JP7050585B2 - Central processing unit, meter reading system and unauthorized access detection method - Google Patents

Description

The present invention relates to a central processing unit that authenticates a terminal device, a meter reading system, and an unauthorized access detection method.

In recent years, various information has been digitized and managed. Along with this, a technique for preventing unauthorized access to an information system that manages or collects information is drawing attention. In order to prevent unauthorized access, the information system needs to determine whether or not it is unauthorized access.

In Patent Document 1, addresses such as MAC (Media Access Control) addresses of legitimate devices are registered in advance in the communication control device, and the addresses stored in the data received from the devices and the registered addresses are described. A technique for determining whether or not an unauthorized access is made based on whether or not they match is disclosed.

Japanese Unexamined Patent Publication No. 2016-72801

In the technique described in Patent Document 1, it is determined whether or not the access is unauthorized by using the address stored in the transmitted data. Therefore, in the technique described in Patent Document 1, when an unauthorized device transmits data using an address registered in a communication control device by disguising the address, it is determined to be a legitimate access. It ends up. Further, in the technique described in Patent Document 1, it is not possible to distinguish whether or not a legitimate device is owned by the correct owner, and even when an unauthorized owner makes unauthorized access using the legitimate device. , It cannot be determined that the access is unauthorized. The technique described in Patent Document 1 has a problem that it cannot detect unauthorized access that cannot be determined by an address.

The present invention has been made in view of the above, and an object of the present invention is to obtain a central processing unit capable of detecting unauthorized access that cannot be determined by an address.

In order to solve the above-mentioned problems and achieve the object, the central processing apparatus according to the present invention is a central processing apparatus that can be connected to a multi-hop network, and is a multi-hop of a legitimate terminal device constituting the multi-hop network. Obtains topology information indicating a legitimate connection position in the network, obtains the connection position in the multi-hop network of the terminal device that is the source of the data based on the data received from the terminal device, and is based on the obtained connection position and topology information. The authentication processing unit is provided with an authentication processing unit that executes detection processing to detect unauthorized access, and the authentication processing unit continuously fails in authentication using an authentication key commonly held with a legitimate terminal device. When is equal to or greater than the threshold value, detection processing is performed, and the topology information is obtained from the relay device, which is a device that relays the communication between the address of the legitimate terminal device and the central processing device for each legitimate terminal device. Each time the authentication processing unit authenticates the terminal device, the authentication processing unit records the address of the terminal device, the time of authentication, and the authentication result as a first authentication log, including the identification information, and the terminal from which the data is transmitted from the data. Extract the source address, which is the address of the device, extract the identification information of the relay device corresponding to the source address from the topology information, and address it to the source address by the communication path based on the extracted identification information of the relay device. The terminal device requests the acquisition of the second authentication log, which is the information that records the past authentication results, and if the second authentication log and the first authentication log do not match, it is determined that the access is unauthorized .

According to the present invention, it is possible to detect an unauthorized access that cannot be determined by an address.

The figure which shows the structural example of the meter reading system which concerns on embodiment of this invention. The figure which shows the configuration example of the central processing system of embodiment The figure which shows the configuration example of the computer system which realizes the authentication server of embodiment The figure which shows the configuration example of the topology information held by the authentication server. Diagram showing a configuration example of the authentication key table held by the key server Diagram showing a configuration example of the encryption key table held by the key server Figure showing an example of authentication log The figure which shows the configuration example of the terminal apparatus of embodiment The figure which shows an example of the authentication log held by a terminal device. The figure which shows the configuration example of the aggregation device of embodiment The figure which shows an example of the topology information held by an aggregate device. Chart diagram showing an example of the authentication processing procedure of the embodiment The figure which shows the example which the unauthorized terminal device is wirelessly connected. A flowchart showing an example of an authentication processing procedure in the authentication server of the embodiment. A flowchart showing an example of the processing procedure of the unauthorized terminal determination process in step S29. The figure which shows an example of the estimated value of the communicable range of a terminal device. A flowchart showing another example of the processing procedure of the unauthorized terminal determination process in step S29. The figure which shows the example which the terminal device was removed illegally A flowchart showing an example of the authentication procedure when the authentication process includes the judgment using the topology information.

Hereinafter, the central processing unit, the meter reading system, and the unauthorized access detection method according to the embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to this embodiment.

Embodiment.
FIG. 1 is a diagram showing a configuration example of a meter reading system according to an embodiment of the present invention. The meter reading system of the present embodiment includes terminal devices 1-1 to 1-11 called smart meters, aggregation devices 2-1 and 2-2, and central processing called a head end system (HES). A system 3 and a meter data management system (MDMS (Meter Data Management System)) 4 are provided. The aggregating devices 2-1 and 2-2 and the central processing system 3 are connected by a network 5. The network 5 is, for example, an optical line network and a mobile phone network, but is not limited thereto.

Hereinafter, when each of the terminal devices 1-1 to 1-11 is shown without distinction, it is described as terminal device 1, and when each of the aggregation devices 2-1 and 2-2 is shown without distinction. Is described as an aggregation device 2. In FIG. 1, 11 terminal devices 1 and 2 aggregation devices 2 are shown, but these are examples, and the number of terminal devices 1 and aggregation devices 2 is limited to the example shown in FIG. Not done.

Each of the terminal devices 1-1 to 1-11 is installed in a home, a business establishment, etc., measures the amount of electric power used in the home, the business establishment, etc., and transmits the measurement result to the corresponding aggregation device 2. .. The terminal devices 1-1 to 1-11 are defined with the aggregation device 2 corresponding to each. The aggregation device 2 aggregates the data transmitted from the terminal devices 1-1 to 1-11, which are legitimate terminals, and relays the communication between the terminal devices 1-1 to 1-11 and the central processing system 3. ..

The aggregation device 2 and the terminal devices 1-1 to 1-11 communicate by a wireless multi-hop method. That is, the aggregation device 2 and the terminal devices 1-1 to 1-11 form a wireless multi-hop network. The aggregating device 2 and the terminal devices 1-1 to 1-11 periodically exchange control messages according to a route control protocol, and hold route information, that is, information regarding a connection position in a wireless multi-hop network as topology information. .. An example of a routing protocol is RPL (IPv6 (Internet Protocol version 6) Routing Protocol for Low power and Lossy Network), but the routing protocol is not limited to this. Hereinafter, the direction of communication from the terminal devices 1-1 to 1-11 to the aggregation device 2 is referred to as an up direction, and the direction of communication from the aggregation device 2 to the terminal devices 1-1 to 1-11 is referred to as a down direction.

Specifically, the topology information held by each terminal device 1 stores information indicating the next terminal device 1 or the aggregation device 2 on the upstream route. Hereinafter, each of the terminal device 1 and the aggregation device 2 constituting the wireless multi-hop network is also referred to as a node. Further, the next terminal device 1 or the aggregation device 2 on the upstream and downstream paths of each smart meter is referred to as a next node. Regarding the downlink route, when the aggregation device 2 transmits data to each terminal device 1, information indicating a node to pass through, that is, the terminal device 1 to pass through may be stored in the data, or the information indicating the terminal device 1 to pass through may be stored in the data. Also, each terminal device 1 may hold information on the next node for each destination as topology information.

