JP6700371B1 - Management device, communication system, program and control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable transmission/reception of a large amount of data while ensuring high security capable of preventing an attack such as spoofing of a user in data communication between a device and a user device via a mobile communication network. A non-IP communication method for performing data communication without using IP in the mobile communication network (such as a communication method based on NIDD) is used for the device corresponding to device identification information transmitted from the user device. A first transmitting unit for transmitting to the device, communication permission information for permitting communication of the user device, and decryption information for decrypting the communication permission information encrypted by the encryption information. A second transmission unit that transmits the encryption information and the communication permission information, or the communication permission information encrypted by the encryption information to the user device. [Selection diagram] Figure 1

Description

  The present invention relates to a management device, a mobile communication system, a program, and a control method for realizing secure large-capacity data communication between a device and a user device via a network.

  Conventionally, there is known a communication standard called LTE-Advanced Pro, which is an extension of LTE (Long Term Evolution)-Advanced (see Non-Patent Document 1) of 3GPP, which is a communication standard for mobile communication systems (see Non-Patent Document 2). .. In this LTE-Advanced Pro, specifications for providing communication of recent IoT (Internet of Things) devices have been established. Here, "IoT" is a general term for a form in which various things are connected to the Internet or a cloud computer system, and control/information communication is performed.

  In LTE-Advanced Pro, in order to support communication via a mobile communication network of a large number of IoT devices installed, two new communication standards, category M1 (also referred to as “eMTC (enhanced Machine-Type Communications)”). And category NB1 (also referred to as “NB-IoT (NarrowBand-IoT)”) are supported.

3GPP TS 36.300 V10.12.0 (2014-12). 3GPP TS 36.300 V13.5.0 (2016-09).

  In data communication between a device such as an IoT device and a user device via a mobile communication network, there is a problem that it is desired to transmit and receive a large amount of data while ensuring high security capable of preventing an attack due to a user's spoofing.

A management apparatus according to an aspect of the present invention is a management apparatus that manages communication between a device and a user apparatus via a mobile communication network, and uses data (IP) in the mobile communication network without using an IP (Internet Protocol). Encrypted by the non-IP communication method for performing communication, the communication permission information for permitting the communication of the user device to the device corresponding to the device identification information transmitted from the user device, and the encryption information. A first transmitting unit for transmitting the decryption information for decrypting the communication permission information to the device, and the encryption information and the communication permission information, or the encryption information encrypted by the encryption information A second transmission unit that transmits the communication permission information to the user device.
In the management device, the non-IP communication method may be a communication method based on NIDD (Non-IP Data Deliver).
Further, in the management device, the communication permission information may include a device connection client certificate of the user device.
Further, in the management device, the encryption information and the decryption information may be the same information.
Further, in the management device, at least one of the encryption information and the decryption information may be information with use time restriction.
Further, in the management device, the second transmission unit, the encrypted information and the communication permission information, or the communication permission information encrypted by the encryption information, by the encrypted communication, the user It may be transmitted to the device.
Moreover, in the said management apparatus, the said management apparatus may be SCS(Service Capability Server).
Further, the management device includes an authentication processing unit that executes an authentication process using the authentication information transmitted from the user device, and the first transmission unit is configured to perform the encryption when the authentication processing unit authenticates. The conversion information and the communication permission information may be transmitted to the device via the first network.
Further, in the management device, the authentication information includes a user authentication client certificate of the user device, and the authentication processing sends an authentication request to a predetermined certificate authority regarding the user authentication client certificate of the user device. However, a process of receiving the authentication result of the predetermined certificate authority may be included.
Further, in the management device, the authentication information includes the device identification information transmitted from the user device and user identification information of the user device transmitted from the user device, and the authentication process is performed by the device. It may include a process of collating the user information of the device corresponding to the identification information with the user identification information.

  A communication system according to another aspect of the present invention is a communication system including the management device described above, and a charging processing device that performs a charging process for a communication service usage charge in the device and the user device. In the authentication processing, the collation is performed using information registered in the billing processing device for at least one of user information of the device and user identification information of the user device.

  A communication system according to still another aspect of the present invention provides a device connectable to a base station of a mobile communication network, a user apparatus capable of communicating with the device, and communication between the device and the user apparatus. A management system for managing, wherein the management device is the management device according to any one of claims 1 to 10, and when the user device communicates with the device, The device has a transmission unit for transmitting the communication permission information encrypted by the encryption information to the device, and the device decrypts the encrypted communication permission information transmitted from the user device. And a communication permission/prohibition determination unit that determines whether or not to permit communication with the user device by using the decrypted communication permission information.

