JP7058687B2 - Systems, communication devices, programs, and communication methods - Google Patents

Description

The present invention relates to systems, communication devices, programs, and communication methods.

A cloud service that provides a part or all of the functions by a cloud computing system has been known (see, for example, Patent Document 1).
[Prior Art Document]
[Patent Document]
[Patent Document 1] Japanese Unexamined Patent Publication No. 2019-101884

According to the first aspect of the present invention, the system is provided. The system may include a communication device and an application. The communication device may have a key information transmitter that transmits key information to an application on the cloud. The communication device has a device ID receiver that transmits the key information to the management system that receives and stores the key information from the application and receives the device ID assigned to the communication device by the management system. It's okay. The communication device may have a token generator that generates an authentication token. The communication device may have a token transmitter that sends an authentication token to the management system. It may have a data acquisition unit for acquiring data. It may have a data transmitter that sends data, device IDs, and authentication tokens to the application. The application may have a data receiver that receives data, device IDs, and authentication tokens from the communication device. The application may have an authentication result acquisition unit that transmits the device ID and the authentication token to the management system and acquires the authentication result of the device ID and the authentication token. The application may have a data management unit that manages data based on the authentication result.

The communication device has a storage unit including a security area for which security measures are taken, and at least one of the device ID and the authentication token may be stored in the security zone. The communication device may store the device ID and the authentication token in the security zone. The storage unit may include the security area and the non-security area, and the security area is virtually separated from the non-security area, and access from the non-security area is restricted. good. The storage unit may include the security area and the non-security area, and the security area may be an area that is virtually separated from the non-security area and in which the secure OS is operating. The communication device includes a normal area and a secure area, and at least one of the device ID and the authentication token may be stored in the secure area. The communication device may store the device ID and the authentication token in the secure area. The token generation unit may set an expiration date for the generated authentication token and update the authentication token based on the expiration date. The communication device may be an IoT device, and the token transmission unit may transmit the authentication token to the management system according to LwM2M. The communication device may be capable of transmitting a plurality of types of data, and the system includes a type information receiving unit that receives type information indicating the types of data that the communication device can transmit from the communication device, and the above. A determination unit that determines the cloud service of the destination of each of the plurality of types of data based on the type information, and a registration control that causes the communication device to register the cloud service determined by the determination unit for the application. It may be equipped with a part.

According to the second aspect of the present invention, a communication device is provided. The communication device may include a key information transmitter that transmits key information to an application on the cloud. The communication device includes a device ID receiver that transmits the key information to the management system that receives and stores the key information from the application and receives the device ID assigned to the communication device by the management system. good. The communication device may include a token generator that generates an authentication token. The communication device may include a token transmitter that sends an authentication token to the management system. The communication device may include a data acquisition unit for acquiring data. The communication device may include a data transmitter that sends data, a device ID, and an authentication token to the application.

According to the third aspect of the present invention, a program for making a computer function as the communication device is provided.

According to a fourth aspect of the present invention, a communication method performed by a computer is provided. The communication method may include a key information transmission stage for transmitting key information to an application on the cloud. The communication method includes a device ID receiving stage in which the key information is transmitted to the management system that receives and stores the key information from the application, and the device ID assigned to the communication device by the management system is received. good. The communication method may include a token generation step of generating an authentication token. The communication method may include a token transmission step of transmitting the authentication token to the management system. The communication method may include a data acquisition stage for acquiring data. The communication method may comprise a data transmission step of transmitting data, a device ID, and an authentication token to the application.

The outline of the above invention does not list all the necessary features of the present invention. A subcombination of these feature groups can also be an invention.

An example of the system 10 is shown schematically. An example of the processing flow in the system 10 is shown schematically. An example of the functional configuration of the communication device 100 is schematically shown. An example of the system configuration of the communication device 100 is shown schematically. An example of the functional configuration of the application 200 is shown schematically. An example of the functional configuration of the management system 300 is shown schematically. An example of the hardware configuration of the computer 1200 that functions as the execution device of the communication device 100 or the application 200 is schematically shown.

Hereinafter, the present invention will be described through embodiments of the invention, but the following embodiments do not limit the invention within the scope of the claims. Also, not all combinations of features described in the embodiments are essential to the means of solving the invention.

FIG. 1 schematically shows an example of the system 10. The system 10 includes a communication device 100 and an application 200.

