JP4738951B2 - Relay device and communication system including relay device - Google Patents

Description

  The present invention is arranged between a relay device, in particular, a product processing device that performs processing related to product production and a management server that manages the product processing device, and information between the product processing device and the management server. The present invention relates to a relay device that relays transmission / reception of data and a communication system including the relay device.

2. Description of the Related Art Conventionally, there has been proposed a system for remotely managing product processing apparatuses arranged on a product production line via a public line such as a dedicated line or the Internet. For example, in the combination weighing system disclosed in Patent Document 1, the communication device of the balance control unit is connected to a server computer via the Internet. And in the system of this patent document 1, when replacement of a control program becomes necessary, a control program is downloaded from a server computer.
JP 2001-243074 A

  As in Patent Document 1, a system for remotely managing a product processing apparatus via the Internet has been proposed, but communication on the Internet is exposed to threats such as wiretapping, tampering, impersonation, and virus infection. ing.

  In particular, confidential information may be included in a commodity processing apparatus used for commodity production. Further, if the merchandise processing apparatus malfunctions due to distribution of an illegal program such as rewriting of operation parameters or operation software by a malicious third party, the damage to the human life or production may be stopped.

  For example, in a food production line with product processing equipment such as weighing equipment, packaging equipment, and product inspection equipment, management confidential information such as production volume and production know-how exists in each equipment, and inspection parameters etc. were malicious. If it is rewritten by a person's hand, there is a risk that the inspection will not be performed properly.

  As a countermeasure against such a threat, PKI (public key infrastructure) is widely used. However, in PKI, the validity of an individual having a certificate cannot be completely guaranteed. For example, when the product processing device itself having a registered certificate is stolen or discarded, it is possible to access the internal network using the product processing device.

  Therefore, in a system for remotely managing a product processing apparatus that performs processing related to the production of such products, not only authentication by PKI but also higher security measures that can further guarantee the validity of connected individuals are taken. There is a need.

  An object of the present invention is to provide a relay device capable of ensuring security of information exchange between a product processing device and a management server that remotely manages the product processing device, and a communication system using the relay device. is there.

  A relay device according to a first aspect of the present invention is disposed between a product processing device that performs processing related to product production and a management server that manages the product processing device, and includes a first and a second relay unit, First and second verification units, and first and second determination units are provided. The first relay unit relays transmission of first information that is information from the management server having the server-side certificate to the product processing apparatus. The second relay unit relays transmission of second information, which is information from the product processing apparatus having the processing apparatus side certificate to the management server. The first verification unit performs verification processing on the server-side certificate when relaying transmission of the first information. The second verification unit performs verification processing on the processing device side certificate when relaying transmission of the second information. The first determination unit determines whether to permit connection with the management server based on the result of the verification process by the first verification unit. The second determination unit determines whether to permit connection with the product processing device based on the result of the verification process by the second verification unit.

  With this relay device, the product processing device and the management server do not exchange information directly. When sending information such as a request command from the product processing device to the management server, or from the management server to the product processing device When sending information such as a control program, the certificate of each device is verified.

  As the certificate, for example, there is a certificate issued by a certificate authority in PKI. Using this certificate, individual authentication of the device to be connected is performed.

  Here, in addition to proof of certificate validity by a certificate authority in PKI, etc., even a device having a certificate issued from a common certificate authority and recognized as valid is a device that should not be connected (for example, discarded) Alternatively, connection from a stolen device or the like) is not permitted. Therefore, higher communication security can be ensured.

  In other words, tampering of communication data, intermediate interception, spoofing in communication, virus infection, and the like can be prevented. In other words, by adopting such a mechanism, for example, even when the control board of the product processing device is stolen or the relay device is stolen, it can be used as a management server to intercept communications or Damage caused by unauthorized access such as sending fake information or viruses can be prevented.

  Examples of information addressed to the management server include update request commands, device information such as operating rates, etc., and information addressed to product processing devices include new versions of programs and remote maintenance information. A command etc. can be mentioned as an example.

  It is more preferable to encrypt all communication via the relay device.

  Further, the server-side certificate and the processing device-side certificate have the same generation subject and are incorporated into each device from the beginning at the time of shipment, so that the certificate itself can be prevented from being counterfeited more reliably.

  A relay device according to a second invention is the relay device according to the first invention, and further includes a relay device side certificate. The relay apparatus side certificate is verified in the management server and verified in the product processing apparatus.

  Here, the relay device itself also has a certificate, thereby enabling mutual authentication between the management server and the product processing device.