  Further, a program according to still another aspect of the present invention is a program for causing a computer of a management device that manages communication between a device and a user device via a mobile communication network to function. Communication permission information for permitting communication of the user device to the device corresponding to device identification information transmitted from the user device by a non-IP communication method for performing data communication without using (Internet Protocol), and A first transmitting step of transmitting decryption information for decrypting the communication permission information encrypted by the encryption information to the device, the encryption information and the communication permission information, or A second transmission step of transmitting the communication permission information encrypted by the encryption information to the user device, and causing the computer to execute the second transmission step.

  Further, a control method according to still another aspect of the present invention is a control method of a management device that manages communication between a device and a user device via a mobile communication network, wherein an IP (Internet) is used in the mobile communication network. Communication permission information for permitting communication of the user apparatus to the device corresponding to the device identification information transmitted from the user apparatus by a non-IP communication method for performing data communication without using Protocol, and encryption. A first transmitting step of transmitting, to the device, decryption information for decrypting the communication permission information encrypted by the encryption information, the encryption information and the communication permission information, or the encryption A second transmitting step of transmitting the communication permission information encrypted by the usage information to the user device.

  According to the present invention, it is possible to transmit and receive a large amount of data while ensuring high security capable of preventing an attack such as a user's spoofing in data communication between a device and a user device via a mobile communication network.

FIG. 3 is an explanatory diagram showing an example of a schematic configuration of a communication system according to an embodiment. The sequence diagram which shows the flow of the processing operation of SCS which comprises the same communication system. The sequence diagram which shows the flow of the communication operation of the user apparatus and IoT device in the communication system.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is an explanatory diagram showing an example of a schematic configuration of a communication system according to the present embodiment.
The communication system of the present embodiment includes one or more IoT devices 10, one or more base stations 20 that wirelessly communicate with the IoT devices 10, an SGW (Serving Gateway) and a PGW (PDN (Packet Data Network) Gateway). ), an MME (Mobility Management Entity) 40, an HSS (Home Subscriber Server) 50, a SCEF (Service Capability Function) server 60, an application 80, an accounting server 70, and an accounting server 70. And a SCS (Service Capability Server) 100 as a management device, a user device 200, and a wireless AP (Access Point) 300.

  The facilities in the mobile communication network 1 such as the SCS 100 and the billing server 70 may be managed and operated by the mobile communication carrier of the mobile communication network 1, for example.

  The IoT device 10 of the present embodiment is provided with a sensor device used in various industries such as medical care, agriculture, electric power, water and sewerage, automobiles, and transportation, but it is an IoT device having any application and function. It may be. The IoT device 10 of the present embodiment incorporates a mobile communication unit 10a for mobile communication, which is also called a mobile station, and the mobile communication unit 10a is configured as, for example, a communication module. The IoT device 10 can perform wireless communication with the base station 20 by a predetermined wireless communication method by the mobile communication unit 10a and can be connected to the mobile communication network 1 side, and communication by the NIDD via the mobile communication network 1 can be performed. The communication using the IP (Internet Protocol) can be performed via the mobile communication network 1.

  In addition, the IoT device 10 of the present embodiment incorporates a wireless LAN communication unit 10b capable of wirelessly communicating with the wireless AP 300, and the wireless LAN communication unit 10b performs wireless communication with the wireless AP 300 by a predetermined wireless communication method. As a result, it is possible to communicate with the user device 200 via the wireless LAN using the communication method using IP.

  In the present embodiment, the IoT device 10 uses the mobile communication unit 10a to periodically send various types of data obtained by measuring and acquiring information on the surrounding environment and the installed device by the sensor device. Then, it is transmitted to the AS 90 and the like through the mobile communication network 1 (hereinafter, also referred to as “regular notification”). The time interval of the periodical notification from the IoT device 10 may not be constant. For example, the periodical notification from the IoT device 10 may be at a predetermined time interval (for example, every 10 minutes, every 30 minutes, every one day, or every three days), or the IoT device 10 is to be transmitted. The timing may be a timing when a predetermined number (for example, 100) of the data are collected. Further, the periodical notification from the IoT device 10 may be at the timing of 0 minute 00 second and 30 minute 00 second every hour.

  Although only one IoT device 10 is shown in FIG. 1 for convenience of illustration, the number of IoT devices 10 may be two or more.

  The base station 20 constitutes a radio access network (RAN), and is also called, for example, an eNodeB, a gNodeB, or the like, or a macro cell base station, a small cell base station, or the like depending on the size of the cell formed by itself. The base station 20 includes, for example, a radio unit (RRH) that transmits and receives radio signals and a baseband unit (BBU) that performs digital baseband signal processing. The RRH converts, for example, a digital baseband signal received from the BBU into an RF signal, amplifies the power to a predetermined signal level, and transmits the RF signal to the IoT device 10. Further, the RRH converts the RF signal received from the mobile communication unit 10a of the IoT device 10 into a digital baseband signal and transmits the digital baseband signal to the BBU.

