JP5600982B2 - Server device, device association method, device association program, and installer - Google Patents

Description

  The present invention relates to a server device associated with a client device, a device association method, a device association program, and an installer generated by the server device.

  In recent years, in a client device, a technique for operating a server device and data stored in the server device has become widespread. However, in order to operate the server device or the like in the client device, it is necessary to associate the server device with the client software on the client device side at the first use. By performing this association process, authentication between the client software and the server device is established, and authentication at the time of subsequent connection can be omitted, and smooth connection and operation can be realized.

  Hereinafter, an example of the association process will be described.

  First, as shown in FIG. 11B, the user operates the server device to start the server software in the initial setting mode. At this time, the server device maintains the standby state until the client device is detected. When the server device detects the client device, the server device newly sets an authentication password. Thereafter, when a password newly set by the server device is input on the client device side and authentication is established, information for connecting to the server device is transferred from the server device to the client device. The client device can connect to the server device based on the information transferred from the server device.

  However, the association process has a problem that the operation is complicated because the user needs to operate both the server device and the client device. Further, due to security problems, the above association processing cannot be performed when the server device and the client device are not on the same local network, and there is a problem that operability is poor.

  In relation to the above problem, in order to improve security, an access authentication server that manages key information of the server device is provided, and a public key is acquired from the access authentication server to associate the client device with the server device. A technique has been proposed (for example, Patent Document 1).

  More specifically, in Patent Document 1, when an authentication request is transmitted from the client device to the access authentication server, the access authentication server verifies the authentication information and transmits the verification result to the client device. Thereby, a connection is established between the client device and the access authentication server. Thereafter, the client device makes a public key acquisition request of the server device to the access authentication server, stores the acquired public key, and then configures a plurality of server devices connected to the network via the access authentication server Request information acquisition. Then, the server device that manages the configuration information requested by the client device generates authentication information by encrypting the configuration information with a unique secret key, and transmits the authentication information to the client device together with the configuration information. The client device that has received the configuration information or the like determines its validity using the public key, and performs setting processing only when it is valid.

  Further, as another technique related to the above problem, a technique of a direct access management server that registers a control apparatus and a controlled apparatus has been proposed (for example, Patent Document 2). In the above-mentioned Patent Document 2, when the direct access management server receives a management ID acquisition request transmitted from the service server in response to a request from the control device, the direct access management server generates a new management ID for the combination of the control device and the service. Then, the management ID is transmitted to the service server. Then, the service server transmits the received management ID to the control device. Next, when a registration password request is received from the service server, the direct access management server generates a password for registering the controlled device, and transmits the password to the control device via the service server. Thereafter, when the password is received from the controlled device, the direct access management server authenticates the controlled device, and executes the setting process when the authentication is established.

JP 2004-193832 A JP 2007-316678 A

  However, in the technologies described in Patent Document 1 and Patent Document 2, the association processing requires a third device such as an access authentication server and a direct access management server in addition to the server device and the client device. It was a heavy burden on the surface. In the technologies described in Patent Document 1 and Patent Document 2, when performing the association process, it is necessary to transmit and receive information not only between the server device and the client device but also through the authentication server. There was also a problem that processing was complicated.

  The present invention has been made in view of such circumstances, and can solve the above-described problems and can easily perform association processing with a client device while maintaining security, a device association method, and a device. An object is to provide an association program and an installer.

  The server device of the present invention generates an installer that includes at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device. An installer generating means is provided.

  The device association method of the present invention generates an installer containing at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device. An installer generating step is provided.

  The device association program of the present invention generates an installer containing at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device. It is characterized by causing a computer to execute the processing to be performed.

  The installer of the present invention includes at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device. .

  According to the present invention, it is possible to eliminate the troublesomeness in association processing and easily perform association processing between a server device and a client device.

