WO2025173727A1 - Network management device, network management system, iot device, and network management method - Google Patents

Abstract

A network management device (1) comprises: a first information acquisition unit (11) that acquires a first network information (i1) pertaining to a network specified by an IoT device (70); a first information output unit (21) that outputs the first network information (i1) acquired by the first information acquisition unit (11); a second information acquisition unit (12) that acquires second network information (i2) pertaining to a network specified by a control device (90) which requests connection to the IoT device (70); an information processing unit (50) that obtains a determination result (R) indicating whether or not to connect the control device (90) to the IoT device (70), on the basis of the first network information (i1) and the second network information (i2); and a second information output unit (22) that outputs the determination result (R) to the IoT device (70).

Description

Network management device, network management system, IoT device, and network management method

This disclosure relates to a network management device, a network management system, an IoT (Internet of Things) device, and a network management method.

IoT devices connected to communication networks have been known for some time. The Matter standard has been proposed as a communication standard for these IoT devices when they communicate. The Matter standard is a standard for smart homes established by the Connectivity Standards Alliance (CSA). Using the Matter standard makes it possible to easily connect multiple IoT devices made by different manufacturers for communication. Patent Document 1 discloses a method for building a network between a UPnP (Universal Plug and Play) device and a UPnP endpoint.

Special Publication No. 2010-507285

With conventional technology, IoT devices can be connected to insecure networks, creating security issues.

This disclosure provides a network management device and the like that can prevent IoT devices from connecting to an insecure network.

A network management device according to one aspect of the present disclosure includes a first information acquisition unit that acquires first network information of a network specified by an IoT device; a first information output unit that outputs the first network information acquired by the first information acquisition unit; a second information acquisition unit that acquires second network information of a network specified by a control device that requests connection to the IoT device; an information processing unit that obtains a determination result indicating whether or not to connect the control device to the IoT device based on the first network information and the second network information; and a second information output unit that outputs the determination result to the IoT device.

A network management system according to one aspect of the present disclosure is a network management system including the above-described network management device and the IoT device, and the IoT device pairs with the control device when the determination result indicates that the control device should be connected to the IoT device.

An IoT device according to one aspect of the present disclosure includes a first information output unit that outputs first network information of a network specified by the IoT device, an information acquisition unit that acquires second network information of a network specified by a control device that requests connection to the IoT device, an information processing unit that obtains a determination result indicating whether or not to connect the control device to the IoT device based on the first network information and the second network information, and a second information output unit that outputs the determination result to the control device.

A network management method according to one aspect of the present disclosure includes the steps of outputting first network information of a network specified by an IoT device, acquiring second network information of a network specified by a control device requesting connection to the IoT device, obtaining a determination result indicating whether or not to connect the control device to the IoT device based on the first network information and the second network information, and outputting the determination result to the IoT device.

The network management device disclosed herein can prevent IoT devices from connecting to insecure networks.

FIG. 1 is a diagram showing a schematic configuration of a network management system according to an embodiment. FIG. 2 is a block diagram of a network management device, IoT devices, and control devices included in the network management system according to the embodiment. FIG. 3 is a diagram showing the flow of information in the network management device, IoT devices, and control devices. FIG. 4 is a sequence diagram illustrating the operations of the network management device, the IoT device, and the control device according to the embodiment. FIG. 5 is a flowchart showing the operation of the network management device according to the embodiment. FIG. 6 is a flowchart showing the operation of the control device according to the embodiment. FIG. 7 is a diagram illustrating an example of an IoT device according to the first modification of the embodiment. FIG. 8 is a block configuration diagram of an IoT device and a control device according to the first modification of the embodiment. FIG. 9 is a diagram illustrating the flow of information in the IoT device and the control device according to the first modification of the embodiment. FIG. 10 is a sequence diagram illustrating the operations of the network management device, the IoT device, and the control device according to the second modification of the embodiment.

(Background to this disclosure)
In recent years, log information of IoT devices connected to a network has been collected, and services suited to the usage style of users of the IoT devices have been provided.

Furthermore, with regard to the networks to which IoT devices are connected, communication standards (such as the Matter standard) have been proposed that enable the interconnection of multiple IoT devices from different manufacturers. With this communication standard, IoT devices are connected to a network using a control device such as a smartphone. However, when connecting an IoT device to a network, the IoT device may be connected to an insecure network unintentionally by the IoT device's user. When an IoT device is connected to an insecure network, problems arise in which log information from the IoT device cannot be collected. There is also the possibility of personal information being leaked via an insecure network.

In response to this, the network management device and network management system disclosed herein have the following configuration to prevent IoT devices from being connected to an insecure network.

Embodiments of the present disclosure will be described in detail below with reference to the drawings. Note that each embodiment described below represents a preferred specific example of the present disclosure. The shapes, components, component placement and connection configurations, etc. shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not set forth in the independent claims that represent the highest concept of the present disclosure will be described as optional components that constitute a more preferred embodiment. Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration.

(Embodiment)
[Schematic configuration of network management system]
The schematic configuration of a network management system according to an embodiment will be described with reference to FIG.

Figure 1 shows the general configuration of a network management system 5 according to an embodiment.

FIG. 1 shows the network management device 1, IoT device 70, and control device 90 included in the network management system 5.

The network management device 1 is a device that builds a network between IoT devices 70 and control devices 90 that control the operation of the IoT devices 70.

IoT devices 70 are devices that can be controlled by control devices 90 and are also called controlled devices. IoT devices 70 are, for example, electrical equipment such as refrigerators, televisions, projectors, printers, and copiers. IoT devices 70 are placed in designated spaces within a building. Designated spaces are spaces that are temporarily used by different users, such as common spaces in an office, conference rooms, guest rooms, and rental rooms in a building.