  The core network included in the mobile communication network 1 is also referred to as EPC (Evolved Packet Core) in LTE/LTE-Advanced, for example, and the base station 20 is connected to the core network via a predetermined communication interface. The core network also has various nodes such as S/PGW 30, MME 40, HSS 50, and SCEF 60. The core network may have other nodes such as a PCRF (Policy and Charging Rules Function).

  The S/PGW 30 performs data communication with the base station 20 via the mobile communication network without using IP (Internet Protocol), and performs data communication with the user apparatus 200 using IP. The S/PGW 30 functions as a node that performs packet transfer when performing data communication using IP between the IoT device 10 and the user device 200. Specifically, an IP address is assigned to the mobile communication unit 10a of the IoT device 10 and packet data transfer processing is performed. For example, as functions of the P-GW, IP address issuance to the IoT device 10, user authentication regarding connection to the packet network, communication use data for charging (for example, CDR: Call Data Record) creation, a DHCP server function, etc. Have. Further, as an S-GW function, it serves as an anchor point of the RAN having the base station 20 and the like, and relays user packet data between P-GWs.

  The MME 40 is a node that accommodates the base station 20 and performs wireless communication network control, mobility control, handover control, user authentication control, and the like. Based on the registration information of the HSS 50, the MME 40 transfers the data transmitted via the base station 20 to the SCEF 60 that performs the NIDD data transfer described below, or the data addressed to the IoT device 10 transmitted from the SCEF 60. Or transfer control information such as a transmission request to the base station 20. Further, the MME 40 has a function of collecting and storing information such as communication log information and communication control parameters for each of the IoT device 10 and the base station 20.

  The HSS 50 is a database of information of users (subscribers) who use a communication service using a mobile communication system. For example, the HSS 50 manages user contract information and user authentication information of the IoT device 10, and uses such information as a location registration trigger. To notify the MME 40.

  The SCEF 60 is a node having an interface for providing a part of 3GPP communication service to a third party application provider. The SCEF 60 serves as a connection point for the packet network provided with the AS 90, and performs a transfer process of data transmission from the IoT device 10 by NID described later. In addition, the SCEF 60 creates communication usage data (for example, CDR) for accounting for data transmission from the IoT device 10 by NIDD. The communication between the SCEF 60 and the AS 90 may be realized by secure packet communication such as using private IP or a dedicated line.

  Further, in the present embodiment, control information such as a transmission request for requesting data transmission (periodical notification) to the IoT device 10 at a predetermined data transmission timing may be notified from the SCEF 60 to the IoT device 10 through a control channel, for example. You can

  The transmission request including the transmission timing information may be included in the paging information received by the mobile communication unit 10a of the IoT device 10 when waiting for an incoming call. If the received paging information includes the S-TMSI (SAE Temporary Mobile Subscriber Identity) as the terminal identification information of the mobile communication unit 10a of the IoT device 10, the IoT device 10 is the paging information for the mobile communication unit 10a. Then, based on the transmission timing information included in the paging information, the transmission target data is transmitted to the AS 90 via the base station 20 at a predetermined transmission timing.

  In addition, the mobile communication unit 10a of the IoT device 10 may suspend the power supply to some circuits during the standby state for incoming calls in order to reduce the power consumption and put the sleep state. The mobile communication unit 10a of the IoT device 10 receives paging information including a transmission request having the transmission timing information at the time of waiting for the incoming call, powers the entire circuit by using the reception as a trigger, and activates a predetermined application. Alternatively, the data to be transmitted may be transmitted, and control may be performed such that the data returns to the sleep state when the data transmission is completed.

  Further, in the present embodiment, communication status information indicating the status of data transmission (regular notification) periodically transmitted from the IoT device 10 is transferred from the IoT device 10 or the base station 20 to the SCS 100 or the like via the MME 40 and the SCEF 60. can do. The communication status information is, for example, information such as communication log information and communication control parameters of the IoT device 10 and the base station 20, transmission timing setting information set in the communication information terminal of the IoT device 10, and communication information terminal of the IoT device 10. Data transmission history information having the frequency and data amount of data transmission in the above.

  The billing server 70 performs a billing process for data transmission from the IoT device 10 to the AS 90 based on the communication usage data (eg, CDR) of the IoT device 10 received from the SCEF 60 and the registration information of the HSS 50, for example. Further, it is also used for the later-described authentication processing performed by the authentication processing unit of the SCS 100.

  The certificate authority 80 is an external certificate authority that issues an SCS client certificate, which is a user certificate client certificate for connecting to the SCS 100 and performing communication, to the user device 200 to perform authentication. When the user device 200 communicates with the IoT device 10 by the communication method using IP, the user device 200 performs a procedure to have the certificate authority 80 issue the SCS client certificate in advance.

  The AS 90 is, for example, a server that executes various data processes required to provide various applications that utilize communication through the mobile communication network 1. The AS 90 of this embodiment includes a server having a database function of collecting and storing data transmitted from the IoT device 10 and performing various analyzes.