The communication device 100 has a function of acquiring and uploading any kind of data. The communication device 100 includes, for example, an arbitrary type of sensor, and uploads data detected by the sensor. The communication device 100 may be a so-called IoT (Internet Of Thing) device.

The communication device 100 may upload data to the application 200 on the cloud 20. The communication device 100 may access the cloud 20 via the mobile communication network. The communication device 100 may comply with any of a 3G (3rd Generation) communication method, an LTE (Long Term Evolution) communication method, a 5G (5th Generation) communication method, and a communication method after the 6G (6th Generation) communication method. good. The communication device 100 may access the cloud 20 via a radio base station and a Wi-Fi® access point. The communication device 100 may access the cloud 20 by wired communication.

The application 200 is realized on the cloud 20. The application 200 can be executed by the devices and systems constituting the cloud 20. The application 200 may be realized in any cloud environment on the cloud 20. For example, the application 200 is realized on a managed cloud environment such as Microsoft Azure, GCP (Google Cloud Platform), AWS (Amazon Web Services), and the like.

The application 200 receives and manages data from the communication device 100. Conventionally, an application realized on the cloud 20 can receive and manage data from a communication device 100, but cannot confirm the validity of the communication device 100. Therefore, it was difficult to ensure the reliability of the data. In the system 10 according to the present embodiment, the validity of the communication device 100 is ensured by using the management system 300 that manages the devices.

The management system 300 has an authentication function for authenticating the communication device 100. The management system 300 provides, for example, the service of Pelion Device Management.

FIG. 2 schematically shows an example of the processing flow in the system 10. Here, a flow in which the communication device 100 is newly registered and data is uploaded will be described.

In step 102 (the step may be abbreviated as S) 102, the communication device 100 transmits an Enroll Key to the application 200. The Enroll Key is an example of key information that differs for each communication device 100. For example, the purchaser of the communication device 100 confirms the Enroll Key assigned to the communication device 100, inputs the Enroll Key to the communication device 100, and transmits the Enroll Key to the application 200.

In S104, the application 200 transmits the Enroll Key received in S102 to the management system 300 and registers it. The management system 300 stores the received Enroll Key.

In S106, the communication device 100 connects to the management system 300 by using the Enroll Key. The management system 300 authenticates the Enroll Key received from the communication device 100. The management system 300 determines that authentication is possible if the Enroll Key received from the communication device 100 matches any of the Enroll Keys received and stored from the application 200, and if they do not match any of them, the management system 300 determines that authentication is possible. It may be determined that the authentication is not possible. Here, the description will be continued assuming that it is determined that authentication is possible.

In S108, the management system 300 assigns a device ID to the communication device 100 and transmits the device ID to the communication device 100. The device ID is an ID that allows the management system 300 to uniquely identify the communication device 100.

In S110, the communication device 100 stores the device ID received from the management system 300 and generates an authentication token. The authentication token is, for example, a random number string. The communication device 100 may store the device ID and the authentication token in a security area included in the storage unit of the communication device 100 and having security measures.

The communication device 100 transmits the generated authentication token to the management system 300. The management system 300 registers the device ID assigned to the communication device 100 in association with the authentication token received from the communication device 100.

In S112, the communication device 100 transmits the data detected by the sensor, the device ID received in S108, and the authentication token generated in S110 to the application 200. In S114, the application 200 transmits the device ID and the authentication token received in S112 to the management system 300.

The management system 300 authenticates the device ID and the authentication token received in S114. When the combination of the device ID and the authentication token is registered, the management system 300 determines that authentication is possible, and when it is not registered, it determines that authentication is not possible. In S116, the management system 300 transmits the authentication result to the application 200.

When the authentication result is authenticationable, the application 200 registers the data in association with the device ID. When the authentication result is authentication / rejection, the application 200 discards the data and notifies the administrator of the application 200 that the authentication is rejected.

As described above, by using the management system 300, the validity of the communication device 100 can be guaranteed, and the reliability of the data can be guaranteed. In particular, in addition to using the management system 300, the communication device 100 is configured to store the authentication token and the device ID in the security area, thereby greatly enhancing the legitimacy of the communication device 100 and the reliability of the data. Can be done.

FIG. 3 schematically shows an example of the functional configuration of the communication device 100. The communication device 100 includes a key information acquisition unit 102, an application communication unit 104, a system communication unit 106, a storage unit 108, an authentication token generation unit 110, and a data acquisition unit 112.

