JP7474882B2 - Information processing system and information processing method - Google Patents

Description

The present invention relates to technology for authenticating devices.

In recent years, a variety of devices, such as sensors and surveillance cameras, have been connected to networks as IoT devices. IoT services that use these IoT devices to create new added value are expected to become widespread in a variety of fields.

As more and more IoT devices are connected to networks, security risks to IoT devices are increasing. To address these security risks, various authentication technologies are being applied. One such authentication technology is, for example, the SIM-based authentication technology disclosed in Patent Document 1.

There is also a technology that performs authentication by sending a token from the device to a service providing server and having the server determine the validity of the token. A conventional technology for issuing such a token to a device is a technology in which a token providing server considers device authentication to be complete when it receives a token request via a mobile network and issues a token.

JP 2021-140436 A

The above-mentioned token-based technology allows a device holding a valid token to easily connect to a server and use a service. However, the above-mentioned conventional technology for issuing tokens has the problem that a device can only receive a token when it is connected to a specific mobile network.

The present invention has been made in consideration of the above points, and aims to provide a technology that allows a device to connect to a server using a token and use a service, without depending on the network to which the device is connected.

According to the disclosed technology, there is provided an information processing system including an information processing device that provides a service to a device equipped with a tamper-resistant SIM , and a token issuing device that issues a token to the device,
the token issuing device, in response to receiving a token request from the device, authenticates the device using SIM key information of the SIM, and if authentication of the device is successful, issues a token to the device;
An information processing system is provided in which the information processing device transmits a token request to the device in response to receiving a service utilization request from the device, receives a token from the device, and provides a service to the device if the validity of the token is confirmed.

The disclosed technology enables a device to connect to a server using a token and use a service, regardless of the network to which the device is connected.

1 is a diagram illustrating an example of an overall configuration of a system according to an embodiment of the present invention. FIG. 2 is a sequence diagram for explaining the operation of the system. FIG. 2 is a sequence diagram for explaining the operation of the system. FIG. 13 illustrates an example of a token issuing process. FIG. 13 illustrates an example of a token issuing process. FIG. 11 is a diagram for explaining an example of processing including processing for connecting to a mobile network. FIG. 1 is a diagram illustrating the configuration of a device 100. FIG. 2 is a diagram illustrating a configuration of an information processing device 200. FIG. 3 is a configuration diagram of a token issuing device 300. FIG. 4 is a diagram illustrating a configuration of an authentication device 400. FIG. 2 is a diagram illustrating a hardware configuration of the device.

The following describes an embodiment of the present invention (the present embodiment) with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applicable is not limited to the following embodiment.

(System configuration example)
An example of the overall configuration of an information processing system according to the present embodiment is shown in Fig. 1. As shown in Fig. 1, the system includes a device 100, an information processing device 200, a token issuing device 300, and an authentication device 400, which are connected to a network 500.

The device 100 includes a SIM (Subscriber Identity Module) 110. The device 100 is, for example, an IoT terminal equipped with a sensor, etc., and has a function of uploading collected information to the information processing device 200. However, using an IoT terminal as the device 100 is just one example. Another example is when the server to which the device 100 is connected is the information processing device 200.

The SIM 110 mounted on the device 100 may be a card-shaped one that can be inserted and removed from the device 100, or may be an IC chip that is fixed inside the device 100. Authentication information is stored in the SIM 110 or the IC chip. The authentication information may be, for example, an IMSI. The authentication information may be called SIM information, a key, key information, etc. The SIM 110 and the IC chip are examples of an authentication information storage device. The authentication information storage device may be implemented as any device that is tamper-resistant, records authentication information, and can output verification information corresponding to the authentication information. The device 100 may be provided with an authentication information storage device other than the SIM 110 or the IC chip.

The information processing device 200 is a device that authenticates the device by checking the validity of the token received from the device 100, permits connection to the device 100 for which authentication has been approved, and provides services. The information processing device 200 receives information uploaded from the device 100 that has been permitted to connect, and performs, for example, analysis. In this embodiment, the information processing device 200 checks the validity of the token by inquiring of the token issuing device 300.

