WO2018073858A1

WO2018073858A1 - Recovery method, terminal, and device

Info

Publication number: WO2018073858A1
Application number: PCT/JP2016/080679
Authority: WO
Inventors: 太一村川; 秀二石原
Original assignee: 株式会社日立製作所
Priority date: 2016-10-17
Filing date: 2016-10-17
Publication date: 2018-04-26

Abstract

A terminal recovery method for a network system, said network system including a terminal, a first system that can communicate with the terminal via a first network and performs first processing on the terminal, and a second system that can communicate with the terminal via a second network and performs second processing on the terminal, wherein: the terminal has a tamper-resistant first device including a first memory; the first memory stores first attribute information that specifies the first system as a system to which the terminal is to connect, and that also specifies a first restart method as a method by which the terminal is to be restarted, said first restart method acquiring restart data for restarting the terminal from the first system, and then restarting the terminal; and when a processor in the terminal detects that the terminal and the first system can currently communicate with each other but the terminal and the second system cannot currently communicate with each other, the processor determines the first restart method as a method by which the terminal is to be restarted, on the basis of the first attribute information, and restarts the terminal in accordance with the first restart method using restart data obtained from the first system.

Description

Recovery method, terminal, and device

The present invention relates to a restoration method for restoring a terminal on a network, a terminal to be restored on a network, and a device that supports the restoration of the terminal.

In a system that operates a service using a terminal connected to a network, an unexpected incident may occur due to an attack from an attacker via the network. For example, an unauthorized operation such as unauthorized takeover of the terminal or rewriting of data causes the operation of the terminal or the network to become unstable, resulting in an incident. When an incident occurs, the quality of service provision deteriorates.

In order to solve this problem, when an incident occurs, it becomes a challenge to quickly respond and restore the current state to obtain service continuity, but special technical knowledge and technology are required for the solution. This special expertise and technology generally includes preparation, detection and analysis, containment, eradication, recovery, and post-incident response as the main phases of the incident response process. For these responses, it is assumed that a specialized incident response team that has trained and accumulated know-how will acquire the necessary tools and resources. For example, it is required to take vulnerability measures by using anti-virus software, spyware removal software, file integrity check software, and the like.

In addition, the number of devices to be connected is increasing due to the spread of inexpensive communication means, and the number of devices connected to the network and the amount of communication data will increase and diversify. Therefore, the problem of how to manage connected devices arises. It is generally recognized that this trend will continue in the future, and these issues will become serious.

In order to solve such a problem, for example, Patent Document 1 discloses a maintenance system. The maintenance system includes a printer control device installed on the user side and connected to the ink jet printer, a maintenance device installed on the service center side, and a communication line between the printer control device and the maintenance device connected to the maintenance device. And a maintenance USB memory storing a maintenance application that enables maintenance of the inkjet printer. Then, by connecting the maintenance USB memory to the printer control device and starting the maintenance application, the communication line between the printer control device and the maintenance device is connected, and the inkjet printer is diagnosed by the maintenance device. .

JP2012-59123A

However, although the technique of Patent Document 1 described above provides a maintenance means for starting up an application by inserting a USB device into a terminal, there is a problem that maintenance cannot be performed when the USB device itself is contaminated with a virus or the like. .

The present invention aims to improve the safety of terminal recovery.

A recovery method according to one aspect of the invention disclosed in the present application includes: a terminal; a first system capable of communicating with the terminal via a first network; and executing a first process on the terminal; the terminal; A second system capable of communicating via a network and executing a second process on the terminal; and a recovery method for the terminal in a network system, the terminal including a processor for executing a program, the program And a tamper-resistant first device including a first memory, wherein the first memory defines the first system as a connection destination of the terminal, and reconnects the terminal. The first attribute information that defines the first restart method for acquiring the start data for starting the terminal from the first system and restarting as the start method is stored. In the restoration method, the processor detects that the communication between the terminal and the first system is possible and the communication between the terminal and the second system is not possible. When the communication enabled state and the communication disabled state are detected by the detection process and the first detection process, the restart method of the terminal is determined as the first restart method based on the first attribute information. A first determination process, and a first restart process for restarting the terminal using the startup data acquired from the first system in accordance with the first restart method determined by the first determination process. , Is executed.

In addition, the terminal according to the aspect of the invention disclosed in the present application can communicate with the first system that executes the first process via the first network, and the second system that executes the second process and the second system. 2 is a terminal that can communicate via a network, and includes a processor that executes a program, a storage device that stores the program, and a tamper-resistant first device that includes a first memory. The memory defines the first system as a connection destination of the terminal, and obtains start data for starting the terminal from the first system as a restart method of the terminal and restarts the first restart method And the processor is in a communicable state between the terminal and the first system, and the terminal and the second system A first detection process for detecting that the communication state is incapable of communication, and when the communication enabled state and the communication disabled state are detected by the first detection process, based on the first attribute information, Using the startup data acquired from the first system in accordance with a first determination process for determining the restart system as the first restart system and the first restart system determined by the first determination process And a first restart process for restarting the terminal.

The device according to one aspect of the invention disclosed in the present application can communicate with the first system that executes the first process via the first network, and the second system and the second system that execute the second process. 2 A device provided in a terminal capable of communicating via a network, the terminal having a storage device for storing startup data for starting the terminal, the device including a first processor, a first memory, The first memory defines the first system as a connection destination of the terminal, and the startup data for starting the terminal as a restart method of the terminal. Storing first attribute information defining a first restart method to be acquired and restarted from the system, wherein the first processor is connected between the terminal and the first system; When in a communicable state, a notification process for notifying the terminal of a connection destination of the terminal specified by the first attribute information, and a connection destination of the terminal specified by the first attribute information by the notification process is the terminal When the terminal is connected to the first network as a result of the notification, a transmission process for transmitting a restart request including the first restart method to the terminal is executed.