The terminal devices 1-1 to 1-11 transmit the measurement results measured by themselves to the corresponding aggregation device 2. Here, the transmission of data to the aggregation device 2 by the terminal device 1 specifically means that the data is transmitted to the next node based on the topology information held by each terminal device 1. means. When each terminal device 1 receives data from another terminal device 1, if the received data is data addressed to the aggregation device 2, each terminal device 1 transfers the data to the next node based on the topology information held by the terminal device 1. do. This transfer is sequentially performed by each terminal device 1 on the route until the data arrives at the aggregation device 2. Similarly, in the downlink direction, the data is sequentially transferred to the next node, so that the data arrives from the aggregation device 2 to each terminal device 1. The route in the downward direction is designated by, for example, the aggregation device 2.

The aggregation device 2 aggregates the weighing results received from the terminal device 1 and transmits them to the central processing system 3 via the network 5. The aggregation device 2 is installed on, for example, a utility pole. The central processing system 3 collects the weighing result from the aggregation device 2 and transmits the collected weighing result to the MDMS4. The MDMS 4 manages the weighing result received from the central processing system 3.

The line connecting the nodes constituting the wireless multi-hop network shown in FIG. 1 is an example of a communication path, and the number of nodes to which one node can wirelessly connect is not limited to one. Each node may be able to wirelessly connect to a plurality of nodes, and even if a communication failure occurs between the nodes, the communication path between each terminal device 1 and the corresponding aggregation device 2 may be changed. good. Further, although the terminal device 1 is usually associated with one aggregation device 2, a spare aggregation device 2 may be set. As a result, the terminal device 1 can communicate with the spare aggregation device 2 when a failure occurs in the associated aggregation device 2. The aggregation device 2 manages the terminal device 1 that relays communication by itself. Although the example in which the wireless multi-hop method is used for the aggregation device 2 and the terminal devices 1-1 to 1-11 will be described here, the multi-hop method by power line communication may be used. That is, the terminal device 1 and the aggregation device 2 may form a multi-hop network.

FIG. 2 is a diagram showing a configuration example of the central processing system 3 of the present embodiment. The central processing system 3 includes an authentication server 6 which is an example of the central processing device according to the present invention, and a key server 7 which manages the authentication key and the encryption key of the terminal devices 1-1 to 1-11. The central processing system 3 may include devices other than the authentication server 6 and the key server 7. In the present embodiment, the weighing result transmitted from the terminal device 1 to the central processing system 3 is encrypted. Further, the control data for controlling the terminal device 1 exchanged between the central processing system 3 and the terminal device 1 is also encrypted. The terminal device 1 makes an authentication request to the authentication server 6 at a predetermined timing, and the authentication server 6 transmits the encryption key used in the above-mentioned encryption to the terminal device 1 that has succeeded in authentication. .. The defined timing is a periodic timing such as every 24 hours. Further, the terminal device 1 also makes an authentication request and acquires an encryption key when the power of the terminal device 1 is turned on or when the terminal device 1 returns after the communication cannot be performed due to a communication failure or the like. The authentication server 6 changes the encryption key for each terminal device 1 each time authentication is performed. As a result, the encryption key is changed periodically.

The authentication server 6 includes a communication unit 61, an authentication processing unit 62, an encryption processing unit 63, a collection management unit 64, a key acquisition unit 65, and a storage unit 66. The communication unit 61 communicates with the aggregation device 2 via the network 5. The authentication processing unit 62 performs authentication processing for the terminal device 1. The details of the authentication process will be described later. The encryption processing unit 63 encrypts plaintext, which is data to be sent to the terminal device 1, using the encryption key corresponding to the terminal device 1, generates a ciphertext, and transmits the ciphertext to the terminal device 1 via the communication unit 61. do. Further, the encryption processing unit 63 obtains plaintext by decrypting the ciphertext received from the terminal device 1 via the communication unit 61 using the encryption key corresponding to the terminal device 1. The authentication processing unit 62 acquires the encryption key corresponding to the terminal device 1 from the key server 7 via the key acquisition unit 65. When the plaintext obtained by decryption is the measurement result, the encryption processing unit 63 passes the measurement result to the collection management unit 64.

The collection management unit 64 receives the measurement result transmitted from the terminal device 1 from the encryption processing unit 63, and stores it in the storage unit 66 as measurement information. Further, the collection management unit 64 transmits the measurement information stored and accumulated in the storage unit 66 to the MDMS 4 via the communication unit 61. In the present embodiment, the weighing result collected by the authentication server 6 is accumulated as weighing information and transmitted to the MDMS 4, but the authentication server 6 stores the weighing result in another not shown in the central processing system 3. It may be sent to a server, and another server may accumulate the weighing result as weighing information and send it to MDMS4. The weighing result is periodically transmitted from the terminal device 1, for example, every 30 minutes. The terminal device 1 may voluntarily transmit the weighing result, or the collection management unit 64 requests the terminal device 1 to transmit the weighing result via the encryption processing unit 63 and the communication unit 61. The device 1 may transmit the weighing result.

The key acquisition unit 65 communicates with the key server 7. When the key acquisition unit 65 receives a request from the authentication processing unit 62 to acquire the authentication key of the terminal device 1, the key acquisition unit 65 acquires the authentication key corresponding to the terminal device 1 from the key server 7 and passes it to the authentication processing unit 62. Further, when the key acquisition unit 65 receives a request from the encryption processing unit 63 to acquire the encryption key of the terminal device 1 via the authentication processing unit 62, the key acquisition unit 65 acquires the encryption key corresponding to the terminal device 1 from the key server 7. , Passed to the encryption processing unit 63. Further, as will be described later, the authentication processing unit 62 transmits the encryption key to the terminal device 1 in the process of the authentication processing. At this time, the authentication processing unit 62 requests the key acquisition unit 65 to acquire the encryption key of the terminal device 1. When the key acquisition unit 65 receives a request from the authentication processing unit 62 to acquire the encryption key of the terminal device 1, the key acquisition unit 65 acquires the encryption key corresponding to the terminal device 1 from the key server 7 and passes it to the authentication processing unit 62.

The storage unit 66 stores the authentication log, the topology information, and the measurement information. The authentication log is log information that records the authentication result of the terminal device 1, and the topology information is information that indicates the connection position of each terminal device 1 on the wireless multi-hop network. Details of the authentication log and topology information will be described later.

The key server 7 includes a communication unit 71, a control unit 72, and a storage unit 73. The communication unit 71 communicates with the authentication server 6. The storage unit 73 stores the authentication key for each terminal device as an authentication key table. Further, the storage unit 73 stores the encryption key for each terminal device as an encryption key table. Not limited to this example, the authentication key and the encryption key may be collectively stored as one table in the storage unit 73 for each terminal.