  A relay device according to a third aspect of the present invention is the relay device of the first aspect, wherein the processing device side certificate includes a processing device unique number that identifies the product processing device. The second verification unit of the relay device performs verification processing on the processing device unique number. The second determination unit determines whether or not to permit connection with the product processing device based on the result of the collation processing for the processing device unique number.

  Here, individual authentication of the product processing apparatus can be performed more reliably.

  For example, when SSL is used, an information field for entering a general name in the certificate is provided. By including the identification information of the product processing device such as the rod number in a part of the information column, the second determination unit of the relay device that has received the certificate is authorized by the product processing device that is the communication partner. Can be determined.

  A relay device according to a fourth invention is the relay device according to the first invention, and the first information is signed. The first verification unit of the relay device performs verification processing on the signature of the first information. The first determination unit determines whether to relay the transmission of the first information based on the result of the collation process for the signature of the first information.

  Here, if the signature of the first information and the signature information of the relay device match, the first information is transmitted to the product processing device, and if it does not match, it is discarded. As a result, in addition to authentication for each device, the validity of the transmitted information can be confirmed, and in particular, it is possible to more effectively prevent information falsification and spoofing.

  A relay device according to a fifth invention is the relay device according to the first invention, wherein the second information is signed. The second verification unit of the relay device performs verification processing on the signature of the second information. The second determination unit determines whether to relay the transmission of the second information based on the result of the collation process for the signature of the second information.

  Here, when the signature of the second information matches the signature information of the relay device, the second information is transmitted to the management server, and when it does not match, it is discarded. As a result, in addition to authentication for each device, the validity of the transmitted information can be confirmed, and in particular, it is possible to more effectively prevent information falsification and spoofing.

  A relay device according to a sixth aspect of the present invention is the relay device of the first aspect, wherein the first information is software.

  Here, information that causes serious damage especially when eavesdropping or tampering is specified.

  A relay device according to a seventh aspect is the relay device according to the first aspect, wherein the second information is information relating to the product processing device.

  Here, information that causes serious damage especially when eavesdropping or tampering is specified.

  A relay device according to an eighth invention is the relay device according to the first invention, and the first determination unit limits the range of the first information to be relayed according to the contents of the processing device side certificate.

  Here, according to the needs of each customer, only necessary information can be filtered and transmitted from the management server.

  A relay device according to a ninth aspect is the relay device according to the first aspect, wherein the second determination unit limits the range of the second information to be relayed according to the content of the processing device side certificate.

  Here, according to the needs of each customer, it is possible to minimize the information transmission from the product processing apparatus.

  In particular, depending on the type of product processing device, it has the property that programs and parameters necessary for control of the device are included and maintenance by the management server is necessary, while the operation results and special features of the device are required. And know-how parameter setting information is included. In the case of such a product processing device, even if the user of the product processing device is a related organization such as a maintenance company that handles the management server, the operation results of the product processing device and know-how parameter settings may be leaked. Sometimes you don't want to.

  A communication system according to a tenth invention includes the relay device according to the second to ninth inventions, one or more product processing devices, and a management server. The management server is connected to one or more relay devices, and each relay device is connected to one or more product processing devices.

  The merchandise processing apparatus includes a third verification unit and a third determination unit. The third verification unit performs verification processing on the relay device side certificate when receiving the first information. The third determination unit determines whether to permit connection with the relay device based on the result of the verification process by the third verification unit.

  The management server has a fourth verification unit and a fourth determination unit. The fourth verification unit performs verification processing on the relay device side certificate when receiving the second information. The fourth determination unit determines whether to permit connection with the relay device based on a result of the verification process by the fourth verification unit.

  Here, the certificates possessed by the three parties of the management server, the relay device, and the product processing device are mutually verified. As a result, a communication system with a higher security effect can be realized as compared with a conventional communication system using only PKI.

  In general PKI, the validity of a certificate can be confirmed, but the validity of the connection partner having the certificate cannot be completely guaranteed. According to this communication system, since the mutual authentication is performed twice between the product processing device and the management server via the relay device installed at each factory or the like, for example, a certificate about the product processing device leaks to the outside. However, it is not possible to connect directly to the management server outside. With this communication system, it is possible to realize a hierarchical secure authentication system between devices and to easily specify a communication path.

  A communication system according to an eleventh aspect of the invention is the communication system of the tenth aspect of the invention, in which the third determination unit of the product processing device does not permit connection starting from the relay device.

  Here, transmission of information is always performed in response to a request from the merchandise processing device, and unauthorized access via a relay device close to the external network can be more effectively prevented. In particular, it is possible to suppress the unexpected rewrite of the operation parameters of the product processing apparatus and the unexpected change of the control program, and it is possible to avoid leakage of confidential information in the product processing apparatus.