According to the representative embodiment of the present invention, it is possible to improve the safety of terminal recovery. Problems, configurations, and effects other than those described above will become apparent from the description of the following embodiments.

FIG. 1 is an explanatory diagram showing a system configuration example 1 of a network system. FIG. 2 is an explanatory diagram showing a storage content example 1 of the first SIM card and the second SIM card. FIG. 3 is an explanatory diagram illustrating an example of detailed functions of various functions of the first system and the second system. FIG. 4 is an explanatory diagram illustrating an example of a data group stored in the disk of the terminal. FIG. 5A is a sequence diagram illustrating a terminal recovery sequence example 1 (first half) in the network system. FIG. 5B is a sequence diagram illustrating a terminal recovery sequence example 1 (second half) in the network system. FIG. 6 is an explanatory diagram showing a system configuration example 2 of the network system. FIG. 7 is an explanatory diagram showing a system configuration example 3 of the network system. FIG. 8 is an explanatory diagram showing another application example of the network system. FIG. 9 is an explanatory diagram showing a storage content example 2 of the first SIM card and the second SIM card. FIG. 10 is an explanatory diagram showing another example of the data group stored in the disk of the terminal. FIG. 11A is a sequence diagram illustrating a terminal recovery sequence example 2 (first half) in the network system. FIG. 11B is a sequence diagram illustrating a terminal recovery sequence example 2 (second half) in the network system.

<System configuration example of network system>
FIG. 1 is an explanatory diagram showing a system configuration example 1 of a network system. The network system 1 includes a terminal 100, a security monitoring system 110 that is an example of a first system that executes a first process on the terminal 100, and an operation system 120 that is an example of a second system that executes a second process on the terminal 100. And having. The terminal 100 is communicably connected to the security monitoring system 110 via the first network NW1. In addition, the terminal 100 is connected to the operation system 120 through the second network NW2 so as to be communicable. Further, the terminal 100 is one of a first SIM (Subscriber Identity Module) card 130 that is an example of a tamper-resistant first device having a memory area and a second SIM card 140 that is an example of a second device having a memory area. It is communicably connected to one side.

The security monitoring system 110 includes, in the terminal 100, a vulnerability countermeasure function 111 that executes a vulnerability countermeasure as a first process and a boot server function 112 that executes a restart via the first network NW1 as a first process. It is a system to provide. A system is an aggregate in which one or more computers cooperate.

The first network NW1 is a closed network that connects only the terminal 100 and the security monitoring system 110 by wire or wirelessly. Specifically, the first network NW1 is configured by a private network such as a VPN (Virtual Private Network), for example. Therefore, the terminal 100 and the security monitoring system 110 can communicate securely. The first network NW1 only needs to be more secure than the second network NW2.

The operation system 120 is a system that provides the terminal 100 with an operation function 121 that operates a service that can be provided on the second network NW2 as the second processing. The operation system 120 includes, for example, an MME (Mobility Management Entity) that manages the terminal 100 connected to the second network NW2, a distribution system that distributes paid or free content, an inventory management system that manages product inventory, a traveler's inventory Includes an immigration system to manage entry.

The second network NW2 is a communication network that connects the terminal 100 and the operation system 120 in a wired or wireless manner. The second network NW2 is an open network such as the Internet, for example.

The terminal 100 includes a processor 101, a memory 102, a disk 103, a display device 104, a device interface 105, and a communication interface 106, and is connected by a bus 107. The processor 101 controls the terminal 100. The memory 102 serves as a work area for the processor 101. The disk 103 is a non-temporary or temporary recording medium that stores various programs and data. Examples of the disk 103 include an HDD (Hard Disk Drive) and a flash memory. The display device 104 displays data on the display screen.

The device interface 105 is an interface through which either the first SIM card 130 or the second SIM card 140 can be inserted and removed. In FIG. 1, there is one device interface 105, but a plurality of device interfaces 105 (described later) may be used. The communication interface 106 is connected to the first network NW1 and the second network NW2, and transmits / receives data to / from the security monitoring system 110 and the operation system 120.

The first SIM card 130 is an example of a tamper-resistant first device having a memory area. The first device is an LSI (Large Scale Integration) having a structure such as a TRM (Tamper Resistant Module) structure that cannot store information stored therein. As a result, the first device prevents peeping from the outside and prevents alteration of internal data. For example, the first device has software that encrypts an internal program itself and decrypts and executes it as much as necessary during execution. Further, the LSI may be such that the recorded content disappears when the surface of the LSI is exposed to air, or the LSI becomes inoperable when a probe for reading out a signal is attached.

The first SIM card 130 has a first processor 131 and a first memory 132. The first processor 131 executes a program stored in the first memory 132. In addition, the first processor 131 loads the first access restriction table 133 and the first connection profile 134 onto the disk 103.

The first memory 132 stores a first access restriction table 133 and a first connection profile 134. The first access restriction table 133 is information for designating access authority for data held in the disk 103 by the terminal 100 (see FIG. 2A). The first connection profile 134 is information that designates a connection method with the first network NW1 (see FIG. 2A).

The first device is not limited to a SIM card as long as it is a tamper-resistant device having a memory area. For example, the first device may be a tamper-resistant memory device that does not include the first processor 131.

The second SIM card 140 is an example of a second device having a memory area. The second device is not required to be tamper resistant, but a SIM card is employed to share the device interface 105 with the first SIM card 130. The second SIM card 140 has a second processor 141 and a second memory 142. The second processor 141 executes a program stored in the second memory 142. Further, the second processor 141 loads the second access restriction table 143 and the second connection profile 144 onto the disk 103.

The second memory 142 stores a second access restriction table 143 and a second connection profile 144. The second access restriction table 143 is information for designating access authority for data held in the disk 103 by the terminal 100 (see FIG. 2B). The second connection profile 144 is information for designating a connection method with the second network NW2 (see FIG. 2B).