When the control unit 72 receives the authentication key acquisition request of the terminal device 1 via the communication unit 71, the control unit 72 reads the corresponding authentication key from the authentication key table and transmits the corresponding authentication key to the authentication server 6 via the communication unit 71. When the control unit 72 receives the request for acquiring the encryption key of the terminal device 1 via the communication unit 71, the control unit 72 reads the corresponding encryption key from the encryption key table and transmits it to the authentication server 6 via the communication unit 71. As described above, the encryption key is updated at periodic timings. Since the encryption key is updated every time the terminal device 1 is authenticated, the key acquisition unit 65 of the authentication server 6 sends the terminal device 1 to the key server 7 when the authentication processing unit 62 requests the acquisition of the encryption key. Notify you of key updates. When the control unit 72 of the key server 7 receives the notification of the key update of the terminal device 1 via the communication unit 71, the control unit 72 updates the encryption key of the terminal device 1 and transfers the updated encryption key to the authentication server 6 to the communication unit. It sends via 71 and updates the encryption key table. The update timing and update method of the encryption key are not limited to this example. The key server 7 may periodically update the encryption key of each terminal device 1 without the notification from the authentication server 6.

Specifically, the authentication server 6 is a computer system, that is, a computer. The computer system functions as the authentication server 6 by executing the authentication processing program in which the processing executed by the authentication server 6 is described. The authentication processing program includes a program for causing a computer to execute an unauthorized access detection method described later in this embodiment.

FIG. 3 is a diagram showing a configuration example of a computer system that realizes the authentication server 6 of the present embodiment. As shown in FIG. 3, this computer system includes a control unit 101, an input unit 102, a storage unit 103, a display unit 104, a communication unit 105, and an output unit 106, which are connected via a system bus 107. There is.

In FIG. 3, the control unit 101 is, for example, a CPU (Central Processing Unit) or the like. The control unit 101 executes the authentication processing program of the present embodiment. The input unit 102 is composed of, for example, a keyboard, a mouse, or the like, and is used by a user of a computer system to input various information. The storage unit 103 includes various memories such as RAM (Random Access Memory) and ROM (Read Only Memory) and a storage device such as a hard disk, and is a necessary program obtained in the process of a program to be executed by the control unit 101. Store data etc. The storage unit 103 is also used as a temporary storage area for the program. The display unit 104 is composed of an LCD (liquid crystal display panel) or the like, and displays various screens to the user of the computer system. The communication unit 105 is a communication circuit or the like that performs communication processing. The communication unit 105 may be configured by a plurality of communication circuits corresponding to a plurality of communication methods. The output unit 106 is an output interface that outputs data to an external device such as a printer or an external storage device. Note that FIG. 3 is an example, and the configuration of the computer system is not limited to the example of FIG.

Here, an operation example of the computer system until the authentication processing program of the present embodiment becomes executable will be described. The computer system having the above-described configuration stores, for example, an authentication processing program from a CD-ROM drive or DVD-ROM set in a CD (Compact Disc) -ROM or DVD (Digital Versatile Disc) -ROM drive (not shown). It is installed in part 103. Then, when the authentication processing program is executed, the authentication processing program read from the storage unit 103 is stored in the storage unit 103. In this state, the control unit 101 executes the process as the authentication server 6 of the present embodiment according to the program stored in the storage unit 103.

In the above description, a program describing the processing in the authentication server 6 is provided using a CD-ROM or a DVD-ROM as a recording medium, but the present invention is not limited to this, and the configuration of the computer system and the provided program are not limited to this. Depending on the capacity and the like, for example, a program provided by a transmission medium such as the Internet via the communication unit 105 may be used.

The authentication processing unit 62, the encryption processing unit 63, and the collection management unit 64 shown in FIG. 2 are realized by the control unit 101 of FIG. The storage unit 66 shown in FIG. 2 is a part of the storage unit 103 shown in FIG. The communication unit 61 shown in FIG. 2 is realized by the communication unit 105 shown in FIG. The key acquisition unit 65 shown in FIG. 2 is realized by the communication unit 105 and the control unit 101 shown in FIG.

Specifically, the key server 7 is also a computer system, that is, a computer. The configuration example of the computer system that realizes the key server 7 is the same as the computer system illustrated in FIG. The function as the key server 7 is realized by executing the program for realizing the function of the key server 7 by the control unit 101. The operation example of the computer system until this program becomes executable is the same as that of the authentication server 6. The control unit 72 shown in FIG. 2 is realized by the control unit 101 shown in FIG. 3, the storage unit 73 shown in FIG. 2 is realized by the storage unit 103 shown in FIG. 3, and the communication unit shown in FIG. 2 is realized. 71 is realized by the communication unit 105 shown in FIG.

Next, the information stored in the authentication server 6 and the key server 7 of the present embodiment will be described. FIG. 4 is a diagram showing a configuration example of topology information held by the authentication server 6. The topology information held by the authentication server 6 is information indicating a legitimate connection position in the multi-hop network of the legitimate terminal device 1 constituting the multi-hop network. Specifically, the topology information held by the authentication server 6 includes, for each legitimate terminal device, identification information of a relay device which is a device for relaying communication between a legitimate terminal device address and a central processing unit. .. Specifically, as shown in FIG. 4, the topology information held by the authentication server 6 is information indicating the aggregation device 2 that relays the communication of the terminal device 1 and the terminal device 1 that relays the communication of the terminal device 1 for each terminal device 1. be. In this example, there are a plurality of relay devices, and the plurality of relay devices are an aggregate device 2 and one or more legitimate terminal devices 1. The topology information held by the authentication server 6 includes information indicating the terminal device, the aggregation device, and the relay terminal device, respectively.

Specifically, as shown in the first column from the left in FIG. 4, as the information indicating the terminal device, the MAC address which is the address of the terminal device 1 which is the identification information of the terminal device 1 is stored. As the information indicating the aggregation device, as shown in the second column from the left in FIG. 4, the MAC address of the aggregation device 2 that relays the communication of the terminal device 1 is stored. As the information indicating the terminal device to be relayed, as shown in the third column from the left in FIG. 4, the MAC address of the terminal device 1 that relays the communication of the terminal device 1 is stored. M1-1 to M1-5 indicate the MAC addresses of the terminal devices 1-1 to 1-5, respectively. M2-1 and M2-2 indicate the MAC addresses of the aggregate devices 2-1 and 2, respectively. As will be described later, the aggregation device 2 holds the topology information regarding the terminal device 1 managed by the aggregation device 2. The authentication server 6 acquires the topology information held by the aggregation device 2 from each aggregation device 2 and holds it in the storage unit 66 as the topology information of the terminal device 1 constituting the meter reading system.

FIG. 4 shows a part of the topology information in the configuration example shown in FIG. For example, the terminal device 1-1 is connected to the central processing system 3 via the terminal device 1-3 and the aggregation device 2-1. Therefore, as shown in the first row of FIG. 4, in the row in which the MAC address M1-1 of the terminal device 1-1 is stored in the first column from the left, the aggregation device 2- in the second column from the left. M2-1 which is the MAC address of 1 is stored, and M1-3 which is the MAC address of the terminal device 1-3 is stored in the third column from the left. Further, as shown in FIG. 1, the terminal device 1-5 is connected to the central processing system 3 via the terminal devices 1-6, 1-8 and the aggregation device 2-2. Therefore, as shown in the 5th row of FIG. 4, in the row in which the MAC address M1-5 of the terminal device 1-5 is stored in the 1st column from the left, the aggregation device 2-2 is stored in the 2nd column from the left. M2-2, which is the MAC address of the above, is stored, and M1-6, M1-8, which are the MAC addresses of the terminal devices 1-6, 1-8, are stored in the third column from the left.