It is a figure which shows the example of the system containing the server apparatus which concerns on this embodiment. It is a block diagram which shows the example of schematic structure of the server apparatus which concerns on this embodiment. It is a figure which shows the example of schematic structure of the encryption key management part of the server apparatus which concerns on this embodiment. It is a flowchart which shows the flow of the example of an installer production | generation process of the server apparatus which concerns on this embodiment. It is a figure which shows the authentication information generation process example of the server apparatus which concerns on this embodiment. It is a figure which shows the installer production | generation process example of the server apparatus which concerns on this embodiment. It is a time chart which shows the flow of an association process with a server apparatus and a client apparatus. It is a flowchart which shows the example of the flow in case a client apparatus performs an installation process. It is a figure which shows the example of a decoding process of the access information and authentication information in a client apparatus. It is a figure which shows the example of an authentication information confirmation process of the server apparatus which concerns on this embodiment. It is a figure which shows the outline | summary of the example of an association process with a server apparatus and a client apparatus relevant to this embodiment and this invention.

  Hereinafter, examples of embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a schematic configuration example of a system including a server device according to the present embodiment. As shown in FIG. 1, in the present embodiment, each of a server device 1, a client device 2, and a DDNS 3 is connected to a public Internet line 4. In the present embodiment, it is assumed that the server device 1 and the client device 2 are physically separated from each other, but the present invention is not limited to this.

  The DDNS 3 is a name resolution server, and registers the IP address of the server device 1. Therefore, in the present embodiment, the client device 2 can access the server device 1 with the domain name. Information necessary for the client device 2 to access the server device 1 and use the server software includes access information such as the domain name (URL information) of the server device 1 for accessing the server device 1 and server software. And authentication information for using. In FIG. 1, the example provided with the DDNS 3 as the name resolution server has been described. However, the present invention is not limited to this. For example, if an IP address is used instead of a domain name for access information to be described later, the DDNS 3 becomes unnecessary.

(Configuration of server device)
A configuration example of the server device 1 according to the present embodiment will be described.

  FIG. 2 shows a schematic configuration example of the server device 1 according to the present embodiment. FIG. 3 shows a schematic configuration example of the encryption key management unit 11 of the server device 1 according to the present embodiment. As shown in FIG. 2, the server device 1 according to the present embodiment includes an encryption key management unit 11, an authentication information generation unit 12, an installer generation unit 13, an encryption / decryption unit 14, a storage unit 15, an operation unit 16, and the like. ing. Note that the problem of the present invention can be solved if the installer generation unit 13 is provided, and other configurations are not necessarily provided.

  As shown in FIG. 3, the encryption key management unit 11 manages a plurality of encryption keys and their expiration dates. The number of encryption keys managed by the encryption key management unit 11 is not particularly limited, and may be at least one. Each of the plurality of encryption keys managed by the encryption key management unit 11 has its own expiration date. When the managed encryption key reaches the expiration date, the encryption key management unit 11 automatically generates a new encryption key. For example, when the encryption key A with the key number “1” expires and a new encryption key is generated, the key number of the newly generated encryption key is not changed, but the key configuration and the expiration date are Can be different. Note that it is possible to make the configuration or expiration date of a newly generated encryption key the same as the encryption key whose expiration date has expired, but it is preferable to make it different in order to improve security.

  The expiration date set for each encryption key is not particularly limited, and for example, a time such as 5 minutes to 24 hours can be appropriately set as the expiration date. The expiration date may be set in advance or may be received from the user via the operation unit 16 such as a keyboard. In addition, a new encryption key may be generated when the encryption key management unit 11 selects an encryption key used for generating an installer, which will be described later, regardless of the expiration date.

  The authentication information generation unit 12 has a random number generation unit 121. The random number generation unit 121 generates a random number, and in this embodiment, the random number becomes authentication information itself that is data necessary for authentication to use the server software. The installer generation unit 13 generates an installer containing access information such as the domain name (URL information) of the server device 1 and authentication information for using server software. The encryption / decryption unit 14 includes an encryption unit 141 and a decryption unit 142. The encryption unit 141 encrypts information using an encryption key and a password. The decryption unit 142 decrypts the encrypted information using an encryption key and a password.