In this network system, during normal operation, the second SIM card 140 is inserted into the terminal 100, and the terminal 100 communicates with the general system via the second network NW2. When an incident occurs as a specific event between the terminal 100 and the operation system 120, the terminal 100 detects the occurrence of the incident by itself or by a notification from the operation system 120. Thereby, the recovery work of the terminal 100 starts.

The maintenance person of the terminal 100 removes the second SIM card 140 and inserts the first SIM card 130 into the terminal 100. As a result, the terminal 100 is connected to only the closed network called the first network NW1. Then, the terminal 100 is restarted by the boot server function 112 of the security monitoring system 110, and the countermeasure against the vulnerability is taken by the vulnerability countermeasure function 111. Thereby, the recovery work of the terminal 100 is completed. Thereafter, the maintenance person of the terminal 100 removes the first SIM card 130 and inserts the second SIM card 140 into the terminal 100. Thereby, the terminal 100 can communicate with the operation system 120 in a state before the incident occurs.

Note that the maintenance person of the terminal 100 may have both the first SIM card 130 and the second SIM card 140. Further, each owner of the terminal 100 may always hold only the second SIM card 140 and share the first SIM card 130. In addition, a group of owners of the terminal 100 may store the first SIM card 130 to be shared, and another administrator (for example, a supplier providing a maintenance management service) may store the first SIM card 130 to be shared. Also good.

<Example of stored contents of SIM card>
FIG. 2 is an explanatory diagram showing a storage content example 1 of the first SIM card 130 and the second SIM card 140. (A) is an example of stored contents of the first SIM card 130, and (B) is an example of stored contents of the second SIM card 140. The first access restriction table 133 and the second access restriction table 143 have a data type 201, an authority 202, and a state 203. The data type 201 indicates the type of data that the terminal 100 holds in the disk 103. The authority 202 indicates an operation (reading and writing) for data specified by the data type 201 when the SIM card is inserted. A state 203 indicates whether the operation specified by the authority 202 is permitted or prohibited when the SIM card is inserted. The value of state 203 (permitted or prohibited) is arbitrarily set by the first system and the second system that are the connection partners.

The first connection profile 134 and the second connection profile 144 have a connection network destination 204 and a boot method 205. The connection network destination 204 indicates a network (APN (Access Point Name)) that is a connection partner when the SIM card is inserted. The boot method 205 indicates a restart method of the terminal 100 when the SIM card is inserted. The network boot is a method for restarting the terminal 100 under the initiative of the first system (security monitoring system 110). Specifically, for example, the terminal 100 restarts using the startup data downloaded or distributed from the security monitoring system 110 via the first network NW1. The activation data is, for example, an OS image necessary for activation of the terminal 100. On the other hand, the terminal boot is a method of restarting the terminal 100 led by the terminal 100. Specifically, for example, the terminal 100 restarts the terminal 100 using the startup data stored in the disk 103 of the terminal 100 using a restart instruction input from the operator of the terminal 100 as a trigger.

Note that the network boot function for realizing the network boot of the terminal 100 conforms to a general PXE (Preboot Execution Environment) standard. Specifically, for example, the terminal 100 has a PXE-compliant network function in the communication interface 106 and PXE-compliant software in the memory 102.

<Examples of functions in the system>
FIG. 3 is an explanatory diagram illustrating an example of detailed functions of various functions of the first system and the second system. In the security monitoring system 110, the vulnerability countermeasure function 111 implements security countermeasures for the terminal 100. The vulnerability countermeasure function 111 checks the file stored in the disk 103 of the terminal 100 and optimizes the terminal 100. The vulnerability countermeasure function 111 includes a virus removal function 311, an unauthorized application stop function 312, and a security patch update function 313. The virus removal function 311 detects and removes illegal files in the disk 103 of the terminal 100. The unauthorized application stop function 312 stops the execution of the application when an application that is not in the white list owned by the security monitoring system 110 is stored in the disk 103 of the terminal 100. The security patch update function 313 updates the security information of firmware and software in the disk 103 of the terminal 100.

The boot server function 112 provides activation of the terminal 100 via the first network NW1. The boot server function 112 includes an OS image providing function 314 that provides an OS image serving as a boot environment, and a DHCP server function 315 that provides IP address assignment. The DHCP server function 315 provides a new IP address that can be used after the network boot because the incident may cause unauthorized access again if the current IP address continues to be used due to an incident.

Also, in the operation system 120, the operation function 121 manages the operating status of the terminal 100, for example. The operation function 121 includes, for example, a terminal control function 321 based on a command, a terminal monitoring function 322 based on a communication content monitor, and a terminal management function 323 that displays a status.

<Example of data group in disk 103>
FIG. 4 is an explanatory diagram illustrating an example of a data group stored in the disk 103 of the terminal 100. The disk 103 stores operation data 401, setting data 402, and activation data 403 as a data group. The operation data 401 is, for example, surveillance camera video 412 in which personal information such as operation data 411 collected by the terminal 100 and personal numbers and personal privacy are recorded. The setting data 402 is, for example, a network configuration value 421 or an application setting value 422 that changes the behavior of the terminal 100. The activation data 403 is an OS image 430 for activating the terminal 100.

<Recovery sequence example 1>
5A and 5B are sequence diagrams showing a restoration sequence example 1 of the terminal 100 in the network system 1. It is assumed that the second SIM card 140 is inserted into the terminal 100 and recognized, and the terminal 100 is connected to the second network NW2.

In FIG. 5A, the operation system 120 notifies the incident via the second network NW2 (step S501). Specifically, for example, when the operation system 120 confirms the change of the setting data 402 of the unplanned terminal 100 or confirms the situation where the data of the terminal 100 has crashed, When a situation where access is extremely slow is confirmed, an incident is notified that an incident has occurred.

