here that the authentication succeeds.

In S<b>111 , the route control device 100 transmits to the IoT device 10 a connection response signal including information authorizing connection to the updated route. The information may be, for example, an identifier of a tunnel (logical path) to be connected and an identifier of a slice to be connected.

At S112, the IoT device 10 starts data communication. In the example of FIG. 3, it is assumed that the transfer device 3 is connected to the destination server. For example, a packet transmitted from the IoT device 10 is transferred to the transfer device 3 connected to the destination server according to the route (tunnel, slice, etc.) set by the route control device 100, and transferred from the transfer device 3 to the destination server. transferred to Packets in the reverse direction can also be transferred to the IoT device 10 through the same route.

In the above example, device authentication is performed when SIM authentication is successful, but the process may be reversed. For example, the following processing may be performed.

First, when the IoT device 10 performs device authentication by transmitting the device number to the device management apparatus 200 connected to a network such as Wi-Fi (registered trademark) that does not use SIM, and the authentication succeeds, It notifies the route control device 100 that the device authentication has succeeded.

The routing control device 100 that has received the notification of the success of the device authentication performs routing control to connect the IoT device 100 to a network device that performs SIM authentication (for example, the routing control device 100). is connected to the device, and if the device succeeds in SIM authentication, the route control device 100 executes route control so as to connect the IoT device 10 to the target network.

(Device configuration example)
FIG. 4 shows a configuration example of the route control device 100 in this embodiment. As shown in FIG. 4, the route control device 100 includes an authentication unit 110, a route control unit 120, and a data storage unit . The data storage unit 130 stores user information including the unique ID of the SIM of each user (each IoT device).

The authentication unit 110 performs SIM authentication using the SIM unique ID received from the IoT device 10 and the SIM unique ID stored in the data storage unit 130 .

The route control unit 120 performs route setting and the like based on the result of authentication by the authentication unit 110 or route control information received from the device management apparatus 200 .

FIG. 5 shows a configuration example of the device management apparatus 200 according to this embodiment. As shown in FIG. 5, the device management apparatus 200 includes an authentication section 210, a route control instruction section 220, and a data storage section 230. FIG. The data storage unit 130 stores user information including the unique ID (device number) of each IoT device.

The authentication unit 210 performs device authentication using the unique ID of the device received from the IoT device 10 and the unique ID of the device stored in the data storage unit 130 .

The route control instruction unit 220 transmits a route control instruction (route update instruction, etc.) to the route control device 100 when the authentication unit 210 succeeds in device authentication.

FIG. 6 shows a configuration example of the IoT device 10 in this embodiment. As shown in FIG. 6, the IoT device 10 has a SIM 11, a communication section 12, and a data storage section 13. FIG. The communication unit 12 connects to a network such as a mobile network or Wi-Fi (registered trademark) and communicates with a server or the like. The data storage unit 13 stores a unique ID (device number, IMEI, etc.). For example, the communication unit 12 reads out the unique ID from the data storage unit 13 and transmits it to the device management apparatus 200 when receiving permission to connect to the quarantine network from the routing control apparatus 100 .

(Hardware configuration example of the device)
Each of the IoT device 10, the route control device 100, and the device management device 200 can be implemented, for example, by causing one or more computers to execute programs. Computers used for the path control device 100 and the device management device 200 may be physical machines or virtual machines on the cloud. Hereinafter, the IoT device 10, the route control device 100, and the device management device 200 will be collectively referred to as "apparatus".

FIG. 7 is a diagram showing a hardware configuration example of the computer in this embodiment. Note that when the computer is a virtual machine, the hardware configuration is a virtual hardware configuration. The computer of FIG. 7 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are connected to each other via a bus B, respectively.

A program for realizing processing by the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card, for example. When the recording medium 1001 storing the program is set in the drive device 1000 , the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000 . However, the program does not necessarily need to be installed from the recording medium 1001, and may be downloaded from another computer via the network. The auxiliary storage device 1002 stores installed programs, as well as necessary files and data.

The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when a program activation instruction is received. The CPU 1004 implements functions related to the device according to programs stored in the memory device 1003 . The interface device 1005 is used as an interface for connecting to the network. A display device 1006 displays a program-based GUI (Graphical User Interface) or the like. An input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the calculation result.

(Effect of Embodiment)
According to the technology according to the present embodiment described above, the IoT device can access the authorized network path only when the combination of the authorized SIM and the authorized IoT device is used. Conversely, if the device is maliciously replaced with an unauthorized SIM or an unauthorized IoT device, it will not be connected to the authorized network path, making it possible to prevent malicious attacks and information leakage to other servers.