  The storage unit 15 includes an authentication list 151 that stores the authentication information and the expiration date of the authentication information in association with each other. In the following, an example in which the authentication list 151 stores the random number information generated by the random number generation unit 121 in association with the expiration date will be described, but the present invention is not limited to this. Further, in the authentication list 151, the stored authentication information whose expiration date has passed or authentication information already used for authentication may be automatically deleted. The operation unit 16 receives input from the user. The operation unit 16 includes a display unit that displays information. Note that a touch panel method may be applied to the display unit, and input from the user may be received via the display unit.

(Installer generation process)
FIG. 4 shows a flow of an example of an installer generation operation of the server apparatus 1 according to the present embodiment. Hereinafter, an example of an installer generation operation performed by the server apparatus 1 will be described with reference to the flowchart shown in FIG.

  The server apparatus 1 accepts an instruction for generating an installer for the client program from the user (step S401). The installer generation instruction is input from the user via the operation unit 16 or the like provided in the server device 1. Upon receiving an installer generation instruction from the user, the authentication information generation unit 12 generates authentication information, which is information necessary for authentication for using the server software (step S402). In the process of step S402, for example, as illustrated in FIG. 5, the authentication information generation unit 12 causes the random number generation unit 121 to generate a random number X. Further, the authentication information generation unit 12 sets the expiration date of the authentication information with reference to the time when the authentication information is generated (step S403). Then, the storage unit 15 stores the authentication information generated in step S402 and the expiration date set in step S403 in association with each other in the authentication list 151 (step S404).

  The encryption key management unit 14 randomly selects an encryption key to be used for generating the installer (step S405). Here, for simplification of description, the description will be made assuming that the encryption key A is selected, but the present invention is not limited to this. The expiration date of the encryption key selected in step S405 is preferably synchronized with the expiration date of the authentication information set in step S403. Further, when selecting an encryption key, an encryption key set as the same expiration date as that of the authentication information may be selected, or an encryption key having the same expiration date as that of the authentication information may be selected. May be newly generated and used, and the encryption key selection method is not particularly limited.

  The encryption / decryption unit 14 encrypts the encryption key selected as described above and the random number that is the authentication information in the encryption unit 141 (step S406). FIG. 5 shows an example in which X ′ is obtained by encrypting the encryption key A and the random number X.

  Next, as shown in FIG. 6, the encryption / decryption unit 14 uses the used encryption key number (for example, key number 1 corresponding to the encryption key A), the encrypted authentication information obtained in step S406, and the like. (For example, the encrypted random number X ′) and the access information (for example, the domain name) for the client device 2 to access the server device 1 are encrypted with the installer password (step S407). Then, the installer generation unit 13 generates an installer of the client program including the encrypted access and authentication information based on the information encrypted in step S407 (step S408). In the process of step S407, the authentication information and the access information are combined and encrypted again, so that security during the transfer of the installer can be ensured. Further, the encryption process in step S406 and the encryption process in step S407 may be performed by the same encryption unit 141 or may be performed by different encryption units. That is, the encryption method in step S406 and step S407 may be the same encryption method or different encryption methods, and is not particularly limited. For example, the encryption / decryption unit 14 may include a plurality of encryption units, and each encryption process may be performed by different encryption units.

  The installer password is requested when the user instructs the server software to generate an installer for the client program in step S401. The installer password is required when the client program installer generated by the server device 1 is actually installed in the client device 2.

  In this embodiment, the example in which the access password and the authentication information are encrypted using the installer password in step S407 has been described. However, the present invention is not limited to this. For example, when a portable recording medium such as a USB (Universal Serial Bus) memory is used when the generated installer is input to the client apparatus 2, the unique value of the portable recording medium should be used instead of the installer password. Can do. In this case, since the user can save time and effort to directly input the installer password in step S401, the operation can be further simplified.

  Heretofore, access by the server device 1 and generation of an installer including authentication information have been described. That is, the processing of F1 to F4 in FIG. 7 has been described. In this way, the user can obtain an installer including access and authentication information from the server device 1. As described above, when the unique value of the portable recording medium is used instead of the installer password, the processes F2 to F3 and F6 to F7 in FIG. 7 can be omitted.