The control device 90 is a mobile device owned by a user who uses a specified space, such as a smartphone or tablet. Software compatible with the Matter standard is installed on the control device 90.

The following describes an example in which a user uses an IoT device 70 in a shared space in an office.

(a) in Figure 1 shows a network management device 1 and IoT device 70 arranged in a shared space. The IoT device 70 has network information about the network to which the IoT device 70 is connected, i.e., network information about the IoT device 70. The network in this example is a LAN (Local Area Network) using, for example, Wi-Fi (registered trademark) or Zigbee (registered trademark).

(b) in Figure 1 shows a user holding a control device 90 entering a shared space. The user attempts to establish a network between the IoT device 70 and the control device 90 in order to use the IoT device 70 located in the shared space.

In the network management system 5 shown in Figure 1(c), a process is performed to determine whether or not to connect the control device 90 to the IoT device 70. The network management device 1 acquires network information about the IoT device 70 and stores it in a memory unit (c1). The network management device 1 also outputs integrated authentication information that includes the network information about the IoT device 70 (c2).

The user uses the control device 90 to obtain network information for the IoT device 70 (c3). For example, the user obtains the network information for the IoT device 70 by using a camera to read the integrated authentication information displayed in the shared space.

The control device 90 accesses the network of the IoT device 70 based on the acquired network information and outputs this network information to the IoT device 70 (c4). The IoT device 70 receives the network information output from the control device 90 and outputs it to the network management device 1 (c5).

The network management device 1 determines whether or not to connect the control device 90 to the IoT device 70 based on the network information output from the control device 90 and the network information stored in the storage unit. For example, if the above two pieces of network information match, the network management device 1 determines that it is OK to connect the control device 90 to the IoT device 70 in the above network.

The network management system 5 disclosed herein can prevent IoT devices 70 from being connected to an insecure network.

[Configuration of network management device, IoT device, and control device]
The configurations of the network management device 1, the IoT device 70, and the control device 90 included in the network management system 5 will be described with reference to FIGS. 2 and 3. FIG.

Figure 2 is a block diagram of the network management device 1, IoT devices 70, and control devices 90 included in the network management system 5. Figure 3 is a diagram showing the flow of information in the network management device 1, IoT devices 70, and control devices 90.

As shown in Figures 2 and 3, the network management system 5 includes a network management device 1, an IoT device 70, and a control device 90. Although these figures show one IoT device 70, the network management system 5 may include multiple IoT devices.

The IoT device 70 has a user interface such as a touch panel and button switches. When connecting the control device 90 to the IoT device 70, the user performs a predetermined operation input via the user interface. Upon receiving the predetermined operation input, the IoT device 70 outputs identification information d1 of the IoT device 70 and first network information i1, which is network information of the IoT device 70, to the network management device 1 (see (a) in Figure 3).

The identification information d1 of the IoT device 70 is, for example, the logical address or physical address of the IoT device 70. The first network information i1 is information about the network to which the IoT device 70 is connected, that is, network information about the first network specified by the IoT device 70. The first network information i1 includes an SSID (Service Set Identifier) and password for connecting to the first network specified by the IoT device 70.

As shown in FIG. 2, the network management device 1 includes a first information acquisition unit 11, a second information acquisition unit 12, a first information output unit 21, a second information output unit 22, an information generation unit 30, an information processing unit 50, and a storage unit 60. The network management device 1 also includes a display unit 24 such as a display. FIG. 2 also shows the information acquisition unit 10, which includes the first information acquisition unit 11 and the second information acquisition unit 12.

The first information acquisition unit 11 is composed of an arithmetic circuit and a communication circuit. The first information acquisition unit 11 acquires information output from the IoT device 70 via the first network. Specifically, the first information acquisition unit 11 acquires identification information d1 and first network information i1 of the IoT device 70.

The identification information d1 and first network information i1 of the IoT device 70 acquired by the first information acquisition unit 11 are output to the storage unit 60 (see (b) of Figure 3). Furthermore, this identification information d1 and first network information i1 are output to the information generation unit 30 (see (c) of Figure 3).

The storage unit 60 is a storage medium that temporarily or non-temporarily stores data. Examples of storage media include flash memory, RAM (Random Access Memory), and a hard disk. The storage unit 60 stores a program that describes the operation of the network management device 1. The storage unit 60 also stores the identification information d1 and first network information i1 of the IoT device 70 output from the first information acquisition unit 11.

The information generation unit 30 is composed of an arithmetic circuit. The information generation unit 30 generates integrated authentication information ui based on the identification information d1 of the IoT device 70 and the first network information i1 output from the first information acquisition unit 11. The integrated authentication information ui includes the identification information d1 of the IoT device 70 and the first network information i1. The integrated authentication information ui generated by the information generation unit 30 is output to the first information output unit 21.

The first information output unit 21 is composed of an arithmetic circuit and a communication circuit. The first information output unit 21 outputs the integrated authentication information ui generated by the information generation unit 30 by broadcast communication (see (d) in Figure 3). For example, the first information output unit 21 outputs the integrated authentication information ui using a communication method such as BLE (Bluetooth (registered trademark) Low Energy). If the first information output unit 21 has an LED (Light Emitting Diode), the first information output unit 21 may output the integrated authentication information ui using an infrared communication method or an optical communication method.

The information generation unit 30 may generate a two-dimensional barcode such as a QR code (registered trademark) as the integrated authentication information ui (see (e) in Figure 3). When the integrated authentication information ui is generated as a two-dimensional barcode, the first information output unit 21 may output this two-dimensional barcode on the display unit 24 of the network management device 1. The first information output unit 21 may display the two-dimensional barcode on the screen of the IoT device 70, or may print and display it on paper output from the IoT device 70 (not shown).