The key information acquisition unit 102 acquires the key information. The key information acquisition unit 102 acquires, for example, the Enroll Key. The key information acquisition unit 102 may acquire the Enroll Key input by the user or the like of the communication device 100 by using the input device included in the communication device 100.

The application communication unit 104 communicates with the application 200. The application communication unit 104 transmits, for example, the key information acquired by the key information acquisition unit 102 to the application 200. The application communication unit 104 may be an example of a key information transmission unit.

The system communication unit 106 communicates with the management system 300. For example, the system communication unit 106 transmits the key information acquired by the key information acquisition unit 102 to the management system 300, and receives the device ID assigned to the communication device 100 by the management system 300 from the management system 300. The system communication unit 106 may be an example of a device ID receiving unit. The system communication unit 106 stores the received device ID in the storage unit 108.

The storage unit 108 includes a non-security area and a security area to which security measures are taken. The system communication unit 106 may store the device ID in the security area of the storage unit 108.

The security area may be an area that is virtually separated from the non-security area and access from the non-security area is restricted. The security area may be an area where access from the non-security area is restricted by the Security API (Application Programming Interface). The security area is virtually separated from the non-security area, and may be an area in which a secure OS (Operating System) is operating. The security area may be a hardware-encrypted area.

The storage unit 108 may include a normal area and a secure area. The normal area may be called Non-sure World, and the secure area may be called Security World. The communication device 100 may store the device ID in the secure area. The communication device 100 may store the authentication token in the secure area.

The authentication token generation unit 110 generates an authentication token. The authentication token generation unit 110 may generate an authentication token using any known technique. The authentication token generation unit 110 generates, for example, an authentication token of a random number string generated by a random number.

The authentication token generation unit 110 stores the generated authentication token in the storage unit 108. The authentication token generation unit 110 may store the authentication token in the security area of the storage unit 108.

The authentication token generation unit 110 may set an expiration date for the generated authentication token. For example, the authentication token generation unit 110 sets the authentication token as an expiration date after a predetermined period after the authentication token is generated.

The authentication token generation unit 110 may update the authentication token based on the expiration date. For example, the authentication token generation unit 110 monitors the expiration date of the generated authentication token and updates the authentication token that has reached the expiration date.

The system communication unit 106 transmits the authentication token generated by the authentication token generation unit 110 to the management system 300. The system communication unit 106 may be an example of a token transmission unit. When the communication device 100 is an IoT device, the system communication unit 106 may transmit the authentication token to the management system 300 according to LwM2M.

The data acquisition unit 112 acquires the data to be uploaded. The data acquisition unit 112 acquires, for example, the data detected by the sensor included in the communication device 100. The data acquisition unit 112 may receive data detected by an external sensor from the sensor.

The application communication unit 104 transmits the data acquired by the data acquisition unit 112 and the device ID and authentication token stored in the storage unit 108 to the application 200. The application communication unit 104 may be an example of a data transmission unit.

The application communication unit 104 may transmit the data, the device ID, and the authentication token to the application 200 each time the data acquisition unit 112 acquires the data. Further, the application communication unit 104 may transmit data, a device ID, and an authentication token to the application 200 according to a predetermined schedule. For example, at the end of the day, the application communication unit 104 transmits the data acquired by the data acquisition unit 112 during the day, the device ID, and the authentication token to the application 200.

FIG. 4 schematically shows an example of the system configuration of the communication device 100. The communication device 100 exemplified in FIG. 4 includes a HW (HardWare) 120, a mbed OS122, a mbed TLS (Transport Layer Security) 124, an external connection SD (Software Development Kit) 126, a Perion Client 128, and a Secre.

The external connection SDK 126 communicates with the application 200 by the secure communication provided by the mbed TLS124. The external connection SDK 126 may be an example of the application communication unit 104.

The Pelion Client 128 communicates with the management system 300 by the secure communication provided by the TLS 124. The Pelion Client 128 may be an example of the system communication unit 106.

The Security Zone 130 is an example of a security area. The external connection SDK 126 and Pelion Client 128 store data in the Secure Zone 130 or acquire data from the Secure Zone 130 via the Secure API 132.

FIG. 5 schematically shows an example of the functional configuration of the application 200. The application 200 includes a key information acquisition unit 202, a key information registration unit 204, a storage unit 206, a system communication unit 208, a data reception unit 210, an authentication execution unit 212, and a data management unit 214.