  The communication system of the present embodiment supports NIDD (Non-IP Data Delivery). NIDD is a function defined by the 3GPP standard (see, for example, TS23.401 V15.4.0 (2018-06), TS23.682 V15.5.0 (2018-06)), and the IoT device 10 This is a function that allows the mobile communication unit 10a installed in various devices such as to transfer data without operating the IP stack or acquiring an IP address. By using this NIDD, secure data transfer is possible with less attacks from the IP network using IP, and the amount of transmission data for transferring the same amount of information in the mobile communication network 1 can be reduced.

  In order to reduce the load of data processing in the mobile communication network 1, a MEC (Mobile Edge Computing) server that performs a part of the data processing in the mobile communication network 1 may be provided inside or near the base station 20. The MEC server may have a function of managing the data transmission timing of the IoT device 10 located in the cell of the base station 20 corresponding to the server, for example.

  Further, the communication system of the present embodiment supports coverage extension (CE) of category M1 (eMTC) and category NB1 (NB-IoT) so that the IoT device 10 can communicate in the IoT communication mode.

  The IoT communication mode is a communication mode for performing IoT communication with the base station 20, for example, a communication mode based on the eMTC of LTE-Advanced Pro or the NB-IoT standard (see Non-Patent Document 2), or , A communication mode of large-scale machine type communication (5G mMTC: massive Machine-Type Communications) proposed in the fifth generation mobile communication.

  The broadband communication mode is a communication mode in which broadband communication is performed with the base station 20 in a broadband communication area narrower than the IoT communication area in which communication is possible in the IoT communication mode, and for example, the third generation (3G) of mobile communication, It is a communication mode based on the standard of LTE, LTE-Advanced or LTE-Advanced Pro, or a communication mode of a new radio access technology (5G (New Radio)) proposed in the fifth-generation mobile communication.

  The IoT device 10 of this embodiment may be compatible with both the broadband communication mode and the IoT communication mode, or may be compatible with only the IoT communication mode.

Next, the configuration of the SCS 100 of this embodiment will be described.
The SCS 100 has a function as a management device that performs processing for realizing secure encrypted communication between the IoT device 10 and the user device 200 by a communication method using IP. As shown in FIG. 1, the SCS 100 includes an authentication processing unit 110, an SCEF I/F 120, a user management DB 130, and a client certificate issuing unit 140.

  The authentication processing unit 110 uses the authentication information transmitted from the user device 200 to perform an authentication process for authenticating the user device 200 connectable to the IoT device 10. Details of the authentication process will be described later.

  Further, the authentication processing unit 110, together with the SCEF I/F 120, is a device connection client certificate as communication permission information for permitting communication of the user apparatus 200 with the IoT device 10 designated by the user of the user apparatus 200. The device client certificate and the above-mentioned common key (also referred to as “shared key”) are transmitted to the IoT device 10 by a communication method (hereinafter referred to as “NIDD communication method”) compliant with NIDD which is a non-IP communication method. It also functions as the first transmitting unit for transmitting.

  The authentication processing unit 110 also functions as a second transmission unit that transmits the above-mentioned device client certificate and common key to the user device 200. In the present embodiment, since high security is desired for transmitting the device client certificate and the common key to the user device 200, a secure IP with improved security by the NIDD communication method or predetermined technical means. It is desirable to send by a communication method. In the present embodiment, an example will be described in which the device client certificate and the common key are transmitted to the user apparatus 200 by a secure IP communication method (communication method using IP) instead of the NIDD communication method. However, similar to the case of transmitting to the IoT device 10, the device client certificate and the common key can be transmitted to the user device 200 by the NIDD communication method.

  When transmitting the device client certificate and the common key to the user device 200 by the secure IP communication method, it is desired to ensure sufficient security. This is because if the security of this communication is insufficient, the risk that the device client certificate and the common key will be obtained by a third party increases, and a malicious third party device can access the IoT device 10. This is because the possibility increases. Therefore, when transmitting the device client certificate and the common key to the user apparatus 200, the IP communication method is used in the present embodiment, but only the user apparatus permitted to communicate by the SCS client certificate can communicate with the SCS 100. As described above, sufficient security is ensured by performing the authentication and the encrypted communication by SSL (Secure Sockets Layer).

  Further, in the present embodiment, when the device client certificate and the common key are transmitted to the user device 200, the user of the IoT device 10 to be accessed (the person who is permitted to communicate with the IoT device 10) is the user. It also authenticates whether it matches the user of the device 200. This further reduces the risk that a device of a person who is not permitted to communicate with the target IoT device 10 can access the IoT device 10 and secures higher security. Note that the billing server 70 may be used for this authentication.