The control device 90 is a device that requests connection to the IoT device 70. The control device 90 includes an acquisition unit 91, a transmission/reception unit 92, a calculation unit 95, and a storage unit 96. The calculation unit 95 includes a network access unit 95a.

The memory unit 96 stores identification information d2 of the control device 90 and second network information i2. The identification information d2 of the control device 90 is, for example, the logical address or physical address of the control device 90. The second network information i2 is network information of the second network specified by the control device 90.

The acquisition unit 91 acquires the integrated authentication information ui output from the first information output unit 21. The acquisition unit 91 may also acquire the integrated authentication information ui by reading the integrated authentication information ui displayed on a screen or paper using a camera of the control device 90. The acquisition unit 91 outputs the acquired integrated authentication information ui to the calculation unit 95 (see (f) in Figure 3).

The calculation unit 95 extracts the first network information i1 from the integrated authentication information ui and acquires the first network information i1.

The network access unit 95a of the calculation unit 95 accesses the first network based on this first network information i1. Specifically, the network access unit 95a accesses the first network using the SSID and password included in the first network information i1.

Furthermore, the calculation unit 95 replaces the contents of the second network information i2 stored in the storage unit 96 with the same contents as the first network information i1 and outputs it. In other words, the calculation unit 95 outputs the information included in the first network information i1 as the second network information i2 (see (g) in Figure 3).

The transmitter/receiver 92 uses the first network that has become accessible to transmit the second network information i2 and the identification information d2 of the control device 90 to the IoT device 70 (see (h) in Figure 3). In this way, the second network information i2 of the control device 90 is transmitted to the IoT device 70 at the time when the control device 90 becomes able to access the first network.

The IoT device 70 stores the second network information i2 and the identification information d2 of the control device 90 transmitted from the control device 90 in the memory of the IoT device 70. The IoT device 70 also transfers the second network information i2 transmitted from the control device 90 to the network management device 1 (see (i) in Figure 3).

The second information acquisition unit 12 shown in FIG. 2 is composed of an arithmetic circuit and a communication circuit. The second information acquisition unit 12 acquires the second network information i2 output from the control device 90 via the IoT device 70. The second information acquisition unit 12 outputs the acquired second network information i2 to the information processing unit 50 (see (j) in FIG. 3).

The information processing unit 50 is composed of an arithmetic circuit. Based on the first network information i1 and the second network information i2, the information processing unit 50 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70. For example, the information processing unit 50 obtains the above judgment result R by comparing the first network information i1 with the second network information i2.

Specifically, if the first network information i1 stored in the storage unit 60 matches the second network information i2 output from the control device 90, the information processing unit 50 outputs a G judgment that determines to connect the control device 90 to the IoT device 70. If the first network information i1 stored in the storage unit 60 does not match the second network information i2 output from the control device 90, the information processing unit 50 outputs an NG judgment that determines not to connect the control device 90 to the IoT device 70. The information processing unit 50 outputs the obtained judgment result R to the second information output unit 22 (see (k) in Figure 3).

The second information output unit 22 is composed of an arithmetic circuit and a communication circuit. The second information output unit 22 outputs the judgment result R obtained by the information processing unit 50 to the IoT device 70 (see (l) in Figure 3). The IoT device 70 transfers the judgment result R output from the second information output unit 22 to the control device 90 (see (m) in Figure 3). In other words, the second information output unit 22 outputs the judgment result R to the control device 90 via the IoT device 70. The transmitter/receiver unit 92 of the control device 90 receives this judgment result R and outputs it to the arithmetic circuit 95 (see (n) in Figure 3).

For example, if the judgment result R output from the second information output unit 22 is a G judgment, the IoT device 70 and the control device 90 perform commissioning with each other. Commissioning is a process for setting up the control device and controlled device so that they can communicate via a specified network. Commissioning is performed using a communication method such as BLE. This commissioning establishes pairing between the IoT device 70 and the control device 90, and the IoT device 70 and the control device 90 communicate with each other using a secure network based on the first network information i1.

On the other hand, if the judgment result R is an NG judgment, the IoT device 70 and the control device 90 do not perform commissioning. In this case, pairing between the IoT device 70 and the control device 90 is not established, and communication via the network is not realized. In this way, if the judgment result R is an NG judgment, it is possible to prevent, for example, the control device 90 from being unintentionally connected to the IoT device 70 and the network of the IoT device 70 from being rewritten.

The network management device 1 of this embodiment includes a first information acquisition unit 11 that acquires first network information i1 of a network specified by an IoT device 70; a first information output unit 21 that outputs the first network information i1 acquired by the first information acquisition unit 11; a second information acquisition unit 12 that acquires second network information i2 of a network specified by a control device 90 that requests connection to the IoT device 70; an information processing unit 50 that obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2; and a second information output unit 22 that outputs the judgment result R to the IoT device 70.

In this way, by obtaining a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2, it is possible to prevent, for example, the network of the IoT device 70 from being unintentionally rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

[Operations of network management device, IoT device, and control device]
The operations of the network management device, IoT device, and control device will be described with reference to FIG.

Figure 4 is a sequence diagram showing the operation of the network management device 1, IoT device 70, and control device 90.

As shown in FIG. 4, the IoT device 70 outputs the identification information d1 of the IoT device 70 and the first network information i1 to the network management device 1 (step S10).

The network management device 1 acquires the identification information d1 of the IoT device 70 and the first network information i1 from the IoT device 70 (step S11). The identification information d1 of the IoT device 70 is, for example, the logical address or physical address of the IoT device 70. The first network information i1 is network information of the first network specified by the IoT device 70. The first network information i1 includes the SSID and password for connecting to the first network.