In this embodiment, it is assumed that the information processing device 200 is a device that receives information uploaded from the device 100 and provides a service for analyzing the information, but this assumption is merely an example. The service that the information processing device 200 provides to the device 100 may be any service.

The token issuing device 300 authenticates the device 100 based on the information (SIM key information) of the SIM 110, and issues a token to the device 100 if the authentication of the device 100 is OK. In this embodiment, the token issuing device 300 authenticates the device 100 based on the SIM key information using the authentication device 400. Note that the token issuing device 300 may include the functions of the authentication device 400.

The authentication device 400 authenticates the device 100 using the SIM key information based on a request from the token issuing device 300.

The network 500 is composed of, for example, any one or a combination of a wired network, a wireless network, an Internet network, a closed network, etc. Wireless networks include, for example, mobile networks such as LTE and 5G, WiMAX (registered trademark), WiFi (registered trademark), Bluetooth (registered trademark), ZigBee (registered trademark), etc.

(System Operation Example 1)
An operation example 1 of the system in this embodiment will be described with reference to Fig. 2. In this embodiment, an operation example when the device 100 uploads information to the information processing device 200 will be described as an example of service provision by the information processing device 200. Operation example 1 is an operation example in the case where the device 100 holds a valid token.

In S101, the device 100 transmits an information upload request to the information processing device 200. In S102, the information processing device 200 transmits a token request to the device 100 in order to receive a token from the device 100.

In S103, the device 100 returns the token it holds to the information processing device 200. In S104, the information processing device 200 that has received the token transmits a token confirmation request including the token and information indicating the device 100 that sent the token to the token issuing device 300 in order to confirm the validity of the token (whether the token was issued to an authenticated device 100). Note that the token itself may include information indicating the device 100 that sent the token.

In S105, the token issuing device 300 checks the validity of the token received from the information processing device 200. For example, the token issuing device 300 holds an issued token for each device for which device authentication is OK. If the token of the device 100 held by the token issuing device 300 matches the token received from the information processing device 200, the token issuing device 300 determines that the validity of the token is OK. Here, it is assumed that the validity of the token sent from the device 100 is determined to be OK.

In S106, the token issuing device 300 transmits a token confirmation response to the information processing device 200 indicating that the token validity has been confirmed.

If the information processing device 200 is able to confirm the validity of the token received from the device 100, in S107 it transmits to the device 100 an information upload response indicating that authentication is OK (token confirmation is OK). In S108, the device 100 starts uploading information to the information processing device 200.

In addition, the device 100 can also use a valid token to use services provided by devices other than the information processing device 200.

(System Operation Example 2)
Next, a second operation example of the system will be described with reference to Fig. 3. The second operation example is an operation example when the device 100 does not hold a valid token.

In S101, the device 100 transmits an information upload request to the information processing device 200, and in S102, the information processing device 200 transmits a token request to the device 100. Since the device 100 does not hold a valid token, a token issuance process is performed in S200, and as a result, the device 100 holds a valid token. The operation in S200 will be described later.

In steps S103 to S107, authentication processing is performed using a valid token in the same manner as in operation example 1, and in step S108, information uploading begins.

(S200: Operation Example 1 of Token Issuance Processing)
An operation example 1 of S200 (token issuing process) shown in Fig. 3 will be described with reference to Fig. 4. In this embodiment, since authentication of the device 100 having the SIM 110 is performed using information stored in the SIM 110, in order to easily show the operation, the SIM 110 is drawn outside the device 100 in Fig. 4.

In S201, the device 100 sends a token request to the token issuing device 300. In S202, the token issuing device 300 sends a device authentication request to the device 100.

In S203, the device 100 transmits a key calculation request to the SIM 110. Note that the authentication method using the SIM key information is not limited to a specific authentication method, but here, as an example, a case where an authentication method using random numbers is used will be described.

The key calculation request that device 100 sends to SIM 110 in S203 includes a random number generated by device 100.

The SIM 110, which has received the random number, performs a calculation on the random number using the SIM's key information. For example, it calculates a hash value of the information that combines the random number and the key information. In S204, the SIM 110 returns the hash value to the device 100 as the key calculation result.

