JP7280338B1 - Information processing system, token issuing device, information processing method, and program - Google Patents

Abstract

A technology is provided that allows a device to connect to a server using a token and use a service without depending on the network to which the device connects. An information processing system that includes an information processing device that provides a service to a device that includes a tamper-resistant authentication information storage device and a token issuing device that issues a token to the device, In response to receiving a token request from the device, the token issuing device authenticates the device using the key information in the authentication information storage device. A token is issued to the device, and the information processing device receives the token from the device, and when the validity of the token is confirmed, provides the service to the device. [Selection drawing] Fig. 1

Description

The present invention relates to technology for authenticating devices.

In recent years, various devices, such as sensors and surveillance cameras, have been connected to networks as IoT devices. IoT services that create new added value using these IoT devices are expected to spread in various fields.

As many IoT devices are connected to the network, security risks to the IoT devices are increasing. Various authentication technologies are being applied to deal with such security risks. As such an authentication technology, for example, there is an authentication technology using a SIM disclosed in Patent Document 1.

There is also a technique of transmitting a token from a device to a service providing server, and performing authentication by determining the validity of the token on the server side. As a conventional technique for issuing this token to a device, there is a technique in which the token providing server regards the reception of the token request via the mobile network as completion of device authentication and issues the token.

Japanese Patent Application Laid-Open No. 2021-140436

With the token-based technology described above, a device holding a valid token can easily connect to the server and use the service. However, the above conventional technology for issuing tokens has a problem that a device can be issued a token only when it is connected to a specific mobile network.

The present invention has been made in view of the above points, and aims to provide a technique for allowing a device to connect to a server using a token and use a service without depending on the network to which the device connects. aim.

According to the disclosed technique, an information processing system including an information processing device that provides a service to a device equipped with a tamper-resistant SIM and a token issuing device that issues a token to the device,
In response to receiving a token request from the device, the token issuing device authenticates the device using the SIM key information of the SIM , and if the device authentication is successful, issue a token
The information processing device is an information processing system that receives a token from the device and provides a service to the device when the validity of the token is confirmed,
The token issuing device authenticates the device by requesting authentication to an authentication device holding SIM key information of the SIM.
An information processing system is provided.

According to the disclosed technique, a device can use a token to connect to a server and use a service without depending on the network to which the device connects.

It is a figure showing the whole system composition example in an embodiment of the invention. FIG. 4 is a sequence diagram for explaining the operation of the system; FIG. 4 is a sequence diagram for explaining the operation of the system; It is a figure which shows the example of a token issuing process. It is a figure which shows the example of a token issuing process. FIG. 4 is a diagram for explaining an example of processing including connection processing to a mobile network; 1 is a configuration diagram of a device 100; FIG. 2 is a configuration diagram of an information processing apparatus 200; FIG. 3 is a configuration diagram of a token issuing device 300; FIG. 4 is a configuration diagram of an authentication device 400. FIG. It is a hardware block diagram of an apparatus.

An embodiment (this embodiment) of the present invention will be described below with reference to the drawings. The embodiments described below are merely examples, and embodiments to which the present invention is applied are not limited to the following embodiments.

(System configuration example)
FIG. 1 shows an example of the overall configuration of an information processing system according to this embodiment. As shown in FIG. 1, the system includes a device 100, an information processing device 200, a token issuing device 300, and an authentication device 400, which are connected to a network 500. FIG.

The device 100 includes a SIM (Subscriber Identity Module) 110 . The device 100 is an IoT terminal including, for example, a sensor, and has a function of uploading collected information to the information processing apparatus 200 . However, using an IoT terminal as the device 100 is an example. It is also an example that the server to which the device 100 is connected is the information processing apparatus 200 .

The SIM 110 mounted on the device 100 may be in the form of a card that can be inserted into and removed from the device 100, or may be an IC chip that is fixed inside the device 100 as an IC chip. Authentication information is stored in the SIM 110 or IC chip. The authentication information may be the IMSI, for example. The authentication information may be called SIM information, key, key information, or the like. The SIM 110 and IC chip are examples of authentication information storage devices. The authentication information storage device may be implemented as any device as long as it has tamper resistance, can record authentication information, and can output information to be verified according to the authentication information. The device 100 may be provided with an authentication information storage device other than the SIM 110 and the IC chip.