  The SCEF I/F 120 is an interface for communicating with the SCEF 60. The SCS 100 and the SCEF 60 do not need to be connected by a non-IP communication method that does not use IP, but when connecting by the IP communication method, private IP or a dedicated line is used to provide sufficient security. It is desirable to secure

  The user management DB 130 is a database in which various information used for data processing such as authentication processing executed by the authentication processing unit 110 is registered, and at least a part of the information is acquired from the registration information of the HSS 50, and at a predetermined timing. Then, it is synchronized with the registration information of HSS50.

  The client certificate issuing unit 140 issues to the user device 200 a device client certificate for connecting to the IoT device 10 to be accessed and performing communication.

Next, the processing operation of the SCS 100 will be described.
As described above, the NIDD communication method supported by the communication system of the present embodiment is a communication technology that does not use IP and does not require an IP address. Therefore, the risk of a malicious attack by a general IP communication method is low, Secure communication is possible. However, although the NIDD communication system is generally applicable to small-sized data communication, it is often unsuitable for large-sized data communication. In particular, when performing data communication using a control channel in order to realize a more secure NIDD communication system, it is difficult to perform large-sized data communication.

  On the other hand, communication between the IoT device 10 and the user device 200 often requires relatively large-sized data communication such as setting data and firmware update. In addition, large-sized data communication is also required when the user device 200 accesses the IoT device 10 to perform various controls or when large-sized data is transferred from the IoT device 10 to the user device 200. Therefore, for the communication between the IoT device 10 and the user device 200, the NIDD communication method is not suitable, and it is required to perform the communication by the communication method capable of larger size data communication. In addition, in consideration of the user convenience of the user device 200, in the present embodiment, communication is performed between the IoT device 10 and the user device 200 by a widely used large-capacity IP communication method.

  However, in this case, since the IoT device 10 becomes communicable with the IP communication method, the risk of the IoT device 10 being attacked maliciously (risk of unauthorized access) is increased. Therefore, even in the IP communication method, a mechanism for ensuring more secure communication is required.

  Therefore, in the present embodiment, in the communication between the IoT device 10 and the user device 200, the user device 200 that accesses the IoT device 10 is requested for the device client certificate, and only the user device 200 having the proper authority is requested. Allows access (communication) to the IoT device 10. Further, the data communicated between the IoT device 10 and the user device 200 is encrypted by the common key cryptosystem. According to such security measures, secure communication with high security is realized unless the device client certificate and the common key are acquired by a third party.

  In order to maintain such secure communication with high security, it is necessary for the system to ensure that the risk that a device client certificate and common key will be acquired by a third party is low. This is because the IoT device 10 operates under relatively simple control, and therefore measures (control against the client certificate for device and common key being obtained by a third party) involving control on the IoT device 10 side are adopted. Since it is difficult, the SCS 100 securely distributes the device client certificate and the common key to the IoT device 10 so that the device client certificate and the common key cannot be obtained by a third party by so-called “spoofing”. What you do is important.

  In response to this, in the present embodiment, for distribution from the SCS 100 to the IoT device 10, the device client certificate and the common key are sent from the SCS 100 to the IoT device 10 using the NIDD communication system which is a non-IP communication system. I am trying to send it to. According to this, the risk of receiving a malicious attack by a general IP communication method is low, so that the device client certificate and the common key can be securely transmitted from the SCS 100 to the IoT device 10, and high security is ensured.

  Furthermore, by using the NIDD communication method, sufficient security can be secured without taking other security measures such as encrypted communication. As a result, when transmitting the device client certificate and common key from the SCS 100 to the IoT device 10, the amount of data required for encrypted communication can be reduced, and the amount of transmission data for transferring the same amount of information is small. Complete.

  Further, it is considered that there is a high risk that a third party obtains the device client certificate and the common key even when the device client certificate and the common key are distributed from the SCS 100 to the user device 200. Therefore, how to securely distribute the device client certificate and the common key to the user device 200 from the SCS 100 is also important.

  In response to this, in the present embodiment, for distribution from the SCS 100 to the user device 200, the device client certificate and the common key are transmitted by SSL encrypted communication. However, the security of distribution from the SCS 100 to the user device 200 may not be sufficient if only encrypted communication by SSL is used. That is, according to SSL encrypted communication, there is a risk that the device client certificate and the common key may be acquired by so-called “eavesdropping” by a third party who is not permitted to communicate with the IoT device 10 to be accessed. Can be lowered. However, the risk that the device client certificate and the common key may be acquired by a third party due to so-called “spoofing” cannot be excluded.

  Therefore, in the present embodiment, the SCS 100 further performs the authentication process of the user device 200. Specifically, the authentication process is performed so that only the user device permitted to communicate with the SCS client certificate can communicate with the SCS 100. It also authenticates whether the user of the IoT device 10 to be accessed (the person who is permitted to communicate with the IoT device 10) matches the user of the user device 200. By using such an authentication process together, “spoofing” in place of the user device 200 is prevented, and a device client certificate and a common key are provided to a third-party device that is not permitted to communicate with the IoT device 10 to be accessed. Has a low risk of being acquired.