The key information acquisition unit 202 acquires the key information. The key information acquisition unit 202 receives the key information from the application 200.

The key information registration unit 204 registers the key information acquired by the key information acquisition unit 202. The key information registration unit 204 stores the key information acquired by the key information acquisition unit 202 in the storage unit 206.

The system communication unit 208 communicates with the management system 300. The system communication unit 208 transmits the key information to the management system 300 according to the instruction from the key information registration unit 204.

The data receiving unit 210 receives data, a device ID, and an authentication token from the communication device 100. The authentication execution unit 212 executes authentication of the data, the device ID, and the authentication token received by the data reception unit 210. The authentication execution unit 212 transmits the device ID and the authentication token to the management system 300 via the system communication unit 208, and acquires the authentication result of the device ID and the authentication token.

The data management unit 214 manages the data received by the data receiving unit 210 based on the authentication result acquired by the authentication executing unit 212. When the authentication result is authenticationable, the data management unit 214 stores the data in the storage unit 206 in association with the device ID. When the authentication result is authentication failure, the data management unit 214 discards the data and notifies the administrator of the application 200 that the authentication is failure.

FIG. 6 schematically shows an example of the functional configuration of the management system 300. The management system 300 includes a storage unit 302, a key information registration unit 304, an authentication execution unit 306, a type information reception unit 312, a determination unit 314, and a registration control unit 316. It is not always essential that the management system 300 includes all of these.

The key information registration unit 304 registers the key information. The key information registration unit 304 may store the key information received from the application 200 in the storage unit 302.

The authentication execution unit 306 executes various authentications. When the authentication execution unit 306 receives the key information from the communication device 100, the authentication execution unit 306 may authenticate the communication device 100 with the key information. The authentication execution unit 306 determines that authentication is possible if the key information received from the communication device 100 matches any of the key information stored in the storage unit 302, and if they do not match any of the key information, the authentication is rejected. You may judge. When the authentication execution unit 306 determines that authentication is possible, it assigns a device ID to the communication device 100 and transmits the device ID to the communication device 100. Then, the authentication execution unit 306 receives the authentication token from the communication device 100. The authentication execution unit 306 may store the device ID assigned to the communication device 100 and the authentication token received from the communication device 100 in the storage unit 302 in association with each other.

Further, when the authentication execution unit 306 receives the device ID and the authentication token from the application 200, the authentication execution unit 306 may authenticate the device ID and the authentication token. When the combination of the device ID and the authentication token received from the application 200 matches any of the combinations of the device ID and the authentication token stored in the storage unit 302, the authentication execution unit 306 determines that authentication is possible, and both of them. If they do not match, it may be determined that the authentication is not possible. The authentication execution unit 306 notifies the application 200 of the authentication result.

The type information receiving unit 312 receives type information indicating the types of data that can be transmitted by the communication device 100 from the communication device 100 that can transmit a plurality of types of data. Examples of data types include, but are not limited to, still image data, moving image data, position information, temperature, and the like, and any type can be handled.

The determination unit 314 determines the cloud service of each transmission destination of the plurality of types of data based on the type information received by the type information receiving unit 312. The determination unit 314 determines, for example, the cloud service of each transmission destination of the plurality of types of data by referring to the determination information in which the data type and the cloud service are associated with each other. The determination information may be stored in the storage unit 302 in advance. The determination information is generated according to the instructions of, for example, the administrator of the system 10 and the administrator of the management system 300.

The registration control unit 316 causes the communication device 100 to execute registration for the application 200 of the cloud service determined by the determination unit 314. The registration control unit 316 may cause the communication device 100 to execute the registration by transmitting the registration instruction to be registered in the application 200 of the designated cloud service to the communication device 100.

For example, the communication device 100 can transmit the first type data, the second type data, and the third type data, and the determination unit 314 sets the transmission destination of the first type data. When it is determined that the application 200 of 1 and the destination of the second type of data are the second application 200 and the destination of the data of the third type is the third application 200, the registration control unit 316 determines that the communication device 100. To execute registration for the first application 200, the second application 200, and the third application 200.

The communication device 100 first executes registration for the first application 200 according to an instruction from the registration control unit 316. The registration flow may be the same as the above-mentioned flow. The communication device 100 transmits the key information to the first application 200, transmits the key information to the management system 300, and receives the device ID. Then, the communication device 100 transmits the authentication token to the management system 300.