  A communication system according to a twelfth aspect of the present invention is the communication system of the tenth aspect of the present invention, in which the first determination unit of the relay device does not permit connection starting from the management server.

  Here, transmission of information is always performed in response to a request from the relay device side (customer side), and unauthorized access from the external network can be more effectively prevented. In particular, it is possible to prevent unforeseen rewrites of operating parameters of the product processing apparatus and unforeseen changes in the control program, and to avoid leakage of confidential information in the product processing apparatus.

  According to the present invention, in addition to the conventional authentication by PKI, more reliable individual authentication can be performed among the management server, the relay device, and the product processing device, so that particularly unauthorized access such as spoofing and tampering and virus infection can be prevented. This can be effectively prevented, and a high level of security can be secured for the exchange of information between the product processing apparatus and the management server.

  FIG. 1 shows product processing devices 41, 42, 43, and 44 of a product production line connected to a relay device according to an embodiment of the present invention. As shown in FIG. 2, these merchandise processing apparatuses 41, 42, 43, 44 are managed by remote management server 20 via relay apparatus 40 such as remote monitoring and remote software update. The management system comprising the management server 20, the relay device 40, and the product processing devices 41, 42,... Shown in FIG.

  The product processing devices 41, 42,... To be remotely managed perform product processing on the line for producing products that are food to be packed. Specifically, the weighing device 41, the bag making and packaging device 42, the seal check device 43, the weight check device 44, and the like shown in FIG. Although omitted in FIG. 1, the commodity processing apparatus may include an automatic boxing apparatus, a foreign matter contamination check apparatus using X-rays, and the like.

  As shown in FIG. 2, a series of product processing devices 41, 42... Installed in one property (factory or the like) 31 is connected to one relay device 40 installed in the property 31. The relay device 40 is connected to the management server 20 in the centralized management center 10 at a remote location far away from the property 31 via a public line such as the Internet 50 or a dedicated line. The management server 20 also receives a connection request from a relay device installed in the property 32, 33, etc. other than the property 31.

  The relay device 40 relays diagnostic data and parts ordering data transmitted from the product processing devices 41, 42... To the management server 20, or transmits from the management server 20 to the product processing devices 41, 42. Or relay a new version of the product processing program. The product processing devices 41, 42... And the management server 20 are not directly connected, and data (information) is exchanged between them both via the relay device 40.

<Detailed configuration of product processing apparatus>
Here, the merchandise processing devices 41, 42,... Will be described taking the weighing device 41 as an example. The other product processing devices such as the bag making and packaging device 42 and the seal check device 43 have the same control unit configuration as the weighing device 41.

  The weighing device 41 mainly includes a control unit 41a, an operation panel 41b, and a drive unit and a sensor 41c connected to the control unit 41a (see FIG. 3). The drive unit and the sensor 41c include an electromagnet for conveying the weighing object, a weight sensor for detecting the weight of the weighing object, a motor for opening and closing the bottom surface of the weighing hopper, and the like. The operation panel 41b is a touch panel type liquid crystal screen for inputting various settings related to weighing, and is a display for displaying an operation status and the like. The operation panel 41b also serves as an operation panel for the bag making and packaging apparatus 42, and also serves as an input device for registering machine information of product processing apparatuses 41, 42,.

  As shown in FIG. 3, the control unit 41a of the weighing device 41 includes a CPU 81, a RAM 82, a non-volatile memory 83, a communication interface (hereinafter referred to as a communication I / F) 84, and the like connected by a bus.

  The CPU 81 includes a processing device verification unit 81a that performs verification processing on the electronic certificate 66 of the relay device 40, and a processing device determination unit 81b that performs determination processing based on the verification result of the processing device verification unit 81a.

  The nonvolatile memory 83 stores an electronic certificate 61 including a public key, a TLS (SSL) communication secret key 58, a control program (not shown), and the like. Filtering of information sent to the management server 20 via the relay device 40 as the electronic certificate 61 together with the processing device side connection authentication electronic certificate 61a used for authenticating the connection with the relay device 40 The processing device side filtering electronic certificate 61b for causing the relay device 40 to perform the processing is prepared. The TLS communication private key 58 is one of a pair of keys used in the public key cryptosystem. The control unit 41a decrypts the encrypted data (information) sent from the relay device 40 using the TLS communication secret key 58. Further, the control unit 41a encrypts data to be sent to the relay device 40 with a public key.

  The relay device 40 and the weighing device 41 described below are connected by a dedicated line via both communication I / Fs 74 and 84. Note that all communication between the relay device 40 and the weighing device 41 is encrypted.