In S205, the device 100 returns a device authentication response including the random number used in the key calculation and the key calculation result (hash value) to the token issuing device 300. The device authentication response also includes identification information of the device 100 (which may be user identification information) indicating which device 100 sent the key calculation result. The identification information may be any information, and may be, for example, an address or a user ID.

In S206, the token issuing device 300 transmits an authentication request including the random number, the key calculation result, and the identification information received from the device 100 to the authentication device 400. The authentication device 400 holds, for example, key information of the SIM 110 for each device (each user) as subscriber information.

In S206, the authentication device 400 receives the random number, the key calculation result, and the identification information. The authentication device 400 calculates a hash value for the information obtained by concatenating the key information of the SIM 110 of the device 100 held by the authentication device 400 with the received random number using the same method as the hash value calculation in the SIM 110, and if the calculated hash value matches the received key calculation result, it determines that the authentication is OK. Here, it is assumed that the authentication is OK.

In S207, the authentication device 400 returns an authentication response indicating that the authentication is OK to the token issuing device 300.

In S208, the token issuing device 300 issues a token to the device 100 that has been confirmed to be authenticated, and transmits the token to the device 100 as a token response.

Note that performing authentication using the key calculation results as described above is merely one example. For example, the token issuing device 300 may hold SIM key information for each device, receive key information from the device 100, and perform authentication based on whether the received key information matches the held key information.

(S200: Operation Example 2 of Token Issuance Processing)
An operation example 2 of S200 (token issuing process) shown in Fig. 3 will be described with reference to Fig. 5. In the operation example 2 of the token issuing process, in addition to the SIM key information, the machine number (IMEI, etc.) of the device 100 is also used for authentication. The machine number may be called a unique ID of the device. Below, differences from the operation example 1 of the token issuing process will be mainly described.

In S205, the device 100 returns a device authentication response to the token issuing device 300, which includes the identification information of the device 100, the random number used in the key calculation, the key calculation result (hash value), and the device number of the device 100.

In S206, the token issuing device 300 transmits an authentication request including the identification information, the device number, the random number, and the key calculation result received from the device 100 to the authentication device 400. The authentication device 400 holds, for example, the device number and SIM key information for each device (each user) as subscriber information.

In S206, the authentication device 400 receives the identification information, the device number, the random number, and the key calculation result. The authentication device 400 calculates a hash value for the information obtained by concatenating the SIM key information it holds as information about the device 100 with the received random number in the same manner as the hash value calculation in SIM 110, and checks whether the calculated hash value matches the received key calculation result, and also checks whether the device number of the device 100 it holds matches the received device number.

The authentication device 400 determines that the authentication is OK if the calculated hash value matches the received key calculation result and if the device number of the device 100 held by the authentication device 400 matches the received device number.

As mentioned above, by using the device number for authentication, it is possible to prevent fraudulent activities such as inserting SIM110 into an unauthorized device and using it.

Note that performing authentication using the key calculation results as described above is merely one example. For example, the token issuing device 300 may hold SIM key information and a device number for each device, receive key information and a device number from the device 100, and perform authentication based on whether the received key information matches the key information held by the device 100 and whether the device numbers match.

(Example of operation when using a mobile network)
6 illustrates an example of an operation when the device 100 connects to a mobile network (e.g., 3G, 4G, 5G, 6G, etc.) and uploads information. Note that operations S1 to S8 for connecting to the mobile network are existing technologies. Also, the authentication device 400 in FIG. 6 is, for example, an HSS.

In S1, the device 100 transmits a request to connect to a mobile network. In S2, the device 100 receives a SIM authentication request from the base station 50. In S3 to S4, the device 100 acquires the key calculation result by the SIM 110, and transmits a SIM authentication response including the key calculation result to the base station 50. The base station 50 transmits an authentication request to the authentication device 400 (S6), and receives an authentication response from the authentication device 400 (S7). In S8, the base station 50 returns a mobile network connection response to the device 100. In S101 to S108, the processing described using Figures 3 to 5 is performed.