Next, the communication device 100 executes registration for the second application 200. The communication device 100 transmits the key information to the second application 200, and transmits the key information to the management system 300. Since the device ID for the key information has already been assigned, the transmission of the device ID from the management system 300 to the communication device 100 is omitted, and the communication device 100 transmits the authentication token to the management system 300.

Next, the communication device 100 executes registration for the third application 200. The communication device 100 transmits the key information to the third application 200, and transmits the key information to the management system 300. Since the device ID for the key information has already been assigned, the transmission of the device ID from the management system 300 to the communication device 100 is omitted, and the communication device 100 transmits the authentication token to the management system 300.

After the registration is completed, the communication device 100 transmits the first type of data, the device ID, and the authentication token to the first application 200. The communication device 100 transmits the second type of data, the device ID, and the authentication token to the first application 200. The communication device 100 transmits the third type of data, the device ID, and the authentication token to the first application 200.

Depending on the cloud service, there are strengths and weaknesses in the types of data handled. According to the management system 300 according to the present embodiment, when the communication device 100 can transmit a plurality of types of data, the data can be transmitted to the application 200 of the cloud service suitable for the data type.

Here, an example of omitting the transmission of the device ID when registering for the second application 200 and the third application 200 has been described, but the present invention is not limited to this. When registering in each of the second application 200 and the third application 200, a different device ID may be assigned to the communication device 100 for each. In this case, the management system 300 may be able to identify the communication device 100 by associating and managing a plurality of device IDs assigned to the same communication device 100.

FIG. 7 schematically shows an example of a hardware configuration of a computer 1200 that functions as an execution device of a communication device 100 or an application 200. A program installed on the computer 1200 causes the computer 1200 to function as one or more "parts" of the apparatus according to the present embodiment, or causes the computer 1200 to perform an operation associated with the apparatus according to the present embodiment or the one or the like. A plurality of "parts" can be executed and / or a computer 1200 can be made to execute a process according to the present embodiment or a stage of the process. Such a program may be run by the CPU 1212 to cause the computer 1200 to perform certain operations associated with some or all of the blocks of the flowcharts and block diagrams described herein.

The computer 1200 according to this embodiment includes a CPU 1212, a RAM 1214, and a graphic controller 1216, which are interconnected by a host controller 1210. The computer 1200 also includes input / output units such as a communication interface 1222, a storage device 1224, a DVD drive 1226, and an IC card drive, which are connected to the host controller 1210 via the input / output controller 1220. The DVD drive 1226 may be a DVD-ROM drive, a DVD-RAM drive, or the like. The storage device 1224 may be a hard disk drive, a solid state drive, or the like. The computer 1200 also includes a legacy input / output unit such as a ROM 1230 and a keyboard, which are connected to the input / output controller 1220 via an input / output chip 1240.

The CPU 1212 operates according to a program stored in the ROM 1230 and the RAM 1214, thereby controlling each unit. The graphic controller 1216 acquires the image data generated by the CPU 1212 in a frame buffer or the like provided in the RAM 1214 or itself so that the image data is displayed on the display device 1218.

The communication interface 1222 communicates with other electronic devices via the network. The storage device 1224 stores programs and data used by the CPU 1212 in the computer 1200. The DVD drive 1226 reads the program or data from the DVD-ROM 1227 or the like and provides it to the storage device 1224. The IC card drive reads the program and data from the IC card and / or writes the program and data to the IC card.

The ROM 1230 stores in it a boot program or the like executed by the computer 1200 at the time of activation, and / or a program depending on the hardware of the computer 1200. The input / output chip 1240 may also connect various input / output units to the input / output controller 1220 via a USB port, a parallel port, a serial port, a keyboard port, a mouse port, and the like.

The program is provided by a computer-readable storage medium such as a DVD-ROM 1227 or an IC card. The program is read from a computer-readable storage medium, installed in a storage device 1224, RAM 1214, or ROM 1230, which is also an example of a computer-readable storage medium, and executed by the CPU 1212. The information processing described in these programs is read by the computer 1200 and provides a link between the program and the various types of hardware resources described above. The device or method may be configured to implement the operation or processing of information in accordance with the use of the computer 1200.