In the example shown in FIG. 4, it is assumed that the communication path is the same in the up direction and the down direction, and the relay terminal device 1 is shown without distinguishing between the up direction and the down direction. Not limited to this, the terminal device 1 may be managed separately in the ascending direction and the descending direction as the topology information.

The configuration of the topology information shown in FIG. 4 is an example, and the order of the constituent information is not limited to this example. Further, the topology information may include information other than the above-mentioned information. Further, the topology information may not include information indicating a terminal device that relays the communication of the terminal device 1.

FIG. 5 is a diagram showing a configuration example of an authentication key table held by the key server 7. As shown in FIG. 5, the authentication key table held by the key server 7 includes the MAC address of the terminal device 1, which is information indicating the terminal device 1, and the corresponding authentication key. The authentication keys K1-1 to K1-5 are authentication keys for the terminal devices 1-1 to 1-5, respectively. The authentication key is generally not updated as frequently as the encryption key, and is updated in, for example, about 3 years. The update frequency of the authentication key is not limited to this example. The authentication key table is updated by, for example, an operator or the like when the terminal device 1 is installed. Therefore, the authentication key table stores the MAC address and the authentication key of the legitimate terminal device 1 that can enter the meter reading system of the present embodiment.

FIG. 6 is a diagram showing a configuration example of an encryption key table held by the key server 7. As shown in FIG. 6, the encryption key table held by the key server 7 includes the MAC address of the terminal device 1 which is information indicating the terminal device 1 and the corresponding encryption key. The encryption keys C1-1 to C1-5 are encryption keys of the terminal devices 1-1 to 1-5, respectively. The encryption key is updated periodically as described above.

In the present embodiment, when the authentication processing unit 62 of the authentication server 6 receives an authentication request from the terminal device 1, the authentication result, that is, whether the authentication succeeds or fails is recorded in the storage unit 66 as an authentication log. FIG. 7 is a diagram showing an example of an authentication log. As shown in FIG. 7, the authentication log includes an authentication time (described as a time in FIG. 7), information indicating a terminal device, and an authentication result. The authentication log held by the authentication server 6, that is, the authentication log stored in the storage unit 66 is the first authentication log.

Here, in the topology information, an example in which the MAC address is used as the identification information for identifying the terminal device 1 and the aggregation device 2 is shown, but the identification information for identifying the terminal device 1 and the aggregation device 2 is MAC. The identification information is not limited to the address and may be device-specific identification information. When a device other than the MAC address is used as the identification information, the authentication server 6 maintains the correspondence between the identification information and the MAC address. Similarly, in the authentication key table, the encryption key table, and the authentication log, identification information other than the MAC address may be used as the identification information.

FIG. 8 is a diagram showing a configuration example of the terminal device 1 of the present embodiment. As shown in FIG. 8, the terminal device 1 includes a communication unit 11, an authentication processing unit 12, an encryption processing unit 13, a control unit 14, and a storage unit 15. The communication unit 11 performs wireless communication with another terminal device 1 or an aggregation device 2. The authentication processing unit 12 performs authentication processing with the authentication server 6 in order to communicate with the central processing system 3. As described above, the authentication process is periodically performed every 24 hours while the terminal device 1 is activated. For example, the terminal device 1 holds a timer for measuring the cycle of performing the authentication process, and sends an authentication request to the authentication server 6 each time the timer expires. Further, the authentication process is also performed when the power of the terminal device 1 is turned on, when the terminal device 1 recovers from a communication failure, and the like. The details of the authentication process will be described later.

The encryption processing unit 13 generates a ciphertext by encrypting the plaintext which is the data to be transmitted to the central processing system 3 by using the encryption key stored in the storage unit 15, and the ciphertext is transmitted via the communication unit 11. Is transmitted to the central processing system 3. The data transmitted to the central processing system 3 includes the measurement result by a measuring meter (not shown) in the terminal device 1 or connected to the terminal device 1. The weighing result includes the amount of electric power used by the consumer in which the terminal device 1 is installed. Further, the weighing result may include the amount of power generated by the consumer in which the terminal device 1 is installed. Further, the weighing result may be obtained by subtracting the amount of power generation from the amount of electric power used by the consumer in which the terminal device 1 is installed. Further, the encryption processing unit 13 decodes the ciphertext received from the central processing system 3 via the communication unit 11 using the encryption key stored in the storage unit 15, and controls the plaintext data obtained by decryption. Hand over to department 14.

The control unit 14 controls the operation of the terminal device 1 according to the data received from the central processing system 3 via the encryption processing unit 13. For example, when the data received from the central processing system 3 requests the transmission of the weighing result, the measurement result by the weighing meter (not shown) is encrypted by the encryption processing unit 13 and transmitted to the central processing system 3. Instruct to do.

The storage unit 15 stores the authentication log, the authentication key, and the encryption key. The authentication key is an authentication key unique to the terminal device 1 and is stored in the storage unit 15 in advance. The authentication key matches the authentication key held by the key server 7. When the authentication key is updated, both the authentication key stored in the storage unit 15 of the terminal device 1 and the authentication key held by the key server 7 are updated. The encryption key is transmitted from the authentication server 6 in the process of the authentication process. When the authentication processing unit 12 receives the encryption key, the authentication processing unit 12 updates the encryption key stored in the storage unit 15 with the received encryption key.

FIG. 9 is a diagram showing an example of an authentication log held by the terminal device 1. As shown in FIG. 9, the authentication log held by the terminal device 1, which is the second authentication log, includes the time of authentication and the authentication result. In the example shown in FIG. 9, the times of the same authentication result are collectively shown in order to suppress the storage capacity. The authentication log held by the terminal device 1 is not limited to the example shown in FIG. 9, and may indicate the time and the authentication result for each authentication, or may be in another format.

The hardware configuration of the terminal device 1 will be described. The communication unit 11 is realized by a communication circuit, the authentication processing unit 12, the encryption processing unit 13, and the control unit 14 are realized by a processing circuit, and the storage unit 15 is realized by a memory. The processing circuit may be a dedicated circuit or a control circuit including a processor and a memory.

FIG. 10 is a diagram showing a configuration example of the aggregation device 2 of the present embodiment. As shown in FIG. 10, the aggregation device 2 includes a communication unit 21, a control unit 22, and a storage unit 23. The communication unit 21 performs wireless communication with the terminal device 1. Further, the communication unit 21 communicates with the central processing system 3 via the network 5. The control unit 22 updates the topology information of the storage unit 23 based on the data received from the terminal device 1 directly connected to itself or via another terminal device 1 via the communication unit 21.