<Detailed configuration of relay device>
The relay device 40 is a secure proxy installed in the property 31 and has a programming function. The relay device 40 includes a CPU 71, a RAM 72, a nonvolatile memory 73, a communication I / F 74, a network interface (hereinafter referred to as network I / F) 75, a hard disk (hereinafter referred to as HD) 76, and the like connected by a bus. It is.

  The communication I / F 74 of the relay device 40 functions as a relay unit that relays information from the product processing devices 41, 42..., And the communication I of the product processing devices 41, 42. / F84 is connected.

  The network I / F 75 of the relay device 40 functions as a relay unit that relays information from the management server, and is connected to the network I / F 95 of the management server 20 at a remote location via the Internet 50. All communication between the relay device 40 and the management server 20 is also encrypted.

  As described above, the relay device 40 relays data between the product processing devices 41, 42,... And the management server 20. However, in the relay processing, authentication is performed and only a specific route is used. Not accepted.

  The CPU 71 includes a first relay device verification unit 71aa that performs verification processing on the electronic certificate 68 of the management server 20, a second relay device verification unit 71ab that performs verification processing on the electronic certificate 61 of the product processing device, and a first relay. It has 1st relay apparatus judgment part 71ba which performs a judgment process based on the collation result of apparatus collation part 71aa, and 2nd relay apparatus judgment part 71bb which performs a judgment process based on the collation result of 2nd relay apparatus collation part 71ab .

  The non-volatile memory 73 stores a relay device side electronic certificate 66 that is an electronic certificate including a public key, a TLS (SSL) communication private key 57, a program (not shown), and the like. The relay device 40 decrypts the encrypted data sent from the product processing devices 41, 42... And the management server 20 using the TLS communication secret key 57. Further, the relay device 40 encrypts data to be sent to the product processing devices 41, 42,... And the management server 20 with a public key.

  Further, in the nonvolatile memory 73, the rod numbers of the product processing devices 41, 42,... Are stored in the rod number database 73a. The registration work for storing each rod number in the rod number database 73a is performed using the operation panel 41b of the weighing device 41 in the secure communication system.

<Detailed configuration of management server>
As described above, the management server 20 is installed in the centralized management center 10 at a remote location far away from the property 31, and a connection request made from the product processing devices 41, 42, ... via the relay device 40. Accept. This management server 20 has a function of remotely performing maintenance on the product processing devices 41, 42,... In each property 31, 32, 33, a function of distributing the latest control program upon request, and a function of each product processing device. It has a function of acquiring and managing information such as operating status (for example, monitoring and creating a report).

  The management server 20 includes a CPU 91, a RAM 92, a nonvolatile memory 93, a network I / F 95, an HD 96, and the like connected by a bus.

  The CPU 91 includes a management server verification unit 91a that performs verification processing on the electronic certificate 66 of the relay device 40, and a management server determination unit 91b that performs determination processing based on the verification result of the management server verification unit 91a.

  The non-volatile memory 93 includes a server-side electronic certificate 68 that is an electronic certificate including a public key, a TLS (SSL) communication private key 59, a processing device-side electronic certificate 61, 62, 63,. A revocation database 93a that stores the expiration date of the electronic certificate 66, a management program (not shown), and the like are stored. The management server 20 decrypts the encrypted data sent from the relay device 40 using the TLS communication secret key 59. In addition, the management server 20 encrypts data to be sent to the relay device 40 with a public key.

  The management server 20 recognizes and authenticates these relay devices 40 using the relay device-side electronic certificate 66, while accepting connection requests from the plurality of relay devices 40. Further, the management server 20 also confirms information specifying the product processing device such as the rod number included in the data from the product processing devices 41, 42,... Sent via the relay device 40. To do. For example, if the rod number is not registered on the management server 20 side, the reception of the data is refused. In other words, the relay device 40 is recognized, the communication path is specified, the authentication of the electronic certificate 66 on the relay device side is completed, and the rod number in the transmitted data is registered even after the communication session is opened. If it is not done, it will be rejected. As a result, even if the relay device 40 is stolen, a malicious communication session using the relay device 40 can be opened with the management server 20, but data transmission / reception is rejected by the management server 20. The leakage of confidential data from 20 can be prevented.

  In the HD 96, a processing device information database 96 a that stores operation information and maintenance information of each product processing device 41, 42..., An order database 96 b that stores information related to online ordering of parts from each property 31, There exists an update database 96c for storing control programs of various versions of the product processing apparatuses 41, 42,. The use of each database will be described later.

<PKI model of secure communication system>
The secure communication system is a system using PKI, and FIG. 6 shows an example thereof.

  This PKI model includes a root CA 100 having a root CA certificate 101, an intermediate CA having an intermediate CA certificate 111, a management server 20, a relay device 40, and product processing devices 41, 42,. Is a hierarchical model. Although not shown, a plurality of intermediate CAs are provided for each apparatus.