(Installation process)
FIG. 8 shows an example of a flow when the client apparatus 2 performs an installation process using the installer generated by the server apparatus 1 according to the present embodiment. Hereinafter, an example of the flow when the client apparatus 2 performs the installation process will be described with reference to the flowchart shown in FIG. That is, the process from F5 to F7 in FIG. 7 will be described.

  First, the client device 2 accepts an input of an installer generated by the server device 1 (step S801). A method for transferring the installer to the client device 2 is not particularly limited, and for example, a method using a portable recording medium such as a USB memory or an IC card, a mail method using the public Internet line 4, or the like can be applied. When the client apparatus 2 receives the installer, it is required to input an installation password. Therefore, the user inputs the installation password (F3 in FIG. 7) input when the client software 2 instructs the server software to generate an installer for the client program. Input is performed via the operation unit of the apparatus (step S802).

  Note that the expiration date of the authentication information and the encryption key may be changed according to the delivery method of the installer. For example, when the user instructs the server apparatus 1 to generate an installer, the setting input of the installer delivery method may be received from the user, and the expiration date of the authentication information and the encryption key may be set based on the delivery method. . Specifically, for example, when the installer is delivered via a USB memory, the duplication of the installer is relatively difficult, so that the expiration date of the authentication information and the encryption key can be set long. On the other hand, when delivering the installer via the Internet line 4, there is a risk of hacking or the like during the delivery, so it is preferable to set the expiration date of the authentication information and the encryption key short.

  Upon receiving the installation password input, the decryption unit of the client device 2 decrypts the encrypted access and authentication information using the installation password as shown in FIG. 9 (step S803).

  As described above, when the unique value of the portable recording medium is used instead of the installer password in step S407, it is not always necessary to input the installation password in step S802. That is, in the process of step S803, the client device 2 decrypts the access and authentication information encrypted using the unique value of the portable recording medium. In this case, the user can save the trouble of inputting the installation password on the client device side, and can further simplify the operation.

  Next, the client software accesses the server device 1 using the domain name that is the access information (step S804), and corresponds to the authentication information (for example, the encrypted random number X ′) and the used key number (for example, the encryption key A). The key number 1) is transmitted to the server device 1 (step S805).

  Upon receiving the authentication information (for example, encrypted random number X ′) and the usage key number information transmitted from the client device 2 in step S805, the server device 1 receives the usage key number information in the decryption unit 142 as shown in FIG. The authentication information is decrypted based on Then, the server device 1 checks whether or not the decrypted authentication information (for example, the random number X) is within the expiration date and whether or not it is stored in the authentication list 151 (step S806). Thereby, the server apparatus 1 determines whether or not the client apparatus 2 that has transmitted the authentication information and the used key number information can be trusted. Here, when the server apparatus 1 determines that the client apparatus 2 that has transmitted the authentication information and the used key number information can be trusted (step S806 / YES), the connection process is continued (step S807). In this manner, the server device 1 and the client device 2 can be associated with each other.

  On the other hand, if the authentication information transmitted from the client device is not stored in the authentication list 151 (step S806), the connection process is stopped and the operation is terminated. Note that the server apparatus 1 can save the IP address information of the client apparatus that has failed in the black list and reject it even if there is a connection again, thereby improving security.

  As described above, according to this embodiment, it is possible to easily perform association processing between a client device and a server device while maintaining security. In addition, it is possible to perform an associating operation with a server device even on a physically remote client device.

  In other words, in the present embodiment, as shown in FIG. 11B, the initial setting is not performed after the software on the server device side and the software on the client device side have been set up in advance, as shown in FIG. As described above, the software on the server device side generates an installer file of client software in which information necessary for the initial setting is embedded in advance. The user installs client software on the client device using an installer file in which connection information to the server device is embedded. Since the installed client software already has information for connection to the server device embedded therein, it is possible to connect the client device to the server device without the need for troublesome initial settings.