In addition, since it is possible to manage and control the countermeasures against attacks and information leakage as described above on the system side, it is possible to manage a huge number of IoT devices without burdening NW administrators who manage IoT devices. It is possible to securely manage and operate communication channels.

(Appendix)
This specification discloses at least a routing control system, a routing control device, a device management device, a routing control method, and a program as described below.
(Section 1)
a first authentication unit that performs first authentication on a device to be route-controlled;
a second authentication unit that performs a second authentication on the device;
If the first authentication is successful, the device is connected to the second authentication unit through a first route, and if the second authentication by the second authentication unit is successful, the device is connected through a second route. A route control system comprising: a route control unit for connecting to a server of;
(Section 2)
The first authentication unit performs the first authentication using a unique ID of the SIM installed in the device, and the second authentication unit performs the second authentication using a unique ID of the device body. The route control system according to item 1.
(Section 3)
an authentication unit that performs SIM authentication using the unique ID of the SIM installed in the device;
When the SIM authentication is successful, the device is connected to a device management apparatus through a first route, and when machine authentication of the device by the device management apparatus is successful, the device is connected to a target server through a second route. A route control device comprising: a route control unit to be connected;
(Section 4)
When the SIM authentication is successful by a route control device that performs SIM authentication using the unique ID of the SIM installed in the device, the unique ID of the device body transmitted from the device is received, and the unique ID is transmitted. an authentication unit that performs device authentication using
A device management apparatus comprising: a route control instruction section that instructs the route control apparatus to perform route control for connecting the device to a target server when the device authentication is successful by the authentication section.
(Section 5)
A routing method executed in a routing system,
a first authentication step in which a first authentication unit performs first authentication on a device to be route-controlled;
When the first authentication succeeds, the device is connected to a second authentication unit through a first route, and when the second authentication of the device by the second authentication unit succeeds, the device is connected through a second route. A routing control method comprising: a routing control step of connecting to a target server.
(Section 6)
A program for causing a computer to function as each unit in the route control device according to item 3.
(Section 7)
A program for causing a computer to function as each unit in the device management apparatus according to item 4.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

10 IoT devices 11 SIMs
12 communication unit 13 data storage unit 21 route control unit 22 first authentication unit 23 second authentication unit 100 route control device 110 authentication unit 120 route control unit 130 data storage unit 200 device management device 210 authentication unit 220 route control instruction unit 230 data Storage Unit 300 AGV Control Server 400 Video Storage Server 1000 Drive Device 1001 Recording Medium 1002 Auxiliary Storage Device 1003 Memory Device 1004 CPU
1005 interface device 1006 display device 1007 input device 1008 output device

Claims (7)

a first authentication unit that performs first authentication on a device to be route-controlled;
a second authentication unit that performs a second authentication on the device;
If the first authentication is successful, the device is connected to the second authentication unit through a first route, and if the second authentication by the second authentication unit is successful, the device is connected through a second route. A route control system comprising: a route control unit for connecting to a server of; The first authentication unit performs the first authentication using a unique ID of the SIM installed in the device, and the second authentication unit performs the second authentication using a unique ID of the device body. The route control system according to claim 1. an authentication unit that performs SIM authentication using the unique ID of the SIM installed in the device;
When the SIM authentication is successful, the device is connected to a device management apparatus through a first route, and when machine authentication of the device by the device management apparatus is successful, the device is connected to a target server through a second route. A route control device comprising: a route control unit to be connected; When the SIM authentication is successful by a route control device that performs SIM authentication using the unique ID of the SIM installed in the device, the unique ID of the device body transmitted from the device is received, and the unique ID is transmitted. an authentication unit that performs device authentication using
A device management apparatus comprising: a route control instruction unit that instructs the route control unit to perform route control for connecting the device to a target server when the device authentication is successful by the authentication unit. A routing method executed in a routing system,
a first authentication step in which a first authentication unit performs first authentication on a device to be route-controlled;
When the first authentication succeeds, the device is connected to a second authentication unit through a first route, and when the second authentication of the device by the second authentication unit succeeds, the device is connected through a second route. A routing control method comprising: a routing control step of connecting to a target server. A program for causing a computer to function as each unit in the route control device according to claim 3. A program for causing a computer to function as each unit in the device management apparatus according to claim 4.

Images