  The electronic certificates of the management server 20, the relay device 40, and the product processing devices 41, 42,... Are authenticated by the intermediate CA that manages them, and each intermediate CA is authenticated by the root CA.

  In the PKI model, a code signing authority 120 is provided. The code signing authority manages code signatures attached to information such as software transmitted and received between the management server 20, the relay device 40, and the product processing devices 41, 42. In order to confirm that the code signature attached to the information is authentic, the code signing authority has a signing authority certificate 121 and is authenticated by an intermediate CA that manages the code signing authority. Authenticated by root CA.

  By taking such a mechanism, it can be confirmed that each electronic certificate or signature is issued or guaranteed by a trusted organization.

<Each mode of secure communication system>
Next, each mode of the secure communication system having an unauthorized path connection prevention function will be described below.

(1) Setting mode This mode is executed when the number of product processing devices 41, 42... Connected to the relay device 40 increases or decreases.

  All of the triggers for starting the communication session are possessed by the product processing devices 41, 42..., And in order to specify the communication path, the relay device 40 has information relating to the product processing devices 41, 42. Register information. For this reason, the mode of the relay device 40 is switched to register the machine information (here, the rod number). The rod numbers of the product processing devices 41, 42... Are stored in the rod number database 73a of the relay device 40 as shown in FIG.

  The management server 20 cannot open a communication session for the product processing devices 41, 42,..., And can process the product in a response form only in the communication session in which the product processing devices 41, 42,. The devices 41, 42... Can be accessed.

(2) Communication mode All operations for starting a communication session are performed from the product processing devices 41, 42.

  TLS technology is used for all authentication sequences between the relay device 40 and the product processing devices 41, 42,. Specifically, an authentication sequence is performed by combining security technologies such as a public key and a private key, an electronic certificate, and a hash function. At this time, the merchandise processing devices 41, 42,... Cannot be connected to the management server 20 that provides various services without going through the specific relay device 40 registered in the setting mode.

  The identification names and rod numbers of the product processing devices 41, 42,... Are embedded in a predetermined item field inside the processing device side connection authentication electronic certificate 61a used at the time of TLS handshake, and the relay device is started at the start of the TLS session. The relay device 40 determines whether or not to permit relaying by comparing with the rod number obtained by requesting the product processing device 41, 42,.

  If it is the correct partner, the relay device 40 requests connection to the management server 20 that provides various services in the same procedure. In this connection process, TLS authentication is used so that encryption and information integrity can be guaranteed in all communication paths of the secure communication system when a communication session is established. Accordingly, all the data flowing through the Internet 50 is digitally signed for the purpose of preventing falsification.

  After the communication session is established, the product processing devices 41, 42... Use the processing device side filtering electronic certificate 61b which is a certificate different from the processing device side connection authentication electronic certificate 61a. , Transmission information can be filtered. By this filtering, information (communication data) can be selected and encrypted. As described above, since the processing device side filtering electronic certificate 61b is provided, customers using the product processing devices 41, 42,... Filter confidential information that does not need to be transmitted to the outside (management server 20). Can be removed.

  In order to follow the above procedure, the product processing devices 41, 42,... Can be connected to the management server 20 that provides various services only through the specific relay device 40. Therefore, even when the product processing devices 41, 42... Are discarded or stolen, both (customers using the product processing devices 41, 42... And those who provide various services by the management server 20). Security concerns such as unauthorized access are eliminated.

  Further, the relay device 40 itself does not have a trigger function for starting a communication session for the product processing devices 41, 42. For this reason, even when the relay device 40 is discarded or stolen, even when an attempt is made to connect to the product processing devices 41, 42,..., Connection cannot be made and information leakage or the like can be prevented. Thus, there are no security concerns for the customer.

  In addition, regarding the electronic certificates of the product processing devices 41, 42,... And the relay device 40, the management server 20 is equipped with a function for confirming the revocation for each connection request, and the product processing devices 41, 42. Can individually invalidate connection to the management server 20 through the relay device 40. The revocation procedure is realized by checking the expiration date and setting invalidation on the management server 20 side. As a result, both the relay device 40 and the product processing devices 41, 42... Can prevent malicious secondary use of keys and electronic certificates. Information such as the expiration date and the presence / absence of invalidation settings is stored in the invalidation database 93a of the nonvolatile memory 93 of the management server 20. Since the management server 20 performs such revocation confirmation of the electronic certificate, even if the relay device 40 and the control boards of the product processing devices 41, 42,. Thus, malicious communication can be protected on the management server 20 side.