The information processing apparatus 200 is an apparatus that authenticates the device by confirming the validity of a token received from the device 100, permits connection with the device 100 that has been authenticated, and provides services. The information processing apparatus 200 receives information uploaded from the device 100 to which connection is permitted, and analyzes the information, for example. In this embodiment, the information processing device 200 confirms the validity of the token by inquiring of the token issuing device 300 .

In the present embodiment, it is assumed that the information processing apparatus 200 is an apparatus that receives information uploaded from the device 100 and provides a service for analyzing the information. This is just one example. Any service may be provided by the information processing apparatus 200 to the device 100 .

The token issuing device 300 authenticates the device 100 based on the information of the SIM 110 (SIM key information), and issues a token to the device 100 when the device 100 is successfully authenticated. In this embodiment, token issuing device 300 uses authentication device 400 to authenticate device 100 based on SIM key information. Token issuing device 300 may include the function of authentication device 400 .

Authentication device 400 authenticates device 100 using SIM key information based on a request from token issuing device 300 .

The network 500 is composed of, for example, one or a combination of a wired network, a wireless network, an Internet network, a closed network, and the like. Wireless networks include, for example, mobile networks such as LTE and 5G, WiMAX (registered trademark), WiFi (registered trademark), Bluetooth (registered trademark), ZigBee (registered trademark), and the like.

(System operation example 1)
An operation example 1 of the system according to the present embodiment will be described with reference to FIG. In this embodiment, as an example of service provision by the information processing apparatus 200, an operation example when the device 100 uploads information to the information processing apparatus 200 will be described. Operation example 1 is an operation example when the device 100 holds a valid token.

In S<b>101 , the device 100 transmits an information upload request to the information processing apparatus 200 . At S<b>102 , the information processing apparatus 200 transmits a token request to the device 100 in order to receive the token from the device 100 .

In S<b>103 , the device 100 returns the held token to the information processing apparatus 200 . In S104, the information processing apparatus 200 that has received the token checks the validity of the token (whether the token has been issued to the authenticated device 100). 100 is sent to the token issuing device 300. Note that the token itself may include information indicating the device 100 that is the token transmission source.

In S<b>105 , the token issuing device 300 confirms the validity of the token received from the information processing device 200 . For example, the token issuing device 300 holds an issued token for each device for which device authentication is OK. Token issuing device 300 determines that the token is valid when the token received from information processing device 200 matches the token held by device 100 . Here, it is assumed that the validity of the token transmitted from device 100 is determined to be OK.

In S<b>106 , the token issuing device 300 transmits to the information processing device 200 a token confirmation response indicating that the confirmation of the validity of the token was OK.

After confirming the validity of the token received from the device 100, the information processing apparatus 200 transmits an information upload response indicating authentication OK (token confirmation OK) to the device 100 in S107. In S<b>108 , the device 100 starts uploading information to the information processing apparatus 200 .

Note that the device 100 can use a service provided by a device other than the information processing device 200 using a valid token.

(System operation example 2)
Next, an operation example 2 of the system will be described with reference to FIG. Operation example 2 is an operation example when the device 100 does not hold a valid token.

The device 100 transmits an information upload request to the information processing apparatus 200 in S101, and the information processing apparatus 200 transmits a token request to the device 100 in S102. Since the device 100 does not hold a valid token, token issuing processing is performed in S200, and as a result the device 100 holds a valid token. The operation in S200 will be described later.

In S103 to S107, authentication processing using a valid token is performed in the same manner as in Operation Example 1, and in S108, information upload is started.

(S200: Operation example 1 of token issuing process)
Operation example 1 of S200 (token issuing processing) shown in FIG. 3 will be described with reference to FIG. In the present embodiment, the information stored in the SIM 110 is used to authenticate the device 100 having the SIM 110. Therefore, in order to make the operation easier to understand, FIG. is drawn on the outside of the

In S<b>201 , the device 100 transmits a token request to the token issuing device 300 . At S<b>202 , the token issuing device 300 transmits a device authentication request to the device 100 .

In S<b>203 , the device 100 transmits a key calculation request to the SIM 110 . Note that the authentication method using SIM key information is not limited to a specific authentication method, but here, as an example, a case of using an authentication method using random numbers will be described.

A random number generated by the device 100 is included in the key calculation request that the device 100 transmits to the SIM 110 in S203.

The SIM 110 that has received the random number performs calculation using the SIM key information on the random number. For example, a hash value of information obtained by concatenating a random number and key information is calculated. In S204, the SIM 110 returns the hash value to the device 100 as a key calculation result.