The network management device 1 stores the identification information d1 and first network information i1 of the IoT device 70 acquired in step S11 in the storage unit 60 (step S12).

The network management device 1 generates integrated authentication information ui including the identification information d1 and first network information i1 of the IoT device 70 (step S13). Then, the network management device 1 outputs the integrated authentication information ui generated in step S13 to the outside (step S14). The network management device 1 may output the integrated authentication information ui as binary data or as a two-dimensional barcode.

The control device 90 acquires the integrated authentication information ui output from the network management device 1 (step S15).

The control device 90 acquires the first network information i1 from the integrated authentication information ui (step S16). The control device 90 accesses the first network based on the first network information i1 (step S17).

Furthermore, the control device 90 replaces the contents of its own second network information i2 with the same contents as the first network information i1 and outputs it. In other words, the control device 90 outputs the information included in the first network information i1 as the second network information i2 (step S18). At this time, the control device 90 transmits the second network information i2 to the IoT device 70 via the first network that has become accessible.

The IoT device 70 transfers the second network information i2 sent from the control device 90 to the network management device 1 (step S19). The network management device 1 acquires the second network information i2 output from the IoT device 70 (step S20).

The network management device 1 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 saved in step S12 and the second network information i2 acquired in step S20 (step S21). For example, the network management device 1 obtains the above judgment result R by comparing the first network information i1 with the second network information i2. In this example, if the first network information i1 and the second network information i2 match, the judgment result R is a G judgment, and if they do not match, the judgment result R is an NG judgment.

The network management device 1 outputs the above-mentioned judgment result R to the IoT device 70 (step S22). The IoT device 70 transfers the judgment result R output from the network management device 1 to the control device 90 (step S23). The control device 90 acquires the judgment result R output from the IoT device 70 (step S24).

For example, if the judgment result R is a G judgment, the IoT device 70 and the control device 90 perform commissioning with each other. This commissioning establishes pairing between the IoT device 70 and the control device 90, and the IoT device 70 and the control device 90 communicate with each other using a secure network based on the first network information i1.

On the other hand, if the judgment result R is an NG judgment, the IoT device 70 and the control device 90 do not perform commissioning. In this case, pairing between the IoT device 70 and the control device 90 is not established, and communication via the network is not realized. In this way, if the judgment result R is an NG judgment, it is possible to prevent, for example, the network of the IoT device 70 from being unintentionally rewritten.

By performing these steps, you can prevent IoT devices 70 from connecting to insecure networks.

[Network management device operation flow]
The operation flow of the network management device will be described with reference to FIG.

Figure 5 is a flowchart showing the operation of the network management device 1.

As shown in FIG. 5, the network management device 1 acquires the identification information d1 of the IoT device 70 and the first network information i1 from the IoT device 70 (step S111).

The network management device 1 stores the identification information d1 and first network information i1 of the IoT device 70 acquired in step S111 in the storage unit 60 (step S112).

The network management device 1 generates integrated authentication information ui including the identification information d1 of the IoT device 70 and the first network information i1 (step S113).

Then, the network management device 1 outputs the integrated authentication information ui generated in step S113 to the outside (step S114).

The network management device 1 acquires the second network information i2 transmitted from the control device 90 via the IoT device 70 (step S120).

The network management device 1 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 saved in step S112 and the second network information i2 acquired in step S120 (step S121). For example, the network management device 1 obtains the above judgment result R by comparing the first network information i1 with the second network information i2.

The network management device 1 outputs the above-mentioned determination result R to the IoT device 70 (step S122). The determination result R is transferred to the control device 90 via the IoT device 70.

For example, if the judgment result R is a G judgment, the IoT device 70 and the control device 90 communicate with each other using a secure network based on the first network information i1. On the other hand, if the judgment result R is an NG judgment, the IoT device 70 and the control device 90 do not communicate via the network.

By performing these steps, you can prevent IoT devices 70 from connecting to insecure networks.

[Control device operation flow]
The operation flow of the control device will be described with reference to FIG.

Figure 6 is a flowchart showing the operation of the control device 90.

As shown in FIG. 6, the control device 90 acquires the integrated authentication information ui generated by the network management device 1 (step S115).

The control device 90 acquires the first network information i1 from the integrated authentication information ui (step S116).

The control device 90 accesses the first network based on the first network information i1 (step S117).

The control device 90 replaces the contents of its own second network information i2 with the same contents as the first network information i1 and outputs it. In other words, the control device 90 outputs the information contained in the first network information i1 as the second network information i2 (step S118).

The control device 90 transmits the second network information i2 to the IoT device 70 via the first network that has become accessible (step S118A).

The second network information i2 transmitted from the IoT device 70 is output to the network management device 1 via the IoT device 70. The network management device 1 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 included in the integrated authentication information ui and the second network information i2 output by the control device 90.

The control device 90 acquires the judgment result R output from the network management device 1 via the IoT device 70 (step S124).

If the judgment result R is a G judgment, the control device 90 performs commissioning with the IoT device 70. This commissioning establishes pairing between the IoT device 70 and the control device 90, and the IoT device 70 and the control device 90 communicate with each other using a secure network based on the first network information i1.

On the other hand, if the judgment result R is an NG judgment, the control device 90 does not perform commissioning with the IoT device 70. The control device 90 is not paired with the IoT device 70 and is unable to communicate with the IoT device 70 via the network. In this case, the control device 90 may display information indicating that pairing has not been established on the screen of the control device 90.

By performing these steps, you can prevent IoT devices 70 from connecting to insecure networks.