<About each function of the relay device>
Next, focusing on the relay device 40, each function will be described in an organized manner.

(1) Product Processing Device Authentication Function In the secure communication system, mutual authentication is performed when establishing encrypted communication using, for example, PKI. At this time, for the purpose of preventing non-repudiation, a strict check is performed by using the identification name and the extension area item of the electronic certificate.

  When information is sent from the product processing devices 41, 42... To the relay device 40 in order to transmit information to the management server 20, a processing device side connection authentication electronic certificate 61a is attached. In the extended area item, the rod numbers of the product processing apparatuses 41, 42,.

  The second relay device collation unit 71bb of the relay device 40 collates the lot number of the registered product processing devices 41, 42,... With the lot number of the sent electronic certificate 61a. Here, if the rod numbers are different, the second relay device determination unit 71bb of the relay device 40 rejects the connection with the product processing devices 41, 42,.

  Since such a mechanism is employed, for example, even if the electronic certificate 61a of the stolen merchandise processing device 41, 42... Is incorporated in the computer and attempts to make a malicious connection to another relay device 40, the relay device. Since the lot number of the stolen merchandise processing device 41, 42,... Is not registered in 40, the communication session is not opened.

(2) Product processing device information management function In order to play a role of granting connection permission to the management server 20 via the Internet 50 only to the product processing devices 41, 42. Before using the secure communication system, it is necessary to register the machine information of the product processing apparatuses 41, 42. For this reason, the relay device 40 has a function of storing unique information (rod number and the like) of each product processing device 41, 42. For example, as described above, the rod numbers of the product processing devices 41, 42,... Are registered in the rod number database 73a of the relay device 40 by input using the operation panel 41b.

(3) Communication converter function Since the product processing devices 41, 42,... Themselves communicate directly with the management server 20 or the like via the Internet 50 is not preferable from the viewpoint of security, the relay device 40 has the product processing. It plays a role of mediating communication of the devices 41, 42. Further, the relay device 40 has a function of appropriately processing connection requests from a plurality of product processing devices 41, 42,.

(4) Certificate revocation information provision function Normally, in encrypted communication using a certificate, the certificate revocation information is checked by itself. However, in this secure communication system, the management server 20 and the product processing devices 41, 42,... Are not directly connected, and the product processing devices 41, 42,. Can not. Therefore, the relay device 40 is provided with a function of acquiring and providing certificate revocation information necessary as a proxy for the product processing devices 41, 42.

<Features of Secure Communication System Including Relay Device According to the Present Invention>
Recently, with the widespread use of Internet technology, product processing devices have become network-compatible, and services that support remote product processing devices with a centralized management center management server using the Internet communication connection are spreading. .

  However, information handled by the product processing apparatus may include customer management information. In particular, in product production lines and food processing factories for weighing and packaging, the confidentiality of information inside each product processing apparatus is high. In addition, food production inspections are also performed on food production lines, and if unauthorized access is made from outside to the equipment that performs these inspections, the safety of the products may be impaired. Also come out.

  Therefore, when trying to perform a service to send and receive data by connecting to a product processing apparatus via an external network such as a management server, it handles tampering of communication data, intermediate interception, communication spoofing, virus infection, etc. It is important to ensure the security of customer information during communication by taking thorough security measures.

  In response to such a demand, it may be possible to simply use public key encryption technology, but there is no denying the possibility that the merchandise processing apparatus including the memory device storing the key and the control board of the merchandise processing apparatus will be stolen. There is also a possibility that a fake management server is created, a fake program is sent, or confidential information on the product processing apparatus side is sucked up.

  Of course, if PKI is used, it is possible to guarantee the correctness of the communication partner to some extent. However, this technology does not provide a mechanism for detecting communication connection on an unintended route and preventing information leakage. That is, when the product processing device itself is discarded, stolen, or exchanged, it can be abused to connect to the network illegally. As a result, there is a possibility of information leakage to non-communication parties.

  On the other hand, the secure communication system including the relay device 40 of the present embodiment has an unauthorized path connection prevention function, and has the following features. Thereby, safety of communication between the product processing devices 41, 42,... And the management server 20 can be achieved.

(1)
First, in communication between the product processing devices 41, 42... And the management server 20 via the relay device 40, complete encrypted communication is achieved. Specifically, a module having a TLS function is mounted on each of the product processing devices 41, 42,. The TLS communication private key 58 and the electronic certificate (including the public key) 61 are incorporated in the control board at the time of shipment of the product processing apparatuses 41, 42.

  In addition, the product processing apparatuses 41, 42,... Are configured so as not to be directly connected to the Internet 50.