FIG. 2 is a sequence diagram showing the flow of processing operations of the SCS 100 in this embodiment.
In the present embodiment, the processing operation of the SCS 100 includes an authentication step of authenticating whether or not the user device 200 that accesses the SCS 100 has a right to access the IoT device 10 that is the access target, and the user device 200 and the access. It can be roughly divided into a transmission step of transmitting the common key and the device client certificate to the target IoT device 10.

  In the authentication step, the user of the user device 200 applies in advance to the certificate authority 80 for issuing the SCS client certificate (client certificate of the user device 200), and has the SCS client certificate issued. As the certificate authority 80, an existing certificate authority that issues a client certificate can be used.

  When the IoT device 10 is accessed by the user apparatus 200 (user apparatus 200 having the SCS client certificate installed) that has been issued with the SCS client certificate, the user apparatus 200 first accesses the SCS 100. Then, when SSL is established between the user device 200 and the SCS 100, the authentication processing unit 110 of the SCS 100 first transmits a request for acquiring the SCS client certificate to the user device 200. Upon receiving this, the user device 200 transmits the SCS client certificate that is acquired and installed in advance to the authentication processing unit 110 of the SCS 100. Upon receipt of the SCS client certificate, the authentication processing unit 110 of the SCS 100 requests the certificate authority 80 corresponding to the SCS client certificate to confirm the SCS client certificate, and the certificate authority 80 confirms the confirmation result (authentication). Is received), the user device 200 is authenticated and communication with the user device 200 is continued.

  If the SCS client certificate cannot be received from the user device 200 or if the received SCS client certificate fails to be authenticated, the authentication processing unit 110 of the SCS 100 does not authenticate the user device 200. The processing operation ends.

  The authentication processing unit 110 that has authenticated the user device 200 then transmits to the user device 200 a request to acquire SIM information (device identification information) of the IoT device 10 that is the access target that the user device 200 desires to access. This SIM information is information stored in the SIM mounted in the mobile communication unit 10a of the IoT device 10, and for example, user identification information (eg, IMSI: International Mobile Subscriber Identity) or movement of the mobile communication unit 10a. The machine identification number of the communication unit 10a may be used.

  Since the IoT device 10 of the present embodiment uses the NIDD communication method, as described above, the IoT device 10 includes the mobile communication unit 10a for connecting to the mobile communication network 1. Therefore, the SIM information of the mobile communication unit 10a is registered in the billing server 70. Therefore, in the present embodiment, when the SIM information of the IoT device 10 to be accessed is received from the user device 200 in response to the SIM information acquisition request, the authentication processing unit 110 of the SCS 100 causes the information of the charging server 70 and the user management DB 130. Using, to check whether the information of the user registered in the billing server 70 corresponding to the SIM information and the information of the user registered in the billing server 70 as the user of the user device 200 match. (Authenticate). If a match is found by this confirmation (authentication), the user device 200 is authenticated as having the proper authority to access the IoT device 10 to be accessed, and communication with the user device 200 is continued.

  If the SIM information of the IoT device 10 to be accessed cannot be received from the user device 200, or if the user corresponding to the received SIM information and the user of the user device 200 do not match (when authentication fails). , The authentication processing unit 110 of the SCS 100 ends the processing operation without authenticating the user device 200.

  When the user device 200 is authenticated in the above authentication step, the process then proceeds to a transmission step of transmitting the common key and the device client certificate to the user device 200 and the IoT device 10 to be accessed.

  In the transmitting step, first, the client certificate issuing unit 140 of the SCS 100 generates a device client certificate for accessing the IoT device 10 to be accessed. The generated device client certificate is passed to the authentication processing unit 110 of the SCS 100. The authentication processing unit 110 of the SCS 100 also generates a common key. Then, the authentication processing unit 110 transmits the device client certificate and the common key to the IoT device 10 to be accessed by the NIDD communication method. Upon receiving this, the IoT device 10 stores the received device client certificate and common key in its own storage device, and transmits ACK for confirmation of receipt.

  When the authentication processing unit 110 of the SCS 100 receives the ACK of the receipt confirmation from the IoT device 10, next, the same device client certificate and common key that are transmitted to the IoT device 10 are used, and the user device in which the SSL is established. Send to 200.

  Through the authentication step and the transmission step as described above, by distributing the common key and the device client certificate to the user device 200 and the IoT device 10 to be accessed, the common key and the device client certificate are obtained. There is little risk of being acquired by a third party.