[Modification 1]
A network management system 5A according to a first modification of the embodiment will be described with reference to Fig. 8 and Fig. 9. In the first modification, an example in which the network management device 1 is provided in an IoT device 70A will be described.

FIG. 7 is a diagram showing an example of an IoT device 70A according to a first variation of the embodiment.

The IoT device 70A shown in FIG. 7 is, for example, a refrigerator. The IoT device 70A includes a network management device 1 and a display input unit 74. The display input unit 74 is, for example, a touch panel, and functions as a user interface.

Figure 8 is a block diagram of IoT device 70A and control device 90 in Modification 1. Figure 9 is a diagram showing the flow of information in IoT device 70A and control device 90 in Modification 1.

As shown in Figures 8 and 9, the network management system 5A of variant 1 includes an IoT device 70A and a control device 90.

As shown in FIG. 8, the network management device 1 includes a first information output unit 21, a second information output unit 22, an information generation unit 30, an information acquisition unit 10, an information processing unit 50, and a storage unit 60.

The storage unit 60 stores a program that describes the operation of the IoT device 70A. The storage unit 60 also stores identification information d1 and first network information i1 for the IoT device 70A.

By receiving a predetermined operation input via the display input unit 74, the IoT device 70A outputs the identification information d1 and first network information i1 of the IoT device 70A stored in the memory unit 60 to the information generation unit 30 (see (c) in Figure 9).

The information generation unit 30 generates integrated authentication information ui based on the identification information d1 and first network information i1. The integrated authentication information ui generated by the information generation unit 30 is output to the first information output unit 21.

The first information output unit 21 outputs the integrated authentication information ui generated by the information generation unit 30 (see (d) in Figure 9). Specifically, the first information output unit 21 outputs the integrated authentication information ui, which includes the identification information d1 and the first network information i1, via broadcast communication.

The information generation unit 30 may generate a two-dimensional barcode such as a QR code (registered trademark) as the integrated authentication information ui (see (e) of Figure 9). When the integrated authentication information ui is generated as a two-dimensional barcode, the first information output unit 21 may output this two-dimensional barcode to the display input unit 74 of the IoT device 70A. The first information output unit 21 may also print and display the two-dimensional barcode on paper output from the IoT device 70A (not shown).

The control device 90 is a device that requests a connection to the IoT device 70A. The control device 90 includes an acquisition unit 91, a transmission/reception unit 92, a calculation unit 95, and a storage unit 96. The calculation unit 95 includes a network access unit 95a.

The acquisition unit 91 acquires the integrated authentication information ui output from the first information output unit 21. The acquisition unit 91 outputs the acquired integrated authentication information ui to the calculation unit 95 (see (f) in Figure 9).

The calculation unit 95 extracts the first network information i1 from the integrated authentication information ui and acquires the first network information i1.

Furthermore, the calculation unit 95 replaces the contents of the second network information i2 stored in the memory unit 96 with the same contents as the first network information i1 and outputs it. In other words, the calculation unit 95 outputs the information included in the first network information i1 as the second network information i2 (see (g) in Figure 9). The network access unit 95a of the calculation unit 95 accesses the first network based on this first network information i1.

The transmitter/receiver 92 uses the now accessible first network to transmit the second network information i2 and the identification information d2 of the control device 90 to the IoT device 70A (see (h) in Figure 9).

The information acquisition unit 10 of the IoT device 70A acquires the second network information i2 output from the control device 90. The information acquisition unit 10 outputs the acquired second network information i2 to the information processing unit 50 (see (j) in Figure 9).

The information processing unit 50 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70A based on the first network information i1 and the second network information i2. For example, the information processing unit 50 obtains the above judgment result R by comparing the first network information i1 with the second network information i2.

Specifically, if the first network information i1 stored in the storage unit 60 matches the second network information i2 output from the control device 90, the information processing unit 50 outputs a G judgment, determining that the control device 90 should be connected to the IoT device 70A. If the first network information i1 stored in the storage unit 60 does not match the second network information i2 output from the control device 90, the information processing unit 50 outputs an NG judgment, determining that the control device 90 should not be connected to the IoT device 70A. The information processing unit 50 outputs the obtained judgment result R to the second information output unit 22 (see (k) in Figure 9).

The second information output unit 22 transmits the judgment result R obtained by the information processing unit 50 to the control device 90 (see (m) in Figure 9). The transmitter/receiver unit 92 of the control device 90 receives this judgment result R and outputs it to the calculation unit 95 (see (n) in Figure 9).

For example, if the judgment result R output from the second information output unit 22 is a G judgment, the IoT device 70A and the control device 90 perform commissioning with each other. This commissioning establishes pairing between the IoT device 70A and the control device 90, and the IoT device 70A and the control device 90 communicate with each other using a secure network based on the first network information i1.

On the other hand, if the judgment result R is an NG judgment, the IoT device 70A and the control device 90 do not perform commissioning. In this case, pairing between the IoT device 70A and the control device 90 is not established, and communication via the network is not realized. In this way, if the judgment result R is an NG judgment, it is possible to prevent, for example, the network of the IoT device 70A from being unintentionally rewritten.

The IoT device 70A of variant 1 includes a first information output unit 21 that outputs first network information i1 of a network specified by the IoT device 70A, an information acquisition unit 10 that acquires second network information i2 of a network specified by a control device 90 that requests connection to the IoT device 70A, an information processing unit 50 that obtains a determination result R indicating whether or not to connect the control device 90 to the IoT device 70A based on the first network information i1 and the second network information i2, and a second information output unit 22 that outputs the determination result R.