The terminal 100 receives the incident notification and detects the incident by confirming the content of the incident notification (step S502). When the incident is detected, the terminal 100 displays a message to that effect and information prompting the replacement of the SIM card on the display screen of the display device 104. Thereby, the maintenance person of the terminal 100 removes the second SIM card 140 from the device interface 105.

When the terminal 100 detects removal of the second SIM card 140 (step S503), the terminal 100 disconnects communication with the second network NW2 (step S504). When the disconnection is detected, the terminal 100 displays a message to that effect and information prompting the insertion of the first SIM card 130 on the display screen of the display device 104. Thereby, the maintenance person of the terminal 100 inserts the first SIM card 130 into the device interface 105.

When the terminal 100 detects the insertion of the first SIM card 130 (step S505), the terminal 100 recognizes the first SIM card 130. As a result, the first processor 131 of the first SIM card 130 notifies the terminal 100 of the connection destination (step S506). Specifically, for example, the first processor 131 loads “first network NW1”, which is the connection network destination 204 of the first connection profile 134, into the disk 103 of the terminal 100.

The terminal 100 is connected to the notified connection destination “first network NW1” (step S507), and is in a state where it can communicate securely with the security monitoring system 110. The terminal 100 transmits a connection completion notification with the first network NW1 to the first SIM card 130 (step S508).

When receiving the connection completion notification, the first processor 131 of the first SIM card 130 transmits a network boot request to the terminal 100 (step S509). Specifically, for example, the first processor 131 loads “network boot”, which is the boot method 205 of the first connection profile 134, into the disk 103 of the terminal 100. Thereby, the terminal 100 transmits a network boot request to the security monitoring system 110 via the first network NW1 (step S510).

The security monitoring system 110 transmits the OS image 430 and the IP address to the terminal 100 (step S511). The terminal 100 executes network boot with the received OS image 430 (step S512). Specifically, for example, the terminal 100 overwrites the OS image 430 (startup program) on the disk 103 and restarts with the secure OS image 430 after overwriting.

The first processor 131 of the first SIM card 130 loads the first access restriction table 133 onto the disk 103 after secure restart (step S513). Thereby, the terminal 100 sets the first access restriction table 133 as a table to be accessed (step S514). As a result, the first processor 131 cannot access (read and write) the operation data 401 and can access the setting data 402 as shown in FIG.

Then, the terminal 100 transmits a vulnerability treatment request for optimizing the file of the terminal 100 to the security monitoring system 110 via the first network NW1 (step S515). Upon receiving the vulnerability action request, the security monitoring system 110 executes the vulnerability action by the vulnerability countermeasure function 111 (step S516). Specifically, for example, the security monitoring system 110 executes services such as vulnerability countermeasures on the terminal 100 in a situation where the terminal 100 applies the first access restriction table 133. When the vulnerability treatment is finished, the security monitoring system 110 transmits a vulnerability treatment completion notification to the terminal 100 (step S517).

In FIG. 5B, when the terminal 100 receives the vulnerability treatment completion notification from the security monitoring system 110, the terminal 100 detects the completion of the vulnerability treatment (step S518), and the terminal 100 displays the message on the display screen of the display device 104. And information for prompting replacement of the SIM card is displayed. As a result, the maintenance person of the terminal 100 removes the first SIM card 130 from the device interface 105.

When the terminal 100 detects removal of the first SIM card 130 (step S519), the terminal 100 disconnects communication with the first network NW1 (step S520). When the disconnection is detected, the terminal 100 displays a message to that effect and information prompting the insertion of the second SIM card 140 on the display screen of the display device 104. Thereby, the maintenance person of the terminal 100 inserts the second SIM card 140 into the device interface 105.

When the terminal 100 detects the insertion of the second SIM card 140 (step S521), the terminal 100 recognizes the second SIM card 140. Accordingly, the second processor 141 of the second SIM card 140 notifies the terminal 100 of the boot method 205 (step S522). Specifically, for example, the second processor 141 loads “terminal boot”, which is the boot method 205 of the second connection profile 144, into the disk 103 of the terminal 100.

The terminal 100 performs terminal boot, that is, restarts using the OS image 430 stored in the disk 103 according to the notified boot method “terminal boot” (step S523). The second processor 141 of the second SIM card 140 loads the second access restriction table 143 onto the disk 103 by the restart (step S524). Thereby, the terminal 100 sets the second access restriction table 143 as a table to be accessed (step S525). As a result, the second processor 141 can access (read and write) the operational data 401 as shown in FIG.

Also, the second processor 141 of the second SIM card 140 notifies the terminal 100 of the connection destination (step S526). Specifically, for example, the second processor 141 loads “second network NW2”, which is the connection network destination 204 of the second connection profile 144, to the disk 103 of the terminal 100.

The terminal 100 is connected to the notified connection destination “second network NW2” (step S527), and can communicate with the operation system 120. Then, the terminal 100 transmits a normality notification to the operation system 120 (step S528), and the operation system 120 receives the normality notification, thereby confirming that the terminal 100 is normal, that is, has been securely restored. Confirmation is made (step S529). Accordingly, the operation system 120 executes the second process (operation function 121) on the terminal 100.

As described above, according to the present embodiment, it is possible to prevent the spread of incident damage by cutting off the network by replacing the SIM card. Further, the vulnerability treatment of the terminal 100 can be realized by a simple operation such as the replacement operation of the SIM card without requiring special knowledge and technology of the security of the maintenance person. In addition, since a tamper-resistant secure module is employed as the first device, it is possible to realize a service that is highly resistant to fraud from the outside. Further, since the terminal 100 has a network booting mechanism, the terminal 100 can be restarted based on the secure start data 403. Further, the service provision by the operation system 120 can be realized by secure information management by the network setting and access authority given to each SIM card.

In the above-described example, the example in which the device interface 105 is shared by the first SIM card 130 and the second SIM card 140 has been described. However, the terminal 100 uses both the first SIM card 130 and the second SIM card 140 as the first device interface. 105 and the second device interface 105 may be included.