FIG. 3 is a sequence diagram showing a flow of communication operation between the user apparatus 200 and the IoT device 10 according to this embodiment.
Upon receiving the common key and the device client certificate from the SCS 100, the user device 200 accesses the IoT device 10 to be accessed by the IP communication method capable of large-capacity data communication. For example, the user device 200 may access the IoT device 10 via the wireless AP 300, the wireless LAN, or the Internet. In addition, the user device 200 of the present embodiment includes the same mobile communication unit as the IoT device 10, and can perform wireless communication with the base station 20 by a predetermined wireless communication method and connect to the mobile communication network 1 side. In this case, the IoT device 10 may be accessed by the IP communication method via the mobile communication network 1.

  The user device 200 first transmits a login request for data communication with the IoT device 10 to the IoT device 10. The IoT device 10 that has received this login request transmits a request for acquiring the device client certificate to the user device 200. Upon receiving this, the user device 200 encrypts the device client certificate that has been previously received from the SCS 100 and has been installed, with the common key that was previously received from the SCS 100 and stored in the storage unit. Then, the encrypted device client certificate is transmitted to the IoT device 10.

  Upon receiving the device client certificate encrypted with the common key, the IoT device 10 decrypts the received device client certificate using the same common key received from the SCS 100 in advance and stored in the storage unit. Turn into. Then, the IoT device 10 checks whether or not the device client certificate of the user device 200, which is received from the SCS 100 in advance and stored in the storage unit, matches the decrypted device client certificate. To do. If it is determined that they match by this collation, the user device 200 is authenticated, and an ACK for reporting the successful authentication is transmitted to the user device 200.

  If the device client certificate cannot be received from the user device 200, or if the received device client certificate authentication fails, the IoT device 10 does not authenticate the user device 200 and performs the processing operation. finish.

  After that, the user device 200 that has received the authentication success report (ACK) transmits the login information of the ID and the password for logging in to the IoT device 10 to the IoT device 10. The IoT device 10 executes a login process for confirming whether the received login information is valid, and when confirming that the login information is valid, the IoT device 10 accepts the login of the user device 200 and reports the login success to the user device 200. ACK for sending. As a result, the user device 200 can perform various data communications with the IoT device 10 within the range of the given authority.

  Even in data communication after login, it is preferable to communicate by encrypted communication in order to ensure security. This encrypted communication may be performed by the common key cryptosystem using the above-mentioned common key, but may be performed by another cryptosystem such as the public key cryptosystem.

  Further, in the present embodiment, the common key cryptosystem is adopted as the cryptosystem for transmitting the device client certificate from the user device 200 to the IoT device 10. Therefore, the encryption information transmitted from the SCS 100 to the user device 200 is the common key, and the decryption information transmitted from the SCS 100 to the IoT device 10 is the same common key. On the other hand, as an encryption method for transmitting the device client certificate from the user device 200 to the IoT device 10, another encryption method such as a public key encryption method may be adopted. For example, when the public key cryptosystem is adopted, the public key is used for the encryption information transmitted from the SCS 100 to the user device 200, and the private key is used for the decryption information transmitted from the SCS 100 to the IoT device 10. Used.

  Further, in the present embodiment, an example in which the user device 200 performs the encryption process of the device client certificate transmitted from the user device 200 to the IoT device 10 has been described, but the present invention is not limited to this, and the SCS 100 performs the process. May be. Specifically, the SCS 100 side encrypts the device client certificate, and sends the encrypted device client certificate to the user apparatus 200. In this case, since it is not necessary to transmit the common key as the encryption information to the user device 200, higher security can be realized.

  The processing steps and the components of the communication system, server, base station, and mobile communication unit (UE, mobile station) described in this specification can be implemented by various means. For example, these steps and components may be implemented in hardware, firmware, software, or a combination thereof.

  Regarding hardware implementation, in order to realize the steps and components in a substance (for example, various wireless communication devices, various base station devices such as eNodeB and gNode, mobile communication unit, hard disk drive device, or optical disk drive device). Means such as processing units used are one or more application specific ICs (ASICs), digital signal processors (DSPs), digital signal processors (DSPDs), programmable logic devices (PLDs), field programmable. A gate array (FPGA), processor, controller, microcontroller, microprocessor, electronic device, other electronic unit designed to perform the functions described herein, a computer, or a combination thereof. May be implemented in.

  Also, for firmware and/or software implementations, each unit used to implement the components is a code (eg, a procedure, function, module, instruction, etc.) that performs the functions described herein. ) May be implemented. In general, any computer/processor readable medium embodying firmware and/or software code, means, such as a processing unit, used to implement the steps and components described herein. May be used to implement. For example, firmware and/or software code may be stored in memory and executed by a computer or processor, eg, in a controller or storage device. The memory may be mounted inside the computer or the processor, or may be mounted outside the processor. The firmware and/or software code may be, for example, random access memory (RAM), read only memory (ROM), non-volatile random access memory (NVRAM), programmable read only memory (PROM), electrically erasable PROM (EEPROM). ), a FLASH memory, a floppy disk, a compact disk (CD), a digital versatile disk (DVD), a magnetic or optical data storage device, and the like, even when stored on a computer or processor readable medium. Good. The code may be executed by one or more computers or processors, or may cause a computer or processor to perform any of the functional aspects described herein.