FIG. 11 is a diagram showing an example of topology information held by the aggregation device 2. As shown in FIG. 11, the topology information held by the aggregation device 2 includes information indicating the terminal device 1 and information indicating the relay terminal device 1. In the example shown in FIG. 11, assuming that the communication path is the same in the up direction and the down direction, the relay terminal device 1 is shown without distinguishing between the up direction and the down direction. Not limited to this, the aggregation device 2 may manage the terminal device 1 separately in the up direction and the down direction as topology information. The downlink communication path is designated by the aggregation device 2 according to the route control protocol. Therefore, the aggregation device 2 holds the communication path in the downlink direction for each terminal device 1. Regarding the upstream communication path, when each terminal device 1 relays the upstream data, the aggregation device 2 grasps the upstream communication path by sequentially adding its own identification information. You may do so. The aggregation device 2 may grasp the communication path in the upstream direction by collecting the information of the next node from each terminal device 1.

Next, the operation of this embodiment will be described. In the meter reading system of the present embodiment, the authentication server 6 performs authentication processing so that an unauthorized terminal device is not connected to the verification system. FIG. 12 is a chart diagram showing an example of the authentication processing procedure of the present embodiment. In the example shown in FIG. 12, an example in which authentication processing is performed according to RFC (Request For Comments) 5191 PANA (Protocol for carrying Authentication for Network Access) is shown. The authentication processing procedure is not limited to the example shown in FIG.

As shown in FIG. 12, the terminal device 1 transmits an authentication start request requesting the start of the authentication process to the aggregation device 2 (step S1). Next, the aggregation device 2 requests the terminal device 1 to acquire the information necessary for starting the authentication (step S2). The terminal device 1 transmits information necessary for starting authentication to the aggregation device 2 in response to the request in step S2 (step S3), and the aggregation device 2 returns a response (step S4). The terminal device 1 transmits an authentication request storing an authentication key to the aggregation device 2, and the aggregation device 2 transfers the authentication request to the authentication server 6 (step S5). The authentication request also includes the MAC address of the terminal device 1 that is the source, and the authentication server 6 acquires the authentication key of the terminal device 1 from the key server 7 based on the MAC address of the terminal device 1. Information is generated based on the acquired authentication key (step S6). The information generated at this time is information for which a correct calculation result cannot be obtained without a correct authentication key. As for this information and the processing using this information, those defined by RFC5191 PANA can be used, so detailed description thereof will be omitted.

The authentication server 6 transmits the generated information to the terminal device 1 via the aggregation device 2 (step S7). The terminal device 1 performs a calculation using the received information and the retained authentication key (step S8), and transmits the calculation result to the authentication server 6 via the aggregation device 2 (step S9). The authentication server 6 compares the received calculation result with the correct calculation result, determines that the authentication is successful if they match, and transmits a response notifying the authentication success to the terminal device 1 via the aggregation device 2 ( Step S10). If the authentication fails, the authentication server 6 notifies the terminal device 1 that the authentication has failed, and ends the authentication process. At this time, the authentication server 6 does not have to send a notification that the authentication has failed.

The terminal device 1 notified of the successful authentication requests the authentication server 6 to acquire the encryption key via the aggregation device 2 (step S11). The authentication server 6 acquires the encryption key corresponding to the terminal device 1 from the key server 7, and transmits the encryption key to the terminal device 1 via the aggregation device 2 (step S12). The terminal device 1 transmits a response to step S12 to the aggregation device 2 (step S13). The authentication process is carried out by the above procedure. In this process, the encryption key used for the encrypted communication between the terminal device 1 and the central processing system 3 is transmitted from the authentication server 6 to the terminal device 1. After that, the terminal device 1 performs encrypted communication with the central processing system 3.

Suppose that an unauthorized terminal disguised as a correct MAC address tries to connect to the verification system of the present embodiment. In this case, since the MAC address is correct, it is not possible to determine whether the terminal is an invalid terminal using the MAC address. FIG. 13 is a diagram showing an example in which an unauthorized terminal device is wirelessly connected. Note that FIG. 13 omits the illustration of the network 5, the central processing system 3, and the MDMS 4. In the example shown in FIG. 13, the unauthorized terminal device 8 is an unauthorized terminal device that is not a terminal device installed by the operator of the meter reading system. It is assumed that the unauthorized terminal device 8 is placed within a range in which it can communicate with the terminal device 1-8 by disguising the MAC address of the terminal device 1-5. Although the unauthorized terminal device 8 does not hold the authentication key held by the terminal device 1-5, there is a possibility that the authentication key is estimated by some method and the authentication process is attempted. If the authentication key is incorrect, the authentication server 6 determines that the authentication has failed. However, the unauthorized terminal device 8 changes the authentication key a plurality of times to perform the authentication process, so that the unauthorized terminal device 8 has the correct authentication key. There is a possibility that the authentication will be successful by sending. On the other hand, even if the terminal device 1 is correct, there is a possibility that authentication will fail due to a bit error or the like occurring in the communication path.

In the present embodiment, the authentication server 6 performs the determination process of the unauthorized terminal using the topology information, as will be described later, so that the unauthorized terminal device 8 can be determined as an unauthorized terminal in such a case. As shown in FIG. 13, the correct terminal device 1-5 corresponding to the MAC address used by the unauthorized terminal device 8 communicates with the aggregation device 2-2 via the terminal device 1-6. On the other hand, the unauthorized terminal device 8 communicates with the aggregation device 2-2 without going through the terminal device 1-6. Therefore, by using the topology information indicating the communication path, it can be determined that the unauthorized terminal device 8 is an unauthorized terminal device. If the unauthorized terminal device 8 is placed at a position that has the same communication path as the correct terminal device 1, the correct terminal device 1 and the unauthorized terminal device 8 have the same MAC address, so that interference occurs and communication is possible. It disappears. Therefore, in general, the unauthorized terminal device 8 that spoofes the MAC address has a different communication path from the correct terminal device 1 that has the correct MAC address that is the source of the spoofing.

FIG. 14 is a flowchart showing an example of the authentication processing procedure in the authentication server 6 of the present embodiment. As shown in FIG. 14, the authentication processing unit 62 of the authentication server 6 determines whether or not an authentication request has been received from the terminal device 1 (step S21). This authentication request corresponds to step S5 in FIG. If the authentication request has not been received from the terminal device 1 (step S21 No), step S21 is repeated.

When the authentication request is received from the terminal device 1 (step S21 Yes), the authentication processing unit 62 of the authentication server 6 confirms whether the MAC address of the requesting terminal device 1 stored in the authentication request is valid. (Step S22). Specifically, in step S22, when the authentication processing unit 62 receives the authentication request, the key server 7 transfers the authentication key corresponding to the MAC address of the terminal device 1 from which the authentication request is requested via the key acquisition unit 65. get. At this time, the key server 7 notifies the authentication server 6 that the authentication key is not registered when the MAC address of the terminal device 1 for which the acquisition of the authentication key is requested does not exist in the authentication key table, and the authentication key table. If there is a MAC address of the terminal device 1 for which the acquisition of the authentication key is requested, the authentication key is notified to the authentication server 6. When the authentication processing unit 62 of the authentication server 6 can acquire the authentication key from the key server 7, it determines that the MAC address of the request source is valid. On the other hand, when the key server 7 notifies that the authentication key is not registered, the authentication processing unit 62 of the authentication server 6 determines that the MAC address of the requesting terminal device 1 is not valid.

When it is determined in step S22 that the MAC address is valid (step S22 Yes), the authentication processing unit 62 generates information for authentication and transmits the information for authentication (step S23). The transmission of this information corresponds to steps S6 and S7 in FIG. The authentication processing unit 62 determines whether or not a correct calculation result has been received from the terminal device 1 that requested the authentication request (step S24). This calculation result is a result calculated by using the authentication key held by the terminal device 1 as described in step S8 of FIG. Therefore, if the correct authentication key is not held, the correct calculation result will not be obtained.

When the authentication processing unit 62 receives the correct calculation result from the terminal device 1 that is the requester of the authentication request (step S24 Yes), the authentication processing unit 62 notifies the terminal device 1 of the authentication success of the requester of the authentication request (step S25). Next, the authentication processing unit 62 determines whether or not the encryption key request requesting the acquisition of the encryption key has been received from the terminal device 1 from which the authentication request is requested (step S26), and if received (step S26 Yes). ), The encryption key is transmitted to the terminal device 1 (step S27), and the process is terminated. If the encryption key request is not received (step S26 No), step S26 is repeated. If the encryption key request is not received even after a certain period of time has elapsed from the execution of step S25, the process may be terminated.

On the other hand, if the MAC address is not valid (step S22 No), it is notified that the terminal is an unauthorized terminal, that is, that there is an unauthorized access (step S31), and the process is terminated. Notification of an unauthorized terminal may be performed, for example, by displaying a screen, by voice, or by sending an e-mail to a predetermined operator's e-mail address. It can be done in any way. Further, if the invalid MAC address is recorded and the number of times the authentication request using the same invalid MAC address is received exceeds the threshold value, the process proceeds to step S31 and the authentication request using the MAC address is received. If the number of times is less than the threshold value, the process may be terminated without performing step S31.

When the correct calculation result is not received in step S24 (step S24 No), the authentication processing unit 62 notifies the terminal device 1 of the authentication failure (step S28), and executes the unauthorized terminal determination process using the topology information. (Step S29). When the authentication processing unit 62 receives the correct result in step S24, it records in the authentication log of the storage unit 66 as authentication success, and when the authentication processing unit 62 does not receive the correct result in step S24, the authentication log of the storage unit 66 is recorded as authentication success. Record in.

FIG. 15 is a flowchart showing an example of the processing procedure of the fraudulent terminal determination process in step S29. First, the authentication processing unit 62 confirms the communication path of the terminal device 1 from which the authentication request is requested (step S41). Here, it is assumed that the data transmitted from the terminal device 1 stores information indicating the communication path of this data, that is, the relayed terminal device 1 and the aggregation device 2. Therefore, the authentication processing unit 62 can confirm the communication path of the terminal device 1 from which the authentication request is requested by extracting the information indicating the communication path from the authentication request received from the terminal device 1.

The authentication processing unit 62 determines whether or not the communication path, specifically, the communication path of the terminal device 1 from which the authentication request is requested is correct (step S42). Specifically, the authentication processing unit 62 extracts information indicating the aggregation device 2 corresponding to the terminal device 1 from which the authentication request is requested and the relay terminal device 1 from the topology information stored in the storage unit 66. The authentication processing unit 62 determines whether or not the communication path is correct based on whether or not the extracted information and the communication path of the terminal device 1 that is the request source of the authentication request match. The communication path is also information indicating the connection position of the terminal device 1 in the wireless multi-hop network. In the present embodiment, when it is determined that the unauthorized terminal is an unauthorized terminal in the unauthorized terminal determination process, it is determined that the authentication request from the unauthorized terminal is an unauthorized access. As a result, unauthorized access can be detected by determining that the terminal is an unauthorized terminal in the unauthorized terminal determination process. That is, the authentication processing unit 62 of the present embodiment acquires the topology information from the storage unit 66, and obtains the connection position in the multi-hop network of the terminal device 1 from which the data is transmitted based on the data received from the terminal device 1. , Performs detection processing to detect unauthorized access based on the obtained connection position and topology information.

Next, when the communication path is correct (step S42 Yes), the authentication processing unit 62 determines that the terminal is not an unauthorized terminal (step S43), and when the communication path is incorrect (step S42 No), determines that the terminal is an unauthorized terminal. (Step S44), the unauthorized terminal determination process is terminated.

As described above, in the example shown in FIG. 15, the authentication processing unit 62 extracts the identification information of the device that relays the authentication request from the authentication request, and the extracted identification information and the identification information of the relay device included in the topology information. If the above matches, authentication using the authentication key commonly held with the legitimate terminal device 1 is performed. On the other hand, the authentication processing unit 62 determines that the access is unauthorized when the extracted identification information and the identification information of the relay device included in the topology information do not match.

Returning to the description of FIG. When it is determined as an unauthorized terminal by the unauthorized terminal determination process in step S29 (step S30 Yes), the authentication processing unit 62 advances the process to step S31. When it is determined that the terminal is not an unauthorized terminal by the unauthorized terminal determination process in step S29 (step S30 No.), the authentication processing unit 62 ends the process.

In the above description, whether or not the communication path is correct is determined based on whether or not the entire communication path, that is, the relay terminal device 1 and the aggregation device 2 are correct, but a part of the communication path. May be used to determine whether the communication path is correct or not. That is, if the authentication processing unit 62 determines whether or not the communication path is correct by using one or more of the terminal device 1 and the aggregation device 2 which are the communication paths between the terminal device 1 and the central processing system 3. good. For example, it may be determined whether or not the communication path is correct depending on whether or not the aggregation device 2 that passes through is correct. Alternatively, the authentication processing unit 62 defines the aggregation device 2 to be passed through and the terminal device 1 selected from the relay terminal device 1 stored in the topology information, and the terminal device from which the authentication request is requested. If the communication path of 1 goes through these two, it may be determined that the communication path is correct.

Further, as a judgment as to whether or not the communication path is correct, the terminal device capable of relaying using the geographical position where the terminal device 1 is arranged and the communicable range is used instead of using the topology information shown in FIG. 1 may be determined. Generally, since the business operator knows the geographical position where the terminal device 1 is arranged, this information is stored in the storage unit 66 of the authentication server 6 as equipment information. The range in which the terminal device 1 can communicate can be roughly determined by the specifications of the terminal device 1. FIG. 16 is a diagram showing an example of an estimated value of the communicable range of the terminal device 1-6. As shown in FIG. 16, the authentication processing unit 62 estimates a wireless communication range 9 based on the frequency band and transmission power used in the wireless communication of the terminal device 1 centering on the geographical position of the terminal device 1-6. do. Then, the authentication processing unit 62 searches for the terminal device 1 arranged within this range 9 from the equipment information, and determines in advance as a relay candidate terminal device. In the example shown in FIG. 16, the terminal devices 1-5, 1-7, 1-8 are arranged within the range 9. The data transmitted from the terminal device 1-6 should always arrive at the authentication server 6 via at least one of the terminal devices 1-5, 1-7, 1-8.