In S<b>205 , the device 100 returns a device authentication response including the random number used for key calculation and the key calculation result (hash value) to the token issuing device 300 . The device authentication response also includes identification information of the device 100 (which may be user identification information) indicating from which device 100 the key calculation result was sent. The identification information may be any information, such as an address or a user ID.

In S<b>206 , the token issuing device 300 transmits an authentication request including the random number received from the device 100 , the key calculation result, and the identification information to the authentication device 400 . The authentication device 400 holds key information of the SIM 110 for each device (each user) as subscriber information, for example.

The authentication apparatus 400, which has received the random number, the key calculation result, and the identification information in S206, uses the same method as the hash value calculation in the SIM 110 for the information obtained by concatenating the key information of the SIM 110 of the device 100 held by itself and the received random number. , and if the calculated hash value matches the received key calculation result, it is determined that the authentication is OK. Here, it is assumed that the authentication is OK.

In S<b>207 , the authentication device 400 returns an authentication response indicating that the authentication is OK to the token issuing device 300 .

In S208, the token issuing device 300 issues a token to the device 100 that has been confirmed to be successfully authenticated, and transmits the token to the device 100 as a token response.

Note that the authentication using the key calculation result as described above is merely an example. For example, the token issuing device 300 may hold SIM key information for each device, receive key information from the device 100, and perform authentication based on whether or not the key information matches the held key information. .

(S200: Operation example 2 of token issuing process)
Operation example 2 of S200 (token issuing process) shown in FIG. 3 will be described with reference to FIG. In operation example 2 of the token issuing process, in addition to the SIM key information, the device number (IMEI, etc.) of the device 100 is also used for authentication. The aircraft number may be referred to as the device's unique ID. In the following, portions of the token issuing process that are different from the operation example 1 will be mainly described.

In S<b>205 , the device 100 returns to the token issuing apparatus 300 a device authentication response including the identification information of the device 100 , the random number used in key calculation, the key calculation result (hash value), and the machine number of the device 100 .

In S<b>206 , the token issuing device 300 transmits the authentication request received from the device 100 , including the identification information, device number, random number, and key calculation result, to the authentication device 400 . The authentication device 400 holds, for example, a device number and SIM key information for each device (for each user) as subscriber information.

In S206, the authentication apparatus 400, which has received the identification information, machine number, random number, and key calculation result, converts information obtained by concatenating the SIM key information held by itself as information about the device 100 and the received random number to the SIM 110. Calculate the hash value by the same method as hash value calculation, check whether the calculated hash value and the received key calculation result match, and compare the device number of the device 100 held by itself with the received device number. match.

The authentication device 400 determines that authentication is OK when the calculated hash value matches the received key calculation result, and when the device number of the device 100 held by itself matches the received device number. do.

As described above, by using the device number for authentication, it is possible to prevent fraud such as inserting and using the SIM 110 in an unauthorized device.

Note that the authentication using the key calculation result as described above is merely an example. For example, the token issuing device 300 holds SIM key information and device number for each device, receives the key information and device number from the device 100, and receives the key information and device number from the device 100. It is also possible to perform authentication based on whether or not they match.

(Example of operation when using a mobile network)
FIG. 6 illustrates an operation example when the device 100 connects to a mobile network (eg, 3G, 4G, 5G, 6G, etc.) and uploads information. Note that S1 to S8, which are operations for connecting to the mobile network, are existing technologies. Also, the authentication device 400 in FIG. 6 is, for example, an HSS.

At S1, the device 100 transmits a connection request to the mobile network. At S<b>2 , device 100 receives a SIM authentication request from base station 50 . In S3-S4, the device 100 acquires the key calculation result by the SIM 110 and transmits a SIM authentication response including the key calculation result to the base station 50. FIG. The base station 50 transmits an authentication request to the authentication device 400 (S6) and receives an authentication response from the authentication device 400 (S7). At S<b>8 , a mobile network connection response is returned from the base station 50 to the device 100 . In S101 to S108, the processing described with reference to FIGS. 3 to 5 is performed.

(Device configuration example)
FIG. 7 shows an example of the functional configuration of the device 100. As shown in FIG. As shown in FIG. 7 , device 100 includes SIM 110 , token processing section 120 , authentication processing section 130 , information processing section 140 and data storage section 150 .

The SIM 110 may be in the form of a removable card, or may be an IC chip fixed to the device 100 . Also, the SIM 110 may be externally attached to the device 100 .