For example, when communication is executed between the computer 1200 and an external device, the CPU 1212 executes a communication program loaded in the RAM 1214, and performs communication processing with respect to the communication interface 1222 based on the processing described in the communication program. You may order. Under the control of the CPU 1212, the communication interface 1222 reads and reads transmission data stored in a transmission buffer area provided in a recording medium such as a RAM 1214, a storage device 1224, a DVD-ROM 1227, or an IC card. The data is transmitted to the network, or the received data received from the network is written to the reception buffer area or the like provided on the recording medium.

Further, the CPU 1212 makes it possible for the RAM 1214 to read all or necessary parts of a file or database stored in an external recording medium such as a storage device 1224, a DVD drive 1226 (DVD-ROM1227), an IC card, etc., on the RAM 1214. Various types of processing may be performed on the data of. The CPU 1212 may then write back the processed data to an external recording medium.

Various types of information such as various types of programs, data, tables, and databases may be stored in recording media and processed. The CPU 1212 describes various types of operations, information processing, conditional judgment, conditional branching, unconditional branching, and information retrieval described in various parts of the present disclosure with respect to the data read from the RAM 1214. Various types of processing may be performed, including / replacement, etc., and the results are written back to the RAM 1214. Further, the CPU 1212 may search for information in a file, database, or the like in the recording medium. For example, when a plurality of entries each having an attribute value of the first attribute associated with the attribute value of the second attribute are stored in the recording medium, the CPU 1212 is the first of the plurality of entries. The attribute value of the attribute of is searched for the entry that matches the specified condition, the attribute value of the second attribute stored in the entry is read, and the attribute value of the second attribute is changed to the first attribute that satisfies the predetermined condition. You may get the attribute value of the associated second attribute.

The program or software module described above may be stored on a computer 1200 or in a computer-readable storage medium near the computer 1200. Further, a recording medium such as a hard disk or RAM provided in a dedicated communication network or a server system connected to the Internet can be used as a computer-readable storage medium, whereby the program can be transferred to the computer 1200 via the network. offer.

The blocks in the flowcharts and block diagrams of this embodiment may represent the stage of the process in which the operation is performed or the "part" of the device responsible for performing the operation. Specific steps and "parts" are supplied with a dedicated circuit, a programmable circuit supplied with computer-readable instructions stored on a computer-readable storage medium, and / or with computer-readable instructions stored on a computer-readable storage medium. It may be implemented by the processor. Dedicated circuits may include digital and / or analog hardware circuits, and may include integrated circuits (ICs) and / or discrete circuits. Programmable circuits include logical products, logical sums, exclusive logical sums, negative logical products, negative logical sums, and other logical operations, such as, for example, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and the like. , Flip-flops, registers, and reconfigurable hardware circuits, including memory elements.

The computer readable storage medium may include any tangible device capable of storing instructions executed by the appropriate device, so that the computer readable storage medium having the instructions stored therein may be in a flow chart or block diagram. It will be equipped with a product that contains instructions that can be executed to create means for performing the specified operation. Examples of the computer-readable storage medium may include an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, and the like. More specific examples of computer-readable storage media include floppy (registered trademark) disks, diskettes, hard disks, random access memory (RAM), read-only memory (ROM), and erasable programmable read-only memory (EPROM or flash memory). , Electrically Erasable Programmable Read Only Memory (EEPROM), Static Random Access Memory (SRAM), Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD), Blu-ray® Disc, Memory Stick , Integrated circuit cards and the like may be included.

Computer-readable instructions are assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or object-oriented programming such as Smalltalk, JAVA®, C ++, etc. Includes either source code or object code written in any combination of one or more programming languages, including languages and traditional procedural programming languages such as the "C" programming language or similar programming languages. good.

Computer-readable instructions are used to generate means for a general-purpose computer, a special-purpose computer, or the processor of another programmable data processing device, or a programmable circuit, to perform an operation specified in a flowchart or block diagram. General purpose computers, special purpose computers, or other programmable data processing locally or via a local area network (LAN), a wide area network (WAN) such as the Internet, etc., to execute such computer-readable instructions. It may be provided to the processor of the device or a programmable circuit. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, and the like.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various changes or improvements can be made to the above embodiments. It is clear from the description of the claims that the form with such changes or improvements may be included in the technical scope of the present invention.