On the other hand, it is highly possible that the terminal device disguised as the MAC address of the terminal device 1-6 does not go through the terminal devices 1-5, 1-7, 1-8. Therefore, by obtaining the range 9 for each terminal device 1 and predetermining the terminal device 1 existing in the range 9 as the relay candidate terminal device, the authentication request that does not go through any of the relay candidate terminal devices is received. In this case, it can be determined that the communication path of the requesting terminal device is not correct. Even if the terminal device 1 is correct, the communication path may be changed due to a communication failure or the like, and the communication path may be temporarily different from the communication path held by the authentication server 6. By defining the relay candidate terminal device based on the geographical position, it is possible to prevent the correct terminal device 1 from being erroneously determined as an unauthorized terminal in such a case.

In the example shown in FIG. 14, when authentication fails, that is, when No is determined in step S24, an unauthorized terminal determination process, which is a detection process for detecting unauthorized access using topology information, is performed. However, if the number of consecutive authentication failures is equal to or greater than the threshold value, the unauthorized terminal determination process may be executed. That is, the authentication processing unit 62 performs fraudulent terminal determination processing when the number of consecutive failures using the authentication key commonly held with the legitimate terminal device 1 exceeds the threshold value. It may be carried out. The threshold is one or more times. If the MAC address is spoofed, as described above, the unauthorized terminal device does not hold the correct authentication key, so there is a possibility that the authentication key will be changed and authentication will be attempted multiple times. There is a possibility that authentication will fail due to a communication error or the like due to a legitimate access from a legitimate terminal device 1. If the threshold value is set to a plurality of times, the possibility of performing the unauthorized terminal determination process at the time of legitimate access can be reduced, and the processing load can be reduced.

FIG. 17 is a flowchart showing another example of the processing procedure of the fraudulent terminal determination process in step S29. The authentication processing unit 62 transmits a request for acquiring an authentication log to the terminal device 1 using a downlink communication path to the terminal device 1 (step S51). Specifically, the authentication processing unit 62 designates a downlink communication path, that is, a relaying aggregation device 2 and a terminal device 1 based on the topology information of the storage unit 66, and sends an authentication log acquisition request to the terminal device 1. Send. The terminal device 1 transmits the authentication log acquisition request stored in the storage unit 15 to the authentication server 6.

The authentication processing unit 62 compares the authentication log received from the terminal device 1 with the authentication log held by itself (step S52). For example, it is assumed that the authentication processing unit 62 fails to authenticate the terminal device 1-5 at time t3, as shown in FIG. The authentication processing unit 62 acquires an authentication log from the terminal device 1-5 in step S51. The authentication processing unit 62 confirms whether the authentication log received from the terminal device 1-5 contains the information that the authentication at time t3 has failed. In general, it is assumed that the terminal device 1 and the authentication server 6 perform time synchronization by an arbitrary time synchronization method. However, since the authentication time recognized by the terminal device 1 and the authentication time stored in the authentication server 6 may not completely match due to processing, transmission delay, or the like, the authentication server 6 may start from the terminal device 1. The time may be corrected and compared by adding a certain time to the acquired authentication time. Further, even if the correction is performed, it is possible that the two times do not completely match. Therefore, if the time difference between the two is less than or equal to the specified time, for example, about 1 to 5 minutes, the authentication times match. You may judge that.

When the authentication log received from the terminal device 1 and the authentication log held by itself match (step S53 Yes), the authentication processing unit 62 determines that the terminal is not an unauthorized terminal (step S54), and performs an unauthorized terminal determination process. finish. When the authentication log received from the terminal device 1 and the authentication log held by itself do not match (step S53 No), the authentication processing unit 62 determines that the terminal is an unauthorized terminal (step S55), and performs an unauthorized terminal determination process. finish. In the present embodiment, when it is determined that the unauthorized terminal is an unauthorized terminal in the unauthorized terminal determination process, it is determined that the authentication request from the unauthorized terminal is an unauthorized access. That is, the unauthorized terminal determination process is a detection process for detecting unauthorized access.

As described above, in the example shown in FIG. 17, the authentication processing unit 62 stores the address of the terminal device, the authentication time, and the authentication result in the storage unit 66 every time the terminal device is authenticated. Record as. The authentication processing unit 62 extracts the source address, which is the address of the terminal device of the data transmission source, from the data, and extracts the identification information of the relay device corresponding to the source address from the topology information. The authentication processing unit 62 requests the acquisition of the second authentication log, which is the information recording the past authentication results in the terminal device, to the source address by the communication path based on the extracted identification information of the relay device. If the authentication log of 2 and the authentication log of the first do not match, it is determined that the access is unauthorized.

In the notification that the terminal is an unauthorized terminal in step S31 shown in FIG. 14, the factor determined to be an unauthorized terminal may also be notified. That is, the authentication server 6 may separately notify whether the MAC address is determined to be invalid or whether the MAC address is correctly determined to be invalid by the unauthorized terminal determination process using the topology information. The operator who detects the notification that the terminal is an unauthorized terminal identifies the location where the unauthorized terminal device is considered to exist by specifying the communication path from the data transmitted from the terminal device determined to be the unauthorized terminal. However, on-site surveys may be conducted based on the specified locations.

In the above-mentioned example, when the authentication fails, the fraudulent terminal determination process based on the topology information is executed, but the trigger for executing the fraudulent terminal determination process based on the topology information is not limited to this example. For example, when the terminal device 1 receives data to be transferred from another terminal device to the aggregation device 2, the format of this data is different from the defined format, or when some abnormality is detected in the received data. An abnormality may be notified to the authentication server 6 together with the MAC address of the terminal device from which the data is transmitted. Then, when the authentication server 6 receives the notification of the abnormality, the authentication server 6 may perform the unauthorized terminal determination process based on the topology information based on the data received from the terminal of the notified MAC address.

Further, the unauthorized terminal determination process based on the topology information may be periodically performed. In the meter reading system, the business operator who originally constructs the meter reading system charges electricity charges based on the measurement result received from the terminal device 1, so that the terminal device 1 is correctly linked to the customer who contracts with the business operator. Need to be. The installation position of the terminal device 1 is usually fixed except when the terminal device 1 is moved under the control of the business operator due to relocation or the like. On the other hand, the terminal device 1 is removed from the original installation position by an unauthorized user, that is, a place in the consumer where the terminal device 1 is installed by the business operator, and is installed in another place by the unauthorized user. Injustice such as In such a case, since the terminal device 1 itself is a legitimate terminal device and holds a correct authentication key, it may pass the authentication process. If the authentication process is passed, the original consumer corresponding to the terminal device 1 will be charged the amount of electric power used by the unauthorized user.