Token processing unit 120 receives a token request from information processing device 200 , and if a valid token is stored in data storage unit 150 , reads the token from data storage unit 150 and transmits the token to information processing device 200 . If a valid token is not stored in the data storage unit 150, the token processing unit 120 requests a token from the token issuing device 300, passes through authentication processing, and stores the token issued by the token issuing device 300 as data. Stored in unit 150 .

Upon receiving a device authentication request from the token issuing device 300 , the authentication processing unit 130 receives a key calculation result from the SIM 110 by transmitting a key calculation request to the SIM 110 and returns a device authentication response to the token issuing device 300 .

The information processing unit 140 transmits an information upload request to the information processing device 200 and uploads information in response to receiving an information upload response from the information processing device 200 .

FIG. 8 shows a functional configuration example of the information processing device 200 . As shown in FIG. 8 , the information processing device 200 includes an information processing section 210 , a token processing section 220 and a data storage section 230 . The information processing unit 210 provides services to the device 100 . As an example, upon receiving an information upload request from the device 100, the information processing section 210 instructs the token processing section 220 to perform token processing. The information processing unit 210 , upon receiving the token confirmation OK notification from the token processing unit 220 , returns an information upload response to the device 100 and stores the information uploaded from the device 100 in the data storage unit 230 .

The token processing unit 220 receives the token from the device 100, confirms the validity of the token using the token issuing device 300, and notifies the information processing unit 210 of the confirmation result.

FIG. 9 shows an example of the functional configuration of the token issuing device 300. As shown in FIG. As shown in FIG. 9, the token issuing device 300 includes a token processing section 310, an authentication processing section 320, and a data storage section 330. FIG.

In the token issuing process, upon receiving a token request from the device 100, the token processing section 310 instructs the authentication processing section 320 to perform device authentication processing. Upon receiving notification of device authentication success from the authentication processing unit 320 , a token for the device 100 is issued, stored in the data storage unit 330 , and the token is transmitted to the device 100 .

Also, upon receiving a token confirmation request including a token from the information processing device 200 , the token processing unit 310 references the data storage unit 330 to confirm the token and returns a token confirmation response to the information processing device 200 .

In the token issuing process, the authentication processing unit 320 transmits a device authentication request to the device 100, and upon receiving a device authentication response from the device 100, requests the authentication device 400 to perform the authentication process based on the information included in the response. , receives an authentication response from the authentication device 400 . Note that the authentication processing unit 320 may include the functions of the authentication device 400 .

FIG. 10 shows a functional configuration example of the authentication device 400. As shown in FIG. FIG. 10 shows an example in which the authentication device 400 performs both SIM authentication and device authentication. As shown in FIG. 10 , authentication device 400 includes SIM authentication section 410 , device authentication section 420 , and data storage section 430 .

The data storage unit 430 stores SIM key information and device number for each user (for each device). SIM authentication section 410 performs SIM authentication using information included in the device authentication response transmitted from device 100 and SIM key information stored in data storage section 430 .

The device authentication unit 420 performs device authentication using the device number included in the device authentication response transmitted from the device 100 and the device number stored in the data storage unit 430 .

(Hardware configuration example of the device)
The device 100, the information processing device 200, the token issuing device 300, and the authentication device 400 can all be implemented, for example, by causing one or more computers to execute programs. The computer may be a physical machine or a virtual machine on the cloud. Hereinafter, the device 100, the information processing device 200, the token issuing device 300, and the authentication device 400 are collectively referred to as "devices".

FIG. 11 is a diagram showing a hardware configuration example of the computer in this embodiment. Note that when the computer is a virtual machine, the hardware configuration is a virtual hardware configuration. The computer of FIG. 11 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are interconnected by a bus B, respectively. 11 is the device 100, the SIM is connected to the bus B. FIG.

A program for realizing processing by the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card, for example. When the recording medium 1001 storing the program is set in the drive device 1000 , the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000 . However, the program does not necessarily need to be installed from the recording medium 1001, and may be downloaded from another computer via the network. The auxiliary storage device 1002 stores installed programs, as well as necessary files and data.

The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when a program activation instruction is received. The CPU 1004 implements functions related to the device according to programs stored in the memory device 1003 . The interface device 1005 is used as an interface for connecting to the network. A display device 1006 displays a program-based GUI (Graphical User Interface) or the like. An input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the calculation result.

(Effect of Embodiment)
According to the technology according to the present embodiment described above, the device can use the token to connect to the server and use the service without depending on the network to which the device connects.