The order of execution of each process such as operation, procedure, step, and step in the apparatus, system, program, and method shown in the claims, specification, and drawings is particularly "before" and "prior to". It should be noted that it can be realized in any order unless the output of the previous process is used in the subsequent process. Even if the scope of claims, the specification, and the operation flow in the drawings are explained using "first", "next", etc. for convenience, it means that it is essential to carry out in this order. It's not a thing.

10 system, 20 cloud, 100 communication device, 102 key information acquisition unit, 104 application communication unit, 106 system communication unit, 108 storage unit, 110 authentication token generation unit, 112 data acquisition unit, 120 HW, 122 mbed OS, 124 mbed TLS, 126 External connection SDK, 128 Pelion Client, 130 Secure Zone, 132 Secure API, 200 application, 202 key information acquisition unit, 204 key information registration unit, 206 storage unit, 208 system communication unit, 210 data receiver, 212 authentication Execution unit, 214 data management unit, 300 management system, 302 storage unit, 304 key information registration unit, 306 authentication execution unit, 312 types of information reception unit, 314 judgment unit, 316 registration control unit, 1200 computer, 1210 host controller, 1212 CPU, 1214 RAM, 1216 graphic controller, 1218 display device, 1220 input / output controller, 1222 communication interface, 1224 storage device, 1226 DVD drive, 1227 DVD-ROM, 1230 ROM, 1240 input / output chip

Claims (13)

With communication devices
A system with applications
The communication device is
A key information transmitter that sends key information to the application on the cloud,
A device ID receiving unit that transmits the key information to the management system that receives and stores the key information from the application and receives the device ID assigned to the communication device by the management system.
A token generator that generates authentication tokens, and
A token transmitter that sends the authentication token to the management system,
The data acquisition unit that acquires data, and
It has a data transmission unit that transmits the data, the device ID, and the authentication token to the application.
The application
A data receiving unit that receives the data, the device ID, and the authentication token from the communication device.
An authentication execution unit that transmits the device ID and the authentication token to the management system and acquires the authentication result of the device ID and the authentication token.
A system having a data management unit that manages the data based on the authentication result. The system according to claim 1, wherein the communication device has a storage unit including a security area to which security measures are taken, and stores at least one of the device ID and the authentication token in the security area. The system according to claim 2, wherein the communication device stores the device ID and the authentication token in the security area. The storage unit includes the security area and the non-security area.
The system according to claim 2 or 3, wherein the security area is virtually separated from the non-security area, and access from the non-security area is restricted. The storage unit includes the security area and the non-security area.
The system according to claim 2 or 3, wherein the security area is virtually separated from the non-security area and is an area in which a secure OS is operating. The system according to claim 1, wherein the communication device includes a normal area and a secure area, and stores at least one of the device ID and the authentication token in the secure area. The system according to claim 6, wherein the communication device stores the device ID and the authentication token in the secure area. The system according to any one of claims 1 to 7, wherein the token generation unit sets an expiration date for the generated authentication token and updates the authentication token based on the expiration date. The communication device is an IoT device.
The system according to any one of claims 1 to 8, wherein the token transmission unit transmits the authentication token to the management system according to LwM2M. The communication device can transmit a plurality of types of data, and the communication device can transmit a plurality of types of data.
The system is
A type information receiving unit that receives type information indicating the type of data that can be transmitted by the communication device from the communication device.
A determination unit that determines the cloud service of the destination of each of the plurality of types of data based on the type information, and a determination unit.
The system according to any one of claims 1 to 9, wherein the communication device includes a registration control unit that causes the communication device to execute registration of the cloud service determined by the determination unit for the application. It ’s a communication device.
A key information transmitter that sends key information to applications on the cloud,
A device ID receiving unit that transmits the key information to the management system that receives and stores the key information from the application and receives the device ID assigned to the communication device by the management system.
A token generator that generates authentication tokens, and
A token transmitter that sends the authentication token to the management system,
The data acquisition unit that acquires data, and
A communication device including a data transmission unit that transmits the data, the device ID, and the authentication token to the application. A program for making a computer function as the communication device according to claim 11. A communication method performed by a computer
The key information transmission stage to send key information to the application on the cloud,
A device ID receiving stage in which the key information is transmitted to the management system that has received and stored the key information from the application and the device ID assigned to the computer by the management system is received.
The token generation stage to generate the authentication token, and
The token transmission stage of transmitting the authentication token to the management system, and
Data acquisition stage to acquire data and
A communication method comprising a data transmission step of transmitting the data, the device ID, and the authentication token to the application.

Images