(Device configuration example)
7 shows an example of a functional configuration of the device 100. As shown in FIG. 7, the device 100 includes a SIM 110, a token processing unit 120, an authentication processing unit 130, an information processing unit 140, and a data storage unit 150.

The SIM 110 may be in the form of a removable card, or an IC chip fixed to the device 100. The SIM 110 may also be in a form that is externally attached to the device 100.

The token processing unit 120 receives a token request from the information processing device 200, and if a valid token is stored in the data storage unit 150, reads the token from the data storage unit 150 and transmits it to the information processing device 200. If a valid token is not stored in the data storage unit 150, the token processing unit 120 requests a token from the token issuing device 300, and stores the token issued by the token issuing device 300 in the data storage unit 150 after authentication processing.

When the authentication processing unit 130 receives a device authentication request from the token issuing device 300, it receives a key calculation result from the SIM 110 by sending a key calculation request to the SIM 110, and returns a device authentication response to the token issuing device 300.

The information processing unit 140 transmits an information upload request to the information processing device 200, and performs information upload in response to receiving an information upload response from the information processing device 200.

Figure 8 shows an example of the functional configuration of the information processing device 200. As shown in Figure 8, the information processing device 200 includes an information processing unit 210, a token processing unit 220, and a data storage unit 230. The information processing unit 210 provides a service to the device 100. As an example, when the information processing unit 210 receives an information upload request from the device 100, it instructs the token processing unit 220 to perform token processing. When the information processing unit 210 receives a notification that the token confirmation is OK from the token processing unit 220, it returns an information upload response to the device 100 and stores the information uploaded from the device 100 in the data storage unit 230.

The token processing unit 220 receives the token from the device 100, verifies the validity of the token using the token issuing device 300, and notifies the information processing unit 210 of the verification result.

Figure 9 shows an example of the functional configuration of the token issuing device 300. As shown in Figure 9, the token issuing device 300 includes a token processing unit 310, an authentication processing unit 320, and a data storage unit 330.

In the token issuing process, when the token processing unit 310 receives a token request from the device 100, it instructs the authentication processing unit 320 to perform device authentication processing. When it receives a notification of successful device authentication from the authentication processing unit 320, it issues a token for the device 100, stores it in the data storage unit 330, and transmits the token to the device 100.

When the token processing unit 310 receives a token confirmation request including a token from the information processing device 200, it refers to the data storage unit 330 to confirm the token and return a token confirmation response to the information processing device 200.

In the token issuing process, the authentication processing unit 320 transmits a device authentication request to the device 100, and upon receiving a device authentication response from the device 100, requests the authentication device 400 to perform authentication processing based on the information contained in the response, and receives the authentication response from the authentication device 400. Note that the authentication processing unit 320 may include the functions of the authentication device 400.

Figure 10 shows an example of the functional configuration of the authentication device 400. Figure 10 shows an example in which the authentication device 400 performs both SIM authentication and device authentication. As shown in Figure 10, the authentication device 400 includes a SIM authentication unit 410, a device authentication unit 420, and a data storage unit 430.

The data storage unit 430 stores SIM key information and device number for each user (each device). The SIM authentication unit 410 performs SIM authentication using information contained in the device authentication response sent from the device 100 and the SIM key information stored in the data storage unit 430.

The device authentication unit 420 performs device authentication using the device number included in the device authentication response sent from the device 100 and the device number stored in the data storage unit 430.

(Example of device hardware configuration)
The device 100, the information processing device 200, the token issuing device 300, and the authentication device 400 can all be realized, for example, by causing one or more computers to execute a program. The computer may be a physical machine or a virtual machine on the cloud. Hereinafter, the device 100, the information processing device 200, the token issuing device 300, and the authentication device 400 are collectively referred to as "devices."

Figure 11 is a diagram showing an example of the hardware configuration of the computer in this embodiment. If the computer is a virtual machine, the hardware configuration is a virtual hardware configuration. The computer in Figure 11 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are all connected to each other by a bus B. If the computer shown in Figure 11 is a device 100, a SIM is connected to the bus B.