<Appendix>
This specification discloses at least an information processing system, an information processing device, a token issuing device, an information processing method, and a program according to the following items.
(Section 1)
An information processing system that includes an information processing device that provides a service to a device that includes a tamper-resistant authentication information storage device and a token issuing device that issues a token to the device,
In response to receiving a token request from the device, the token issuing device authenticates the device using the key information in the authentication information storage device. issue a token to
An information processing system, wherein the information processing apparatus receives a token from the device and provides a service to the device when the validity of the token is confirmed.
(Section 2)
The token issuing device transmits an authentication request to the device in response to receiving a token request from the device, and receives a calculation result calculated using the key information in the authentication information storage device from the device. 2. The information processing system according to claim 1, wherein the device is authenticated using the calculation result.
(Section 3)
3. The information processing system according to claim 1, wherein the token issuing device authenticates the device by requesting authentication to an authentication device holding key information of the authentication information storage device.
(Section 4)
An information processing device in an information processing system including an information processing device that provides a service to a device having a tamper-resistant authentication information storage device, and a token issuing device that issues a token to the device, ,
In response to receiving a service use request from the device, a token request is sent to the device, a token is received from the device, and when the validity of the token is confirmed, the service is provided to the device. an information processing unit that provides
and a token processing unit that confirms the validity of the token by transmitting a token confirmation request to the token issuing device and receiving a token confirmation response from the token issuing device.
(Section 5)
A token issuing device in an information processing system including an information processing device that provides a service to a device having a tamper-resistant authentication information storage device, and a token issuing device that issues a token to the device, ,
a token processing unit that receives a token request from the device and issues a token to the device when the device is successfully authenticated;
an authentication processing unit that authenticates the device using the key information in the authentication information storage device when the token processing unit receives the token request.
(Section 6)
An information processing method executed by an information processing system including an information processing device that provides a service to a device having a tamper-resistant authentication information storage device and a token issuing device that issues a token to the device. hand,
In response to receiving a token request from the device, the token issuing device authenticates the device using the key information in the authentication information storage device. issuing a token to
An information processing method, comprising the step of providing a service to the device when the information processing device receives a token from the device and confirms the validity of the token.
(Section 7)
A program for causing a computer to function as each unit in the information processing apparatus according to item 4.
(Section 8)
A program for causing a computer to function as each unit in the token issuing device according to item 4.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

100 devices 110 SIMs
120 token processing unit 130 authentication processing unit 140 information processing unit 150 data storage unit 200 information processing device 210 information processing unit 220 token processing unit 230 data storage unit 300 token issuing device 310 token processing unit 320 authentication processing unit 330 data storage unit 400 authentication Device 410 SIM authentication unit 420 Device authentication unit 430 Data storage unit 500 Network 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 interface device 1006 display device 1007 input device 1008 output device

Claims (5)

An information processing system that includes an information processing device that provides services to a device equipped with a tamper-resistant SIM and a token issuing device that issues a token to the device,
In response to receiving a token request from the device, the token issuing device authenticates the device using the SIM key information of the SIM , and if the device authentication is successful, issue a token
The information processing device is an information processing system that receives a token from the device and provides a service to the device when the validity of the token is confirmed,
The token issuing device authenticates the device by requesting authentication to an authentication device holding SIM key information of the SIM.
Information processing system. The token issuing device transmits an authentication request to the device in response to receiving a token request from the device, receives from the device a calculation result calculated using SIM key information of the SIM , The information processing system according to claim 1, wherein the device is authenticated using the calculation result. The token issuing device in an information processing system including an information processing device that provides services to a device equipped with a tamper-resistant SIM and a token issuing device that issues a token to the device,
a token processing unit that receives a token request from the device and issues a token to the device when the device is successfully authenticated;
an authentication processing unit that authenticates the device using the SIM key information of the SIM when the token processing unit receives the token request,
The authentication processing unit authenticates the device by requesting authentication to an authentication device holding SIM key information of the SIM.
Token issuer. An information processing method executed by an information processing system including an information processing device that provides a service to a device equipped with a tamper-resistant SIM and a token issuing device that issues a token to the device,
In response to receiving a token request from the device, the token issuing device authenticates the device using the SIM key information of the SIM , and if the device authentication is successful, issuing a token;
an information processing method comprising the step of providing a service to the device when the information processing device receives a token from the device and confirms the validity of the token,
The token issuing device authenticates the device by requesting authentication to an authentication device holding SIM key information of the SIM.
Information processing methods . A program for causing a computer to function as each unit in the token issuing device according to claim 3 .

Images