(2)
Moreover, the relay apparatus 40 is installed in the property 31 as what interposes the merchandise processing apparatuses 41, 42,... And the management server 20.

  This relay device 40 has a TLS communication private key 57 and an electronic certificate (including a public key) 66 built in from the beginning at the time of shipment, like the product processing devices 41, 42.

  The processing device side electronic certificate 61 that is the certificate of the merchandise processing device 41, 42... And the relay device side electronic certificate 66 that is the certificate of the relay device 40 are both incorporated at the time of shipment.

  Further, the server-side electronic certificate 68 of the management server 20 has the same source and is incorporated from the beginning, like the processing device-side electronic certificate 61 and the relay device-side electronic certificate 66.

  These electronic certificates are issued by a certificate authority that is a third-party organization, and the authenticity of the public key is proved.

(3)
By using a secure communication system having the above-described advanced security and unauthorized path connection prevention function, remote support service, online ordering service by remote management server 20 that has been difficult to realize in terms of safety in the past, Various services utilizing the Internet 50 such as a software update service can be safely provided to customers.

<3-1: Remote support service>
Conventionally, at a manufacturing site where a product processing apparatus is introduced, there is a problem that the operation rate of the product processing apparatus varies depending on daily production conditions. In response to this, service personnel, sales, and technical members with know-how provide services by responding locally.

  If this secure communication system is adopted, a secure remote diagnosis service can be provided by establishing a communication path in which encrypted communication and path identification are performed.

  At this time, it is possible to use not only text-based character data such as machine information but also camera video information installed in the product processing device at the same time. It becomes possible. For this reason, not only is it possible to eliminate the waste of time going to the site from the occurrence of a problem, but it is also possible to provide a service that is faster than before.

  In order to implement this remote support service, the operation information and maintenance information of each product processing device 41, 42,... Are collected in the processing device information database 96a of the HD 96 of the management server 20.

<3-2: Online ordering service>
Conventionally, the ordering process for maintenance parts, which has been processed by telephone or FAX, can be safely processed as electronic data with supplemental materials such as video materials. As a result, information such as inventory status and delivery date can be immediately provided to the customer.

  In order to implement this online ordering service, information related to part ordering is collected in the order database 96b of the HD 96 of the management server 20.

<3-3: Software update service>
Conventionally, a service person has been sent to the site to upgrade the control program of the product processing device. However, if this secure communication system is adopted, a software update service can be provided quickly and at low cost. It becomes like this. However, from the viewpoint of security, it is prohibited to open a communication session with the product processing devices 41, 42... From the management server 20 side. Only when requested, it is possible to transmit a necessary control program to the commodity processing devices 41, 42.

  In order to implement this software update service, the update database 96c of the HD 96 of the management server 20 stores control programs from the old version to the latest version for each of various product processing apparatuses.

(4)
In this secure communication system, three parties of merchandise processing devices 41, 42..., A relay device 40 and a management server 20 appear as communication subjects, and each has an electronic certificate. The secure communication system has a function of authenticating a subject on the customer side and specifying a route in order to provide information leakage prevention as a function of the system, and a relay having a communication trigger with respect to the management server 20 The apparatus 40, the product processing apparatuses 41, 42,... Having a communication trigger for the relay apparatus 40, and the management server 20 having no communication trigger are provided. In the secure communication system, the TLS (SSL) communication technology and the mutual authentication function by the relay device 40 and the like are merged.

  As a result, it becomes possible to identify and fix the route information, and an unexpected state occurs in which one of the products of the product processing devices 41, 42... And the relay device 40 is stolen. Can also prevent unauthorized access using it.

<Modification>
(1)
For example, in the case of authentication using SSL, authentication using a common name (CN) field is possible.

  Specifically, an identification symbol field and a specific information field are provided in the general name field (limit is 64 bytes) in the SSL library. In the specific information column, if the relay device 40 or the product processing device 41, 42.

  In this way, it is possible to perform authentication by using a part of the field of the existing electronic certificate to specify the path.

(2)
In the secure communication system described above, it is prohibited from the viewpoint of security to open a communication session with the product processing devices 41, 42... From the management server 20 side. If security can be ensured sufficiently, such as there is no fear of theft, it may be possible to give the management server 20 the authority to trigger a communication trigger.

(3)
In the above-described secure communication system, the processing device side electronic certificate 61 and the TLS communication secret key 58 are put in the non-volatile memory 83 of the control unit 41a. The main functions for these encrypted communication are transferred from the control unit 41a. It is also conceivable that the communication converter is separated and made independent, for example, as a communication converter retrofitted to the weighing device. In this case, it is desirable that the communication converter further includes, for example, a high-speed CPU, various interfaces, a control program, an operation information backup unit, and the like so as to be compatible with existing various commodity processing apparatuses.