<System configuration example 2 of network system 1>
FIG. 6 is an explanatory diagram showing a system configuration example 2 of the network system 1. The terminal 100 includes a first device interface 601 and a second device interface 602. The first SIM card 130 can be inserted into and removed from the first device interface 601. Further, the second SIM card 140 can be inserted into and removed from the second device interface 602.

In the case of the configuration of the terminal 100 in FIG. 6, in FIG. 5A, the removal detection (step S503) of the second SIM card 140 may be performed in the same manner. Communication between 140 and the bus 107 may be disconnected. Thereby, even if the second SIM card 140 is not removed, the processor 101 of the terminal 100 determines that the second SIM card 140 has been removed, and the communication between the terminal 100 and the second network NW2 is disconnected. (Step S504).

Also in FIG. 5B, the removal detection (step S519) of the first SIM card 130 may be similarly performed, but the processor performs communication between the first SIM card 130 and the bus by the operation input of the maintenance person. It may be cut. Thereby, even if the first SIM card 130 is not removed, the processor of the terminal 100 determines that the first SIM card 130 has been removed, and the communication between the terminal 100 and the first network NW1 is disconnected ( Step S520).

As described above, in the configuration of the terminal 100 in FIG. 6, the first SIM card 130 and the second SIM card 140 are always inserted, so that the maintenance person does not need to insert or remove the first SIM card 130 and the second SIM card 140. . Therefore, loss due to insertion / extraction of the first SIM card 130 and the second SIM card 140 can be suppressed.

In addition, although the example using the SIM card has been described in FIGS. 1 to 6, the first device and the second device may be realized by one eSIM (embedded SIM) card built in the terminal 100. .

<System configuration example 3 of network system 1>
FIG. 7 is an explanatory diagram showing a system configuration example 3 of the network system 1. 7, the terminal 100 does not have the device interface 105, the first device interface 601, and the second device interface 602 as shown in FIG. 1 and FIG.

The eSIM card 710 is a device that can switch the service of a communication carrier in software without replacement. For the eSIM card 710, a standard specification has been formulated as “Embedded SIM Remote Provisioning Architecture” by GSMA Association. eSIM is a technology that allows a communication carrier registered in a SIM card to be updated remotely via a third network NW3, which is an MNO (Mobile Network Operator), using OTA (Over The Air) technology.

The eSIM card 710 does not instruct switching of the connection profile as a function of the SIM card alone, but the first connection profile 134 and the second connection profile 144 in the eSIM card 710 according to a switch instruction from an external device called Subscription Manager 701. Switch. The subscription manager 701 is owned and managed by the third network NW3 which is an MNO (Mobile Network Operator).

The eSIM card 710 is a tamper-resistant secure device having a third processor 711 and a third memory 712, and is connected to the bus 107. The third memory 712 stores a first access restriction table 133, a first connection profile 134, a second access restriction table 143, and a second connection profile 144. In the case of the eSIM card 710, the third processor 711, the first access restriction table 133 and the first connection profile 134 in the third memory 712 correspond to the first SIM card 130 (hereinafter referred to as “the first SIM card 130 The third processor 711, the second access restriction table 143 and the second connection profile 144 in the third memory 712 correspond to the second SIM card 140 (hereinafter referred to as “second SIM card 140”). Is called "function of".)

As for the terminal 100 having the built-in eSIM card 710, the terminal 100 switches the function of the first SIM card 130 and the function of the second SIM card 140 by software from the subscription manager 701. For example, in step S503 of FIG. 5A, the terminal 100 turns off the function of the second SIM card 140 by the operation from the subscription manager 701 to put it in a pseudo removal state. Thereby, in step S503, the terminal 100 detects removal of the function of the second SIM card 140.

In step S505 of FIG. 5A, the terminal 100 turns on the function of the first SIM card 130 and puts it into a pseudo insertion state by an operation from the subscription manager 701. Thereby, in step S505, the terminal 100 detects the insertion of the function of the first SIM card 130.

Further, in step S519 in FIG. 5B, the terminal 100 turns off the function of the first SIM card 130 by the operation from the subscription manager 701 to put it in a pseudo removal state. Thereby, in step S519, the terminal 100 detects removal of the function of the first SIM card 130.

Further, in step S521 in FIG. 5B, the terminal 100 turns on the function of the second SIM card 140 and puts it in a pseudo insertion state by an operation from the subscription manager 701. Thereby, in step S521, the terminal 100 detects insertion of the function of the second SIM card 140.

Thus, by applying the eSIM card 710, switching can be performed without replacing the SIM card, and loss of the SIM card can be prevented.

<Another application example of the network system 1>
FIG. 8 is an explanatory diagram illustrating another application example of the network system 1. FIG. 8 is an example in which different services are applied. 8 has the same system configuration as that of FIG. 1, but the configuration example of FIG. 6 or 7 can also be applied.

In FIG. 8, the first system is an asset management system 800 as an example. The asset management system 800 is a system operated by a rental equipment company, for example. The asset management system 800 has a life cycle management function 801 and a boot server function 112. The life cycle management function 801 is a function for managing the life cycle of the terminal 100.

FIG. 9 is an explanatory diagram showing a storage content example 2 of the first SIM card 130 and the second SIM card 140. (A) is an example of stored contents of the first SIM card 130, and (B) is an example of stored contents of the second SIM card 140. The data type 201 of the first access restriction table 133 and the second access restriction table 143 stores unique data 1004 in addition to the operation data 401 and the setting data 402. Reading of the unique data 1004 is prohibited when the second SIM card 140 is inserted, but reading of the unique data 1004 is permitted when the first SIM card 130 is inserted.