  Further, the medium may be a non-transitory recording medium. In addition, the code of the program may be readable and executable by a computer, a processor, or another device or machine, and its format is not limited to a particular format. For example, the code of the program may be any of source code, object code, and binary code, or may be a mixture of two or more of these codes.

  Also, the description of the embodiments disclosed herein is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to this disclosure will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, the present disclosure should not be limited to the examples and designs described herein, but should be admitted to the broadest extent consistent with the principles and novel features disclosed herein.

1: mobile communication network 10: IoT device 20: base station 30: S/PGW
40: MME
50: HSS
60: SCEF
70: Billing server 80: Certificate authority 90: AS
100: SCS
110: Authentication processing unit 120: SCEF I/F
130: User management DB
140: Client certificate issuing unit 200: User device 300: Wireless AP

Claims (14)

A management device for managing communication between a device and a user device via a mobile communication network,
A non-IP communication method for performing data communication without using IP (Internet Protocol) in the mobile communication network, for permitting communication of the user device to the device corresponding to device identification information transmitted from the user device. Communication permission information, and a first transmitting unit for transmitting to the device decryption information for decrypting the communication permission information encrypted by the encryption information,
A management apparatus, comprising: a second transmission unit that transmits the encryption information and the communication permission information, or the communication permission information encrypted by the encryption information to the user device. In the management device according to claim 1,
The management device, wherein the non-IP communication method is a communication method based on NIDD (Non-IP Data Delivery). In the management device according to claim 1 or 2,
The management apparatus, wherein the communication permission information includes a device connection client certificate of the user apparatus. The management device according to any one of claims 1 to 3,
The management device, wherein the encryption information and the decryption information are the same information. The management device according to any one of claims 1 to 4,
At least one of the encryption information and the decryption information is information with a limited usage time, the management apparatus. The management device according to any one of claims 1 to 5,
The second transmitting unit transmits the encryption information and the communication permission information, or the communication permission information encrypted by the encryption information to the user device by encrypted communication. Management device. The management device according to any one of claims 1 to 6,
The management device is an SCS (Service Capability Server). The management device according to any one of claims 1 to 7,
An authentication processing unit that executes an authentication process using the authentication information transmitted from the user device,
The management apparatus, wherein the first transmission unit transmits the encryption information and the communication permission information to the device via the first network when the authentication processing unit authenticates. In the management device according to claim 8,
The authentication information includes a user authentication client certificate of the user device;
The management device includes a process of transmitting an authentication request for a user authentication client certificate of the user device to a predetermined certificate authority and receiving an authentication result of the predetermined certificate authority. The management device according to claim 8 or 9,
The authentication information includes the device identification information transmitted from the user device and user identification information of the user device transmitted from the user device,
The management apparatus is characterized in that the authentication processing includes processing for collating user information of the device corresponding to the device identification information with the user identification information. The management device according to claim 10,
A billing processing device for billing a usage fee of a communication service in the device and the user device, the communication system comprising:
In the authentication process, the collation is performed by using information registered in the billing device for at least one of user information of the device and user identification information of the user device. A device connectable to a base station of a mobile communication network,
A user device capable of communicating with the device;
A management system for managing communication between the device and the user device, comprising:
The management device is the management device according to any one of claims 1 to 10,
The user device, when communicating with the device, has a transmission unit that transmits the communication permission information encrypted by the encryption information to the device,
The device decrypts the encrypted communication permission information transmitted from the user device with the decryption information, and determines whether to permit communication with the user device using the decrypted communication permission information. A communication system comprising: A program that causes a computer of a management device to manage communication between a device and a user device via a mobile communication network,
A non-IP communication method for performing data communication without using IP (Internet Protocol) in the mobile communication network, for permitting communication of the user device to the device corresponding to device identification information transmitted from the user device. Communication permission information, and a first transmitting step of transmitting decryption information for decrypting the communication permission information encrypted by the encryption information to the device,
A second transmitting step of transmitting the encryption information and the communication permission information, or the communication permission information encrypted by the encryption information to the user device, and causing the computer to execute the second transmission step. And the program. A method for controlling a management device that manages communication between a device and a user device via a mobile communication network,
A non-IP communication method for performing data communication without using IP (Internet Protocol) in the mobile communication network, for permitting communication of the user device to the device corresponding to device identification information transmitted from the user device. Communication permission information, and a first transmitting step of transmitting decryption information for decrypting the communication permission information encrypted by the encryption information, to the device,
A second transmitting step of transmitting the encryption information and the communication permission information, or the communication permission information encrypted by the encryption information to the user device.

Images