(4)
In the secure communication system described above, the operation panel 41b of the weighing device 41 is used as an input device for registering the machine information of the product processing devices 41, 42. A dedicated input device may be provided.

  The communication system that employs the relay device according to the present invention is an improper act of impersonating the management server to intercept communication or sending fake information to the product processing device even when the product processing device or the relay device is stolen. Damage due to access can be prevented, and security of information exchange between the product processing apparatus and the management server can be ensured. Therefore, the relay device according to the present invention is particularly useful as a relay device that relays information between the product processing device and a management server that manages the product processing device.

The perspective view of the merchandise processing apparatus group managed by the management server via the relay apparatus which concerns on one Embodiment of this invention. The block diagram of the secure communication system containing a relay apparatus. The block diagram of a goods processing apparatus. The block diagram of a relay apparatus. The block diagram of a management server. The figure of the PKI model in the said embodiment.

Explanation of symbols

20 management server 40 relay device 41 weighing device (product processing device)
42 Bag making and packaging equipment (product processing equipment)
43 Seal check device (product processing device)
44 Weight check device (product processing device)
61, 62, 63 Processing device side electronic certificate 61a Processing device side connection authentication electronic certificate 61b Processing device side filtering electronic certificate 66 Relay device side electronic certificate 68 Server side electronic certificate 71 CPU
71aa 1st relay apparatus collation part (1st collation part)
71ab Second relay device verification unit (second verification unit)
71ba 1st relay apparatus judgment part (1st judgment part)
71ab Second relay device determination unit (second determination unit)
73 Non-volatile memory 74 I / F 74 (second relay unit)
75 Network I / F (first relay part)
81 CPU
81a Processing device verification unit (third verification unit)
81b Processing device judgment unit (third judgment unit)
91 CPU
91a Management server verification unit (fourth verification unit)
91b Management server determination unit (fourth determination unit)
100 root CA
110 Intermediate CA
120 Code signing authority

Claims (12)

A relay device disposed between a product processing device that performs processing related to product production and a management server that manages the product processing device;
A first relay unit that relays transmission of first information that is information from the management server having a server-side certificate to the product processing device;
A second relay unit that relays transmission of second information that is information from the product processing device having a processing device side certificate to the management server;
A first verification unit that performs verification processing on the server-side certificate when relaying transmission of the first information;
A second verification unit that performs verification processing on the processing device side certificate when relaying transmission of the second information;
A first determination unit that determines whether to permit connection with the management server based on a result of the verification process by the first verification unit;
A second determination unit that determines whether to permit connection with the product processing device based on a result of the verification process by the second verification unit;
Relay device. Further comprising a relay device side certificate that is collated in the management server and collated in the product processing device;
The relay apparatus according to claim 1. The processing device side certificate includes a processing device unique number that identifies the product processing device,
The second verification unit performs a verification process on the processing device unique number,
The second determination unit determines whether or not to permit connection with the product processing device based on a result of a matching process with respect to the processing device unique number.
The relay apparatus according to claim 1. The first information is signed.
The first verification unit performs verification processing on the signature of the first information,
The first determination unit determines whether to relay the transmission of the first information based on a result of a verification process on the signature of the first information;
The relay apparatus according to claim 1. The second information is signed.
The second verification unit performs verification processing on the signature of the second information;
The second determination unit determines whether to relay the transmission of the second information based on a result of the collation process for the signature of the second information;
The relay apparatus according to claim 1. The first information is software;
The relay apparatus according to claim 1. The second information is information relating to a product processing device.
The relay apparatus according to claim 1. The first determination unit restricts a range of the first information to be relayed according to the content of the processing device side certificate.
The relay apparatus according to claim 1. The second determination unit restricts a range of the second information to be relayed according to a content of the processing device side certificate;
The relay apparatus according to claim 1. A relay device according to any one of claims 2 to 9,
One or more commodity processing devices connected to the relay device;
The management server connected to the product processing device via one or more relay devices,
The merchandise processing device connects a third verification unit that performs verification processing on the certificate on the relay device side when receiving the first information, and a connection with the relay device based on a result of verification processing by the third verification unit A third determination unit that determines whether or not to allow
The management server establishes a connection between the fourth verification unit that performs verification processing for the certificate on the relay device side when receiving the second information, and the relay device based on a result of verification processing by the fourth verification unit. A fourth determination unit for determining whether to permit,
Communications system. The third determination unit of the product processing device does not permit connection starting from the relay device;
The communication system according to claim 10. The first determination unit of the relay device does not permit connection starting from the management server;
The communication system according to claim 10.

Images