  Note that a program for the CPU to execute the processing shown in the flowcharts of the respective drawings constitutes a program according to the present invention. As a computer-readable recording medium for recording the program, a semiconductor storage unit, an optical and / or magnetic storage unit, or the like can be used. By using such a program and recording medium in a system having a different configuration from the above-described embodiments and causing the CPU of the system to execute the program, substantially the same effect as the present invention can be obtained. .

  Although specifically described based on the preferred embodiments, the present invention is not limited to the server device, the device association method, the device association program, and the installer described above, and various modifications can be made without departing from the scope of the invention. It goes without saying that.

  Note that the present invention is not applied only to association processing for connecting a client device to a server device. The present invention can also be applied, for example, when distributing an installation program for installing an application for using a service provided from a server device that provides a content distribution service to a client device. is there. In this case, the server device that provides the service and the server device that generates the installation program are not necessarily the same.

1 Server device 2 Client device 3 DDNS
4 Internet Line 11 Encryption Key Management Unit 12 Authentication Information Generation Unit 13 Installer Generation Unit 14 Encryption / Decryption Unit 15 Storage Unit 16 Operation Unit 121 Random Number Generation Unit 141 Encryption Unit 142 Decryption Unit 151 Authentication List

Claims (13)

An installer generating means for generating an installer containing at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device;
Encryption key management means for managing at least one encryption key and an expiration date of the encryption key;
Encryption / decryption means for encrypting and decrypting information, and
The encryption key management means selects an encryption key to be used for encryption from at least one managed encryption key,
The encryption / decryption means encrypts the authentication information based on the encryption key selected by the encryption key management means,
Furthermore, the encryption / decryption means encrypts the authentication information based on a unique value of a portable recording medium used when the generated installer is input to the device. Comprising an operating means for receiving an instruction to generate the installer from the user;
The server device according to claim 1, wherein the installer generation unit generates an installer based on an instruction to generate the installer. Authentication information generating means for generating the authentication information;
Storage means for storing the authentication information,
The authentication information has an expiration date,
The server device according to claim 1, wherein the storage unit stores the authentication information and an expiration date of the authentication information in association with each other. The authentication information generating means includes random number generating means,
The server apparatus according to claim 3, wherein the authentication information is a random number generated by the random number generation unit.   5. The server apparatus according to claim 1, wherein the encryption key management unit newly generates and manages an encryption key and an expiration date of the encryption key every predetermined time.   The server apparatus according to claim 1, wherein the encryption key management unit synchronizes an expiration date of the encryption key with an expiration date of the authentication information. A server device is a device association method for associating the server device with a device,
An installer generating step of generating an installer containing at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device When,
An encryption key management step of managing at least one encryption key and an expiration date of the encryption key, and selecting an encryption key to be used for encryption from the managed at least one encryption key;
A first encryption step for encrypting the authentication information based on the encryption key selected in the encryption key management step;
And a second encryption step for encrypting the authentication information based on a unique value of a portable recording medium used when the generated installer is input to the device. An input receiving step of receiving an installer generation instruction input from the user;
8. The apparatus association method according to claim 7, wherein the installer generation step generates an installer based on an installer generation instruction received in the input reception step. An authentication information generation step for generating authentication information having an expiration date;
The device association method according to claim 7, further comprising a storage step of storing the authentication information and the expiration date of the authentication information in association with each other.   10. The device association method according to claim 9, wherein the authentication information generation step generates a random number as the authentication information.   The device association method according to any one of claims 7 to 10, wherein the encryption key management step newly generates and manages an encryption key and an expiration date of the encryption key every predetermined time.   The device association method according to claim 7, wherein the encryption key management step synchronizes an expiration date of the encryption key with an expiration date of the authentication information. Processing to generate an installer containing at least access information for accessing the server device and authentication information for the server device to perform authentication in order to associate the server device with the device;
A process for managing at least one encryption key and an expiration date of the encryption key;
A process of selecting an encryption key to be used for encryption from the at least one managed encryption key;
A process of encrypting the authentication information based on the selected encryption key;
A device association program for causing a computer to execute processing for encrypting the authentication information based on a unique value of a portable recording medium used when causing the device to input the generated installer .

Images