In this way, by obtaining a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70A based on the first network information i1 and the second network information i2, it is possible to prevent, for example, the network of the IoT device 70A from being unintentionally rewritten. This makes it possible to prevent the IoT device 70A from being connected to an unsecure network.

[Modification 2]
A network management system 5 according to a second modification of the embodiment will be described. In the second modification, an example will be described in which a determination result R indicating whether or not to connect a control device 90 to an IoT device 70 is obtained based on the security strength of the second network.

The network management system 5 of variant 2 includes a network management device 1, an IoT device 70, and a control device 90, similar to the embodiment (see Figure 2).

The network management device 1 of Variation 2, like the embodiment, includes a first information acquisition unit 11, a second information acquisition unit 12, a first information output unit 21, a second information output unit 22, an information generation unit 30, an information processing unit 50, and a storage unit 60. The network management device 1 also includes a display unit 24 such as a display.

The control device 90 comprises an acquisition unit 91, a transmission/reception unit 92, a calculation unit 95, and a memory unit 96. The memory unit 96 stores identification information d2 and second network information i2 of the control device 90. The second network information i2 is network information that was stored in the control device 90 before the control device 90 received the first network information i1 from the network management device 1.

FIG. 10 is a sequence diagram showing the operation of the network management device 1, IoT device 70, and control device 90 in the second variation of the embodiment.

As shown in FIG. 10, the IoT device 70 outputs the identification information d1 of the IoT device 70 and the first network information i1 to the network management device 1 (step S10).

The network management device 1 acquires the identification information d1 of the IoT device 70 and the first network information i1 from the IoT device 70 (step S11). The first network information i1 in variant 2 includes the SSID and password for connecting to the first network, and further includes information regarding the security strength of the first network.

The network management device 1 stores the identification information d1 and first network information i1 of the IoT device 70 acquired in step S11 in the storage unit 60 (step S12).

The network management device 1 generates integrated authentication information ui including the identification information d1 and the first network information i1 of the IoT device 70 (step S13). The network management device 1 then outputs the integrated authentication information ui generated in step S13 to the outside (step S14).

The control device 90 acquires the integrated authentication information ui output from the network management device 1 (step S15).

The control device 90 acquires the first network information i1 from the integrated authentication information ui (step S16). The control device 90 accesses the first network based on the first network information i1 (step S17).

The control device 90 of Variation 2 does not replace the contents of its own second network information i2 with the first network information i1, but outputs the second network information i2 stored in the storage unit 96 (step S18B). The control device 90 transmits the second network information i2 to the IoT device 70 via the first network that has become accessible. The second network information i2 of Variation 2 includes the SSID and password for connecting to the second network, as well as information regarding the security strength of the second network.

The IoT device 70 transfers the second network information i2 sent from the control device 90 to the network management device 1 (step S19). The network management device 1 acquires the second network information i2 output from the IoT device 70 (step S20).

The network management device 1 obtains a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 saved in step S12 and the second network information i2 acquired in step S20 (step S21).

For example, the network management device 1 obtains the above judgment result R by comparing the security strength of the first network information i1 with the security strength of the second network information i2. The security strength is determined based on whether the network encryption method is based on a highly secure standard such as WPA (Wi-Fi Protected Access). In this example, if the security strength of the second network information i2 is equivalent to that of the first network information i1, the judgment result R will be a G judgment. On the other hand, if the security strength of the second network information i2 is lower than the security strength of the first network information i1, the judgment result R will be an NG judgment.

The network management device 1 outputs the above determination result R to the IoT device 70 (step S22).

The IoT device 70 transfers the judgment result R output from the network management device 1 to the control device 90 (step S23).

The control device 90 acquires the judgment result R output from the IoT device 70 (step S24).

For example, if the judgment result R is a G judgment, the IoT device 70 and the control device 90 perform commissioning with each other. This commissioning establishes pairing between the IoT device 70 and the control device 90, and the IoT device 70 and the control device 90 communicate with each other using a secure second network based on the second network information i2.

On the other hand, if the judgment result R is an NG judgment, the IoT device 70 and the control device 90 do not perform commissioning. In this case, pairing between the IoT device 70 and the control device 90 is not established, and communication over the network is not realized. In this way, if the judgment result R is an NG judgment, it is possible to prevent the network of the IoT device 70 from being rewritten into a network with low security.

By performing these steps, you can prevent IoT devices 70 from connecting to insecure networks.

(summary)
1 illustrates a network management device according to an embodiment of the present disclosure.

The network management device 1 of Example 1 includes a first information acquisition unit 11 that acquires first network information i1 of a network specified by an IoT device 70, a first information output unit 21 that outputs the first network information i1 acquired by the first information acquisition unit 11, a second information acquisition unit 12 that acquires second network information i2 of a network specified by a control device 90 that requests connection to the IoT device 70, an information processing unit 50 that acquires a determination result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2, and a second information output unit 22 that outputs the determination result R to the IoT device 70.

In this way, by obtaining a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2, it is possible to prevent, for example, the network of the IoT device 70 from being unintentionally rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

The network management device 1 of Example 2 is the network management device described in Example 1, in which the control device 90 acquires the first network information i1 output from the first information output unit 21 and outputs the first network information i1 as second network information i2, and the second information acquisition unit 12 acquires the second network information i2 output from the control device 90.

In this way, by outputting the first network information i1 as the second network information i2, it is possible to prevent the network of the IoT device 70 from being rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

The network management device 1 of Example 3 is the network management device described in Example 1 or 2, and the information processing unit 50 may obtain the judgment result R by comparing the first network information i1 with the second network information i2.

In this way, by comparing the first network information i1 with the second network information i2, an appropriate judgment result R can be obtained. This makes it possible to prevent the IoT device 70 from connecting to an unsecure network.