The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 via the drive device 1000 into the auxiliary storage device 1002. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

When an instruction to start a program is received, the memory device 1003 reads out and stores the program from the auxiliary storage device 1002. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) based on the program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, etc., and is used to input various operational instructions. The output device 1008 outputs the results of calculations.

(Effects of the embodiment)
The technology according to the present embodiment described above makes it possible for a device to connect to a server using a token and use a service, without depending on the network to which the device is connected.

<Additional Notes>
This specification discloses at least the following information processing system, information processing device, token issuing device, information processing method, and program.
(Section 1)
An information processing system including: an information processing device that provides a service to a device having a tamper-resistant authentication information storage device; and a token issuing device that issues a token to the device,
the token issuing device, in response to receiving a token request from the device, authenticates the device using key information of the authentication information storage device, and issues a token to the device if the authentication of the device is successful;
The information processing device receives a token from the device, and if the information processing device can confirm the validity of the token, provides a service to the device.
(Section 2)
The information processing system described in paragraph 1, wherein the token issuing device transmits an authentication request to the device in response to receiving a token request from the device, receives a calculation result calculated using key information of the authentication information storage device from the device, and authenticates the device using the calculation result.
(Section 3)
3. The information processing system according to claim 1, wherein the token issuing device authenticates the device by requesting authentication from an authentication device that holds key information of the authentication information storage device.
(Section 4)
An information processing device in an information processing system including: an information processing device that provides a service to a device having a tamper-resistant authentication information storage device; and a token issuing device that issues a token to the device,
an information processing unit that transmits a token request to the device in response to receiving a service utilization request from the device, receives a token from the device, and provides a service to the device if the validity of the token is confirmed;
a token processing unit that transmits a token verification request to the token issuing device and receives a token verification response from the token issuing device, thereby verifying the validity of the token.
(Section 5)
An information processing device that provides a service to a device having a tamper-resistant authentication information storage device, and a token issuing device that issues a token to the device,
a token processing unit that receives a token request from the device and issues a token to the device if authentication of the device is successful;
an authentication processing unit that, when the token processing unit receives the token request, authenticates the device using key information of the authentication information storage device.
(Section 6)
An information processing method executed by an information processing system including an information processing device that provides a service to a device having a tamper-resistant authentication information storage device, and a token issuing device that issues a token to the device,
a step of, in response to receiving a token request from the device, the token issuing device authenticating the device using key information of the authentication information storage device, and issuing a token to the device if the authentication of the device is successful;
and a step of the information processing device receiving a token from the device, and providing a service to the device if the information processing device is able to confirm the validity of the token.
(Section 7)
5. A program for causing a computer to function as each unit in the information processing device according to claim 4.
(Section 8)
A program for causing a computer to function as each unit in the token issuing device described in paragraph 4.

Although the present embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

100 Device 110 SIM
120 Token processing unit 130 Authentication processing unit 140 Information processing unit 150 Data storage unit 200 Information processing device 210 Information processing unit 220 Token processing unit 230 Data storage unit 300 Token issuing device 310 Token processing unit 320 Authentication processing unit 330 Data storage unit 400 Authentication device 410 SIM authentication unit 420 Machine authentication unit 430 Data storage unit 500 Network 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims (2)

An information processing system including: an information processing device that provides a service to a device having a tamper-resistant SIM ; and a token issuing device that issues a token to the device,
the token issuing device, in response to receiving a token request from the device, authenticates the device using SIM key information of the SIM, and if authentication of the device is successful, issues a token to the device;
The information processing system, in response to receiving a service usage request from the device, sends a token request to the device , receives a token from the device, and provides a service to the device if the validity of the token is confirmed. An information processing method in an information processing system including an information processing device that provides a service to a device having a tamper-resistant SIM, and a token issuing device that issues a token to the device,
the token issuing device, in response to receiving a token request from the device, authenticates the device using SIM key information of the SIM, and if authentication of the device is successful, issues a token to the device;
In response to receiving a service utilization request from the device, the information processing device transmits a token request to the device, receives a token from the device, and provides the service to the device if the validity of the token is confirmed.
Information processing methods.

Images