FIG. 10 is an explanatory diagram showing another example of a data group stored in the disk 103 of the terminal 100. The disk 103 stores operation data 401, setting data 402, startup data 403, and unique data 1004. The operational data 401 is, for example, asset management data 1010. The setting data 402 is, for example, a network configuration value 421 or an application setting value 422 that changes the behavior of the terminal 100. The activation data 403 is an OS image 430 for activating the terminal 100. The unique data 1004 is data unique to the terminal 100 such as the production number 1041, the production date 1042, and the power-on date 1043.

<Recovery sequence example 2>
FIG. 11A and FIG. 11B are sequence diagrams showing a restoration sequence example 2 of the terminal 100 in the network system 1. It is assumed that the second SIM card 140 is inserted into the terminal 100 and recognized, and the terminal 100 is connected to the second network NW2.

In FIG. 11A, the operation system 120 sends an inspection request notification via the second network NW2 (step S1101). Specifically, for example, the operation system 120 transmits a notification to check the life cycle of the terminal 100 to the terminal 100 regularly or irregularly.

The terminal 100 detects the inspection request by receiving the inspection request notification and confirming the content of the inspection request notification (step S1102). When the inspection request is detected, the terminal 100 displays a message to that effect and information for prompting the replacement of the SIM card on the display screen of the display device 104. Thereby, the maintenance person of the terminal 100 removes the second SIM card 140 from the device interface 105.

In FIG. 11A, the processing from step S1101 to step S1114 is the same as that from step S503 to S514 in FIG.

The terminal 100 reads the unique data 1004 according to the first access restriction table 133 and transmits the unique data 1004 to the asset management system 800 via the first network NW1 (step S1115). Upon receiving the specific data 1004, the asset management system 800 performs life cycle management (step S1116). When the life cycle management is completed, the asset management system 800 transmits a life cycle management completion notification to the terminal 100 (step S1117).

In FIG. 11B, when the terminal 100 receives the life cycle management completion notification from the asset management system 800, the terminal 100 detects the completion of the life cycle management (step S1118), and the terminal 100 displays that on the display screen of the display device 104. And information for prompting replacement of the SIM card is displayed. As a result, the maintenance person of the terminal 100 removes the first SIM card 130 from the device interface 105.

The processing from step S1119 to S1127 in FIG. 11B is the same as the processing from step S519 to S527 in FIG.

The terminal 100 transmits an inspection completion notification to the operation system 120 (step S1128), and the operation system 120 receives the inspection completion notification to confirm that the terminal 100 is normal, that is, has been securely restored. (Step S1129).

Thus, according to the present embodiment, the asset management service of the terminal 100 such as life cycle management accesses the operation data 401 and the setting data 402 stored in the terminal 100 for the inventory use of the asset management system 800. Provided without. Therefore, it is possible to link the unique data 1004 of the terminal 100 that is the minimum necessary for the service.

In addition, spreading of the unique data 1004 can be prevented by blocking the network by the SIM card exchange operation. Further, the life cycle management of the terminal 100 can be realized by a simple operation such as replacement of the SIM card without requiring special knowledge and technology of the security of the maintenance person. In addition, since a tamper-resistant secure module is employed as the first device, it is possible to realize a service that is highly resistant to fraud from outside. Further, since the terminal 100 has a network booting mechanism, the terminal 100 can be restarted based on the secure start data 403. Further, the service provision by the operation system 120 can be realized by secure information management by the network setting and access authority given to each SIM card.

In the above-described example, the example using the second SIM card 140 as the second device has been described. However, the second SIM card 140 may not be a tamper-resistant structure, and is stored in the second memory 142. Information (second access restriction table 143 and second connection profile 144) may be stored in the disk 103 or the memory 102 of the terminal 100.

In the above example, the SIM card or eSIM card 710 has been described as an example. However, the functions of the first SIM card 130 and the first SIM card 130 are SIM cards or eSIM cards as long as they are tamper-resistant devices. It is not limited to 710.

Further, in the example described above, the terminal 100 is securely communicated between the terminal 100 and the first system via the first network NW1 using the functions of the first SIM card 130 and the first SIM card 130. Although restored, the function of the first system is stored as a program in a tamper-resistant device (for example, the first SIM card 130, the eSIM card 710, or another tamper-resistant secure module connected to the bus) in the terminal 100. May be. In this case, the bus 107 in the terminal 100 is the first network NW1.

In the example described above, an example in which the SIM card can be inserted into and removed from the terminal 100 has been described. However, the terminal 100 and the first device may be configured to transmit and receive data by non-contact communication.

Further, the functions in the first system and the second system described above are functions realized by causing a processor in the system to execute a program in the system.

As described above, in the present embodiment, the terminal 100, the first system capable of communicating with the terminal 100 via the first network NW1, and executing the first process on the terminal 100, the terminal 100, and the second network NW2 And a second system that executes a second process on the terminal 100 and that is capable of communicating via the terminal 100.

The terminal 100 includes a processor 101 that executes a program, a storage device (for example, a disk 103) that stores the program, and a tamper-resistant first device that includes a first memory 132. The first memory 132 defines the first system as a connection destination of the terminal 100, and obtains start data 403 for starting the terminal 100 as a restart method of the terminal 100 from the first system and restarts the first re-start. First attribute information (for example, first connection profile 134) that defines the activation method is stored. The processor 101 performs a first detection process (for example, steps S502 to S505), a first determination process (for example, steps S510 and S511), and a first restart process (for example, step S512).

The first detection process detects that communication between the terminal 100 and the first system is enabled and communication between the terminal 100 and the second system is disabled. When the first determination process is detected by the first detection process, the restart method of the terminal 100 is determined as the first restart method based on the first attribute information. The first restart process restarts the terminal 100 using the start data 403 acquired from the first system in accordance with the first restart method determined by the first determination process.

Thus, the terminal 100 can be restarted by the secure startup data 403 in a state where the terminal 100 is disconnected from the second network NW2.

In the first determination process, the processor 101 determines the connection destination of the terminal 100 as the first system (for example, steps S506 to S508). Further, the processor 101 performs a transmission process (for example, step S510) and a reception process (for example, S511). In the transmission process, the acquisition request for the activation data 403 is transmitted to the first system determined as the connection destination of the terminal 100 by the first determination process. The reception process receives the activation data 403 from the first system as a result of the acquisition request being transmitted by the transmission process, and stores it in the storage device. In the first restart process, the processor 101 restarts the terminal 100 using the start data 403 received by the reception process according to the first restart method.

Thereby, in a state where the terminal 100 is disconnected from the second network NW2, the secure activation data 403 is acquired via the first network NW1, and the terminal 100 can be restarted.

In the first determination process, the processor 101 determines the connection destination of the terminal 100 as the first system. In addition, the processor 101 performs connection processing for connecting to the first system determined by the first determination processing and causing the first system to execute the first processing after the restart by the first restart processing.

Thereby, the first system can securely execute the first process on the terminal 100 in a state where the terminal 100 is disconnected from the second network NW2.

In addition, the storage device stores a data group used in the second process, and the first memory 132 includes first restriction information (for example, first access restriction) that defines whether or not the data group can be accessed when communicating with the first system. Table 133) is stored. Further, in the connection process, the processor 101 connects to the first system after the restart by the first restart process according to the first restriction information, and causes the first system to execute the first process.

Thereby, when the terminal 100 accesses data with access authority in a state where the terminal 100 is disconnected from the second network NW2, the first system can securely execute the first process on the terminal 100.

In addition, the terminal 100 includes a second device including a second memory 142. The second memory 142 defines the second system as a connection destination of the terminal 100, and is used as a storage device as a restart method of the terminal 100. Second attribute information defining the second restart method using the stored start data 403 is stored. The processor 101 performs a second detection process (for example, steps S518 to S521), a second determination process (for example, step S522), and a second restart process (for example, step S523). The second detection process detects that communication between the terminal 100 and the first system is disabled and communication between the terminal 100 and the second system is enabled. When the second determination process is detected by the second detection process, the restart method of the terminal 100 is determined as the second restart method based on the second attribute information (for example, the second connection profile 144). In the second restart process, the terminal 100 is restarted using the start data 403 stored in the storage device in accordance with the second restart method determined by the second determination process.

Thereby, when the second device is applied before connection with the second network NW2, the terminal 100 can be restarted securely.

In the second determination process, the processor 101 determines the connection destination of the terminal 100 as the second system. After restart by the second restart process, the processor 101 connects to the second system determined by the second determination process, and executes a connection process that causes the second system to execute the second process.

Thereby, the second system can execute the second process on the terminal 100 that has been restored to the secure state.

In addition, the second memory 142 stores second restriction information (for example, the second access restriction table 143) that defines whether or not a data group can be accessed when communicating with the second system. In accordance with the second restriction information, after the restart by the second restart process, the second system connects to the second system and causes the second system to execute the second process.

As a result, the second system NW2 can restore the secure state to the data having the access authority, but the second system can execute the second process after the secure state is restored.

Further, the first device can be inserted into and removed from the terminal 100, and in the first detection process, the processor communicates between the terminal 100 and the first system when the first device is inserted into the terminal 100 and connected. Detects that it has been made possible.

As a result, the terminal 100 is disconnected from the second network NW2 by a simple operation of inserting the first device into the terminal 100, the secure startup data 403 is obtained via the first network NW1, and the terminal 100 is Can be restarted.

In addition, the second device can be inserted into and removed from the terminal 100. In the first detection process, when the second device is removed from the terminal 100, the processor is in a communication disabled state between the terminal 100 and the second system. In the second detection process, when the first device is removed from the terminal 100, the processor is disabled from communicating between the terminal 100 and the first system, and the second device is When the terminal 100 is inserted and connected, it is detected that communication between the terminal 100 and the second system is possible.

As a result, the terminal 100 is disconnected from the second network NW2 by a simple operation of removing the second device from the terminal 100 and inserting the first device into the terminal 100, and is secured via the first network NW1. The startup data 403 can be acquired and the terminal 100 can be restarted. Further, the terminal 100 is restored by connecting the communication between the second network NW2 and the secure terminal 100 by a simple operation of removing the first device from the terminal 100 and inserting the second device into the terminal 100. can do.

Also, the first device and the second device may be tamper-resistant and integrated devices such as the eSIM card 710. In the first detection process, when the first device is selected from the outside, the processor 101 is in a communication capability state between the terminal 100 and the first system, and communicates between the terminal 100 and the second system. Detect that it was disabled. In the second detection process, when the second device is selected from the outside, the processor is in a communication disabled state between the terminal 100 and the first system, and can communicate between the terminal 100 and the second system. Detects that it was in a state.

Thereby, it is not necessary to insert and remove the first device and the second device, and loss can be suppressed.

Further, the first network NW1 is a closed network that enables communication only between the terminal 100 and the first system. Thereby, it is possible to securely communicate between the terminal 100 and the first system.

As described above, according to the present embodiment, even if the maintenance person does not have special expertise or technology, it is possible to easily recover from the deterioration in service provision quality of the terminal 100 by simple work. This also provides a protective effect that keeps the security level of the terminal 100 secure.

The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and the present invention is not necessarily limited to those having all the configurations described. A part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Moreover, you may add the structure of another Example to the structure of a certain Example. Moreover, you may add, delete, or replace another structure about a part of structure of each Example.

In addition, each of the above-described configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, with an integrated circuit, and the processor realizes each function. It may be realized by software by interpreting and executing the program to be executed.

Information such as programs, tables, and files for realizing each function is recorded on a memory, a hard disk, a storage device such as SSD (Solid State Drive), or an IC (Integrated Circuit) card, SD card, DVD (Digital Versatile Disc). It can be stored on a medium.

Also, the control lines and information lines indicate what is considered necessary for the explanation, and do not necessarily indicate all control lines and information lines necessary for mounting. In practice, it can be considered that almost all the components are connected to each other.

Claims

A terminal, a first system capable of communicating with the terminal via a first network and executing a first process on the terminal; a terminal capable of communicating with the terminal via a second network; and performing a second process on the terminal A second system to execute, and a recovery method of the terminal in the network system,
The terminal
A processor that executes the program, a storage device that stores the program, and a tamper-resistant first device that includes a first memory;
The first memory defines the first system as a connection destination of the terminal, and obtains start data for starting the terminal from the first system as a restart method of the terminal and restarts the first system Storing first attribute information defining a restart method;
In the recovery method,
The processor is
A first detection process for detecting that communication between the terminal and the first system is possible and communication between the terminal and the second system is impossible;
A first determination process for determining a restart method of the terminal as the first restart method based on the first attribute information when the communicable state and the incommunicable state are detected by the first detection process; When,
In accordance with the first restart method determined by the first determination process, a first restart process for restarting the terminal using the start data acquired from the first system;
The recovery method characterized by performing.
The recovery method according to claim 1,
In the first determination process, the processor determines the connection destination of the terminal to the first system,
The processor is
A transmission process for transmitting an acquisition request for the startup data to the first system determined as the connection destination of the terminal by the first determination process;
As a result of the acquisition request being transmitted by the transmission process, the activation data is received from the first system and stored in the storage device;
In the first restart process, the processor restarts the terminal using the startup data received by the reception process according to the first restart method.
The recovery method according to claim 1,
In the first determination process, the processor determines the connection destination of the terminal to the first system,
The processor is
After the restart by the first restart process, connecting to the first system determined by the first determination process, and executing a first connection process for causing the first system to execute the first process Characteristic recovery method.
The recovery method according to claim 3,
The storage device stores a data group used in the second process,
The first memory stores first restriction information that defines whether or not the data group can be accessed when communicating with the first system;
In the first connection process, the processor connects to the first system and causes the first system to execute the first process after restart by the first restart process according to the first restriction information. A recovery method characterized by that.
The recovery method according to claim 4,
The terminal has a second device including a second memory;
The second memory defines the second system as a connection destination of the terminal, and defines a second restart method using the boot data stored in the storage device as a restart method of the terminal. Storing second attribute information;
The processor is
A second detection process for detecting that communication between the terminal and the first system is disabled and communication is enabled between the terminal and the second system;
A second determination process for determining a restart method of the terminal to be the second restart method based on the second attribute information when detected by the second detection process;
A second restart process for restarting the terminal using the startup data stored in the storage device in accordance with the second restart method determined by the second determination process;
The recovery method characterized by performing.
The recovery method according to claim 5,
In the second determination process, the processor determines the connection destination of the terminal to the second system,
The processor is
After the restart by the second restart process, connecting to the second system determined by the second determination process, and executing a second connection process for causing the second system to execute the second process Characteristic recovery method.
The recovery method according to claim 6,
The second memory stores second restriction information that defines whether or not the data group can be accessed when communicating with the second system,
In the connection process, the processor connects to the second system and causes the second system to execute the second process after restart by the second restart process according to the second restriction information. Characteristic recovery method.
The recovery method according to claim 1,
The first device can be inserted into and removed from the terminal;
In the first detection process, when the first device is inserted and connected to the terminal, the processor detects that the communication is possible between the terminal and the first system. Characteristic recovery method.
The recovery method according to claim 5,
The second device is connectable to the terminal;
In the first detection process, when the second device is disconnected from the terminal, the processor detects that communication between the terminal and the second system is disabled.
In the second detection process, when the first device is disconnected from the terminal, the processor is disabled from communicating between the terminal and the first system, and the second device is the terminal. A recovery method, comprising: detecting that the communication is possible between the terminal and the second system.
The recovery method according to claim 5,
The first device and the second device are tamper-resistant and integrated integrated devices,
In the first detection process, when the first device is selected from the outside, the processor is brought into a communication capability state between the terminal and the first system, and the terminal and the second system Detected that communication was disabled between
In the second detection process, when the second device is selected from the outside, the processor is in a communication disabled state between the terminal and the first system, and the terminal and the second system A recovery method characterized by detecting that communication with a device is possible.
The recovery method according to claim 1,
The restoration method according to claim 1, wherein the first network is a closed network that enables communication only between the terminal and the first system.
A terminal capable of communicating with a first system for executing a first process via a first network and capable of communicating with a second system for executing a second process via a second network;
A processor that executes the program, a storage device that stores the program, and a tamper-resistant first device that includes a first memory;
The first memory defines the first system as a connection destination of the terminal, and obtains start data for starting the terminal from the first system as a restart method of the terminal and restarts the first system Storing first attribute information defining a restart method;
The processor is
A first detection process for detecting that communication between the terminal and the first system is possible and communication between the terminal and the second system is impossible;
A first determination process for determining a restart method of the terminal as the first restart method based on the first attribute information when the communicable state and the communication disabled state are detected by the first detection process When,
In accordance with the first restart method determined by the first determination process, a first restart process for restarting the terminal using the start data acquired from the first system;
A terminal characterized by executing.
A device provided in a terminal that can communicate with the first system that executes the first process via the first network and that can communicate with the second system that executes the second process via the second network. And
The terminal has a storage device for storing startup data for starting the terminal,
The device is a tamper-resistant device having a first processor and a first memory,
The first memory defines the first system as a connection destination of the terminal, and obtains start data for starting the terminal from the first system as a restart method of the terminal and restarts the first system Storing first attribute information defining a restart method;
The first processor is
When the terminal and the first system are in a communicable state, a notification process for notifying the terminal of the connection destination of the terminal specified by the first attribute information;
When the terminal is connected to the first network as a result of notifying the terminal of the connection destination of the terminal specified by the first attribute information by the notification process, the restart including the first restart method A transmission process for transmitting a request to the terminal;
A device characterized by executing.