The network management device 1 of Example 4 is the network management device described in Example 3, and further includes a storage unit 60 in which first network information i1 is stored. The information processing unit 50 may obtain a judgment result R that determines to connect the control device 90 to the IoT device 70 when the first network information i1 stored in the storage unit 60 matches the second network information i2 output from the control device 90.

In this way, if the first network information i1 stored in the storage unit 60 matches the second network information i2 output from the control device 90, it is determined that the control device 90 should be connected to the IoT device 70, thereby preventing the network of the IoT device 70 from being rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

The network management device 1 of Example 5 is the network management device described in any of Examples 1 to 4, in which the second information acquisition unit 12 acquires second network information i2 output from the control device 90 via the IoT device 70, and the second information output unit 22 may output the determination result R to the control device 90 via the IoT device 70.

In this way, by outputting the second network information i2 and information related to the judgment result R via the IoT device 70, the information necessary to build the network can also be notified to the IoT device 70. This makes it possible to prevent the IoT device 70 from connecting to an unsecure network.

The network management device 1 of Example 6 is the network management device described in any of Examples 1 to 5, and further includes an information generation unit 30 that generates integrated authentication information ui that includes first network information i1 and identification information d1 of the IoT device 70. The first information output unit 21 outputs the integrated authentication information ui generated by the information generation unit 30 to the control device 90, and the control device 90 may acquire the first network information i1 from the integrated authentication information ui.

By generating and outputting the integrated authentication information ui in this manner, it is possible to reduce the number of times data is read by the control device 90, for example.

The network management system 5 of Example 7 includes the network management device 1 described in any one of Examples 1 to 6 and an IoT device 70. The IoT device 70 pairs with the control device 90 when a determination result R is obtained indicating that the control device 90 should be connected to the IoT device 70.

This network management system 5 can prevent IoT devices 70 from being connected to an unsecure network.

The network management system 5 of Example 8 is the network management system described in Example 7, and the IoT device 70 may receive the second network information i2 output from the control device 90 and transfer it to the second information acquisition unit 12, and may also receive the judgment result R output from the second information output unit 22 and transfer it to the control device 90.

In this way, by transferring the second network information i2 and information related to the judgment result R via the IoT device 70, the information necessary to build the network can also be notified to the IoT device 70. This makes it possible to prevent the IoT device 70 from connecting to an unsecure network.

The network management system 5 of Example 9 is the network management system described in Example 7 or 8, and the IoT device 70 may output the first network information i1 to the first information acquisition unit 11 by receiving a predetermined operation input.

This makes it possible to connect the control device 90 to the IoT device 70 when, for example, a specified operation input is received via a user interface.

The network management system 5 of Example 10 is the network management system described in any of Examples 7 to 9, and further includes a control device 90 that requests a connection to the IoT device 70. The control device 90 accesses the IoT device 70 based on the first network information i1, and outputs second network information i2 to the IoT device 70, and the IoT device 70 may output the second network information i2 output from the control device 90 to the network management device 1.

As a result, the second network information i2 of the control device 90 can be transmitted to the IoT device 70 at the time the control device 90 becomes able to access the first network. This makes it possible to output the second network information i2 to the network management device 1. This allows the network management device 1 to determine whether or not to connect the control device 90 to the IoT device 70.

The network management system 5 of Example 11 is the network management system described in Example 10, and when the information processing unit 50 obtains a judgment result R indicating that the control device 90 should be connected to the IoT device 70, the IoT device 70 and the control device 90 may communicate using a network based on the first network information i1.

This allows the IoT device 70 and control device 90 to communicate with each other using a secure network.

The network management system 5 of Example 12 is the network management system described in Example 10, and when the information processing unit 50 obtains a judgment result R indicating that the control device 90 should be connected to the IoT device 70, the IoT device 70 and the control device 90 may communicate based on network information stored in the control device 90 before the control device 90 received the first network information i1.

As a result, for example, if the network based on the network information stored in the control device 90 is a secure network, the IoT device 70 and the control device 90 can communicate with each other using this secure network.

The network management system 5 of Example 13 is the network management system described in any of Examples 7 to 9, and further includes a control device 90 that requests a connection to the IoT device 70. The control device 90 may output information included in the first network information i1 output from the first information output unit 21 as second network information i2.

In this way, by outputting the information contained in the first network information i1 as the second network information i2, it is possible to prevent the network of the IoT device 70 from being rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

The IoT device 70A of Example 14 includes a first information output unit 21 that outputs first network information i1 of a network specified by the IoT device 70A, an information acquisition unit 10 that acquires second network information i2 of a network specified by a control device 90 that requests connection to the IoT device 70A, an information processing unit 50 that obtains a determination result R indicating whether or not to connect the control device 90 to the IoT device 70A based on the first network information i1 and the second network information i2, and a second information output unit 22 that outputs the determination result R to the control device 90.

In this way, by obtaining a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70A based on the first network information i1 and the second network information i2, it is possible to prevent, for example, the network of the IoT device 70A from being unintentionally rewritten. This makes it possible to prevent the IoT device 70A from being connected to an unsecure network.

The network management method of Example 15 includes the steps of outputting first network information i1 of a network specified by the IoT device 70, acquiring second network information i2 of a network specified by a control device 90 requesting connection to the IoT device 70, obtaining a determination result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2, and outputting the determination result R to the IoT device 70.

In this way, by obtaining a judgment result R indicating whether or not to connect the control device 90 to the IoT device 70 based on the first network information i1 and the second network information i2, it is possible to prevent, for example, the network of the IoT device 70 from being unintentionally rewritten. This makes it possible to prevent the IoT device 70 from being connected to an unsecure network.