FIG. 18 is a diagram showing an example in which the terminal device 1-7 is illegally removed. In the example shown in FIG. 18, the correct position installed by the operator is the position where wireless connection is possible to the terminal device 1-8 shown by the broken line. In this case, it is assumed that the terminal device 1-7 is illegally removed, moved to a different position, and installed in a position where it can be wirelessly connected to the terminal device 1-4. In this case, since the terminal device 1-7 has the correct MAC address and the correct authentication key, if an authentication request is made to the authentication server 6 via the terminal device 1-4, the authentication succeeds. there is a possibility. In the present embodiment, as described above, the authentication server 6 can determine that the communication path, that is, the connection position of the terminal device 1-7 is not correct by performing the determination process of the unauthorized terminal using the topology information. In such a case, the terminal device 1-7 can be detected as an unauthorized terminal. In this case, there is a possibility that the authentication will succeed. Therefore, when the authentication fails, not only the unauthorized terminal determination process using the topology information is performed, but also the periodical execution, etc., is related to the authentication. If the fraudulent terminal determination process using the topology information is performed at no timing, the detection accuracy of the fraudulent terminal can be further improved.

Further, the authentication process itself may include an unauthorized terminal determination process using topology information. That is, not only the authentication key and MAC address are correct, but also when it is determined that the communication path is correct based on the topology information, it may be determined that the authentication is successful. FIG. 19 is a flowchart showing an example of an authentication procedure when a determination using topology information is included in the authentication process. Step S21 is the same as step S21 shown in FIG.

After step S21, the authentication processing unit 62 of the authentication server 6 confirms whether the MAC address and communication path of the requesting terminal device 1 stored in the authentication request are valid (step S22a). Confirmation of whether the MAC address is valid is the same as in step S22 of FIG. Confirmation of whether the communication path is valid is the same as in step S41 and step S42 in FIG.

When the MAC address and the communication path are valid (step S22a Yes), the authentication processing unit 62 performs the processing after step S23. If at least one of the MAC address and the communication path is not valid (step S22a No), the authentication processing unit 62 performs the process of step S31. The processing of steps S23 to S31 is the same as the example of FIG.

Not limited to the example shown in FIG. 19, for example, step S22 of FIG. 14 is performed instead of step S22a, and in the case of Yes in step S24, it is determined whether or not the communication path is correct, and the communication path is determined. If is correct, the process may proceed to step S25.

As described above, in the present embodiment, it is determined whether or not the terminal device from which the authentication request is requested is invalid based on the topology information indicating the correct connection position of the terminal device 1 in the wireless multi-hop network. I made it. Therefore, it is possible to detect unauthorized access that cannot be determined by the address, such as when the MAC address is spoofed. Further, even when the terminal device 1 is illegally relocated, the illegally relocated terminal device 1 can be determined to be an unauthorized terminal.

The configuration shown in the above-described embodiment shows an example of the content of the present invention, can be combined with another known technique, and is one of the configurations as long as it does not deviate from the gist of the present invention. It is also possible to omit or change the part.

1,1-1 to 1-11 Terminal equipment, 2,2-1,2-2 Aggregation equipment, 3 Central processing system, 4 MDMS, 5 Network, 6 Authentication server, 7 Key server, 11,61,71 Communication unit , 12,62 Authentication processing unit, 13,63 encryption processing unit, 14,72 control unit, 15,66,73 storage unit, 64 collection management unit, 65 key acquisition unit.

Claims (5)

A central processing unit that can be connected to a multi-hop network.
The multi-hop network of the terminal device that is the source of the data is obtained based on the data received from the terminal device by acquiring the topology information indicating the legitimate connection position of the legitimate terminal device constituting the multi-hop network in the multi-hop network. An authentication processing unit that obtains the connection position in the above and performs detection processing to detect unauthorized access based on the obtained connection position and the topology information.
Equipped with
The authentication processing unit executes the detection process when the number of consecutive failures using the authentication key commonly held with the legitimate terminal device exceeds the threshold value.
The topology information includes, for each legitimate terminal device, identification information of a relay device which is a device for relaying communication between the address of the legitimate terminal device and the central processing unit.
Each time the authentication processing unit authenticates the terminal device, the address of the terminal device, the time of authentication, and the authentication result are recorded as a first authentication log, and the address of the terminal device from which the data is transmitted is recorded from the data. The source address is extracted, the identification information of the relay device corresponding to the source address is extracted from the topology information, and the communication path is addressed to the source address by the communication path based on the extracted identification information of the relay device. Therefore, the terminal device requests the acquisition of the second authentication log, which is the information recording the past authentication results, and if the second authentication log and the first authentication log do not match, it is determined as unauthorized access. A central processing device characterized by the fact that. The multi-hop network includes the legitimate terminal device and an aggregate device that aggregates data transmitted from the legitimate terminal device.
The central processing unit according to claim 1 , wherein the relay device is the aggregation device. The first aspect of the present invention is characterized in that the plurality of relay devices is a plurality of, and the plurality of relay devices are an aggregation device for aggregating data transmitted from the legitimate terminal device and one or more of the legitimate terminal devices. The central processing unit described. Smart meters that make up a multi-hop network and
A central processing unit that can be connected to the multi-hop network and collects the weighing results weighed by the smart meter.
Equipped with
The central processing unit
The topology information indicating the legitimate connection position of the smart meter in the multi-hop network is acquired, the connection position of the device from which the data is transmitted is obtained in the multi-hop network based on the received data, and the obtained connection position and the said Authentication processing unit that performs detection processing to detect unauthorized access based on topology information,
Equipped with
The authentication processing unit executes the detection process when the number of consecutive failures using the authentication key commonly held with the legitimate smart meter exceeds the threshold value.
The topology information includes, for each legitimate smart meter, identification information of a relay device which is a device for relaying communication between a legitimate address of the smart meter and the central processing unit.
Each time the smart meter is authenticated, the authentication processing unit records the address of the smart meter, the time of authentication, and the authentication result as a first authentication log, and from the data, the address of the smart meter from which the data is transmitted. The source address is extracted, the identification information of the relay device corresponding to the source address is extracted from the topology information, and the communication path is addressed to the source address by the communication path based on the extracted identification information of the relay device. Therefore, the smart meter requests the acquisition of the second authentication log, which is the information recording the past authentication results, and if the second authentication log and the first authentication log do not match, it is determined as unauthorized access. A meter reading system characterized by this. An unauthorized access detection method for central processing units that can connect to multi-hop networks.
An acquisition step in which the central processing unit acquires topology information indicating a legitimate connection position in the multi-hop network of legitimate terminal devices constituting the multi-hop network.
A detection step of finding a connection position in a multi-hop network of a terminal device that is a source of the data based on the data received from the terminal device and detecting unauthorized access based on the obtained connection position and the topology information.
Including
When the number of consecutive failures using the authentication key commonly held with the legitimate terminal device exceeds the threshold value, the detection step is executed.
The topology information includes, for each legitimate terminal device, identification information of a relay device which is a device for relaying communication between the address of the legitimate terminal device and the central processing unit.
In the detection step, each time the terminal device is authenticated, the address of the terminal device, the time of authentication, and the authentication result are recorded as a first authentication log, and the address of the terminal device from which the data is transmitted is used from the data. A certain source address is extracted, the identification information of the relay device corresponding to the source address is extracted from the topology information, and the communication path is addressed to the source address by a communication path based on the extracted identification information of the relay device. Requests the acquisition of a second authentication log, which is information recording past authentication results in the terminal device, and determines that unauthorized access is made when the second authentication log and the first authentication log do not match. An unauthorized access detection method characterized by.

Images