(Other embodiments)
Although the embodiments have been described above, the present disclosure is not limited to the above-described embodiments.

In the above, examples have been given in which IoT device 70 is an electrical device such as a refrigerator, television, projector, printer, or copier, but this is not limited to this. For example, IoT device 70 may also be an electrical device such as a lighting device, air conditioner, air purifier, hair dryer, refrigerator, microwave oven, or electric kettle.

In the above, examples have been given of spaces in which IoT devices 70 are placed, such as common spaces in an office, conference rooms, guest rooms, and rental rooms in a building, but this is not limited to these. For example, the space in which IoT devices 70 are placed may be a floor of a house, apartment building, or facility.

In the above example, software compatible with the Matter standard is pre-installed on the control device 90, but this is not limiting. For example, the control device 90 may install software compatible with the Matter standard by downloading application software compatible with the Matter standard.

In the above example, the information generation unit 30 generates a two-dimensional barcode as the integrated authentication information ui, but this is not limited to this. For example, the information generation unit 30 may enter the integrated authentication information ui into an NFC (Near Field Communication) tag, and the first information output unit 21 may output the integrated authentication information ui via the NFC tag.

In the above example, the first network information i1 includes an SSID and a password, but the first network information i1 may include only the SSID and not the password. In this case, the integrated authentication information ui does not include a password, but the user may obtain the password via a route other than the network management device 1. If the integrated authentication information ui acquired by the control device 90 does not include a password, the control device 90 may display a screen requesting entry of a password. The control device 90 may be able to access the first network when the user enters a password.

In addition, this disclosure also includes forms obtained by applying various modifications to the embodiments that would occur to those skilled in the art, as well as forms realized by arbitrarily combining the components and functions of each embodiment within the scope of the spirit of this disclosure.

1 Network management device 5, 5A Network management system 10 Information acquisition unit 11 First information acquisition unit 12 Second information acquisition unit 21 First information output unit 22 Second information output unit 24 Display unit 30 Information generation unit 50 Information processing unit 60 Storage unit 70, 70A IoT device 74 Display input unit 90 Control device 91 Acquisition unit 92 Transmitting/receiving unit 95 Calculation unit 95a Network access unit 96 Storage unit d1, d2 Identification information i1 First network information i2 Second network information R Determination result ui Integrated authentication information

Claims (15)

a first information acquisition unit that acquires first network information of a network designated by an IoT (Internet of Things) device;
a first information output unit that outputs the first network information acquired by the first information acquisition unit;
a second information acquisition unit that acquires second network information of a network designated by a control device that requests connection to the IoT device;
an information processing unit that obtains a determination result indicating whether or not to connect the control device to the IoT device based on the first network information and the second network information;
a second information output unit that outputs the determination result to the IoT device;
A network management device comprising: the control device acquires the first network information output from the first information output unit and outputs the first network information as the second network information;
The network management device according to claim 1 , wherein the second information acquisition unit acquires the second network information output from the control device. The network management device according to claim 1 , wherein the information processing unit obtains the determination result by comparing the first network information with the second network information. Further, a storage unit for storing the first network information is provided,
The network management device of claim 3, wherein the information processing unit obtains the judgment result that determines to connect the control device to the IoT device when the first network information stored in the memory unit matches the second network information output from the control device. The second information acquisition unit acquires the second network information output from the control device via the IoT device,
The network management device according to claim 1 , wherein the second information output unit outputs the determination result to the control device via the IoT device. further comprising an information generating unit that generates integrated authentication information including the first network information and identification information of the IoT device;
the first information output unit outputs the integrated authentication information generated by the information generation unit to the control device;
The network management device according to claim 1 , wherein the control device acquires the first network information from the integrated authentication information. A network management device according to any one of claims 1 to 6;
The IoT device;
A network management system comprising:
The IoT device pairs with the control device when the determination result indicates that the control device should be connected to the IoT device. The network management system according to claim 7, wherein the IoT device receives the second network information output from the control device and transfers it to the second information acquisition unit, and receives the judgment result output from the second information output unit and transfers it to the control device. The network management system according to claim 7 , wherein the IoT device outputs the first network information to the first information acquisition unit by receiving a predetermined operation input. Further, a control device that requests a connection to the IoT device is provided,
the control device accesses the IoT device based on the first network information, and outputs the second network information to the IoT device;
The network management system according to claim 7 , wherein the IoT device outputs the second network information output from the control device to the network management device. The network management system according to claim 10, wherein when the information processing unit obtains a judgment result that the control device should be connected to the IoT device, the IoT device and the control device communicate using a network based on the first network information. 11. The network management system according to claim 10, wherein when the information processing unit obtains the judgment result that the control device should be connected to the IoT device, the IoT device and the control device communicate based on network information that was stored in the control device before the control device received the first network information. The control device further includes a control device that requests a connection to the IoT device,
The network management system according to claim 7 , wherein the control device outputs, as the second network information, information included in the first network information output from the first information output unit. An IoT (Internet of Things) device,
a first information output unit that outputs first network information of a network designated by the IoT device;
an information acquisition unit that acquires second network information of a network designated by a control device that requests connection to the IoT device;
an information processing unit that obtains a determination result indicating whether or not to connect the control device to the IoT device based on the first network information and the second network information;
a second information output unit that outputs the determination result to the control device;
IoT device equipped with: outputting first network information of a network designated by an IoT (Internet of Things) device;
acquiring second network information of a network designated by a control device requesting connection to the IoT device;
obtaining a determination result indicating whether to connect the control device to the IoT device based on the first network information and the second network information;
outputting the determination result to the IoT device;
A network management method comprising: