JP5784059B2 - Communication control method, local device, information processing terminal, communication path establishment support device, and program - Google Patents

Description

  The present invention relates to a communication control method, a local device, an information processing terminal, a communication path establishment support device, and a program, and in particular, a local device connected to a local area network and an information processing connected to a network different from the local area network. The present invention relates to a communication control method for establishing a communication path with a terminal.

  In Patent Document 1, when data is transferred from a transmission side terminal to a reception side terminal, the sender and the receiver perform user registration with the communication support apparatus, and the data is transmitted via the relay server. What is transferred from the side terminal to the receiving side terminal is described.

  In Patent Document 2, the user terminal performs user authentication with the video usage management server, the video usage management server registers the user with the video providing server, and the user terminal receives a service provided from the video providing server. Things are listed.

  Patent Document 3 describes that a proxy server relays and establishes a communication path between an access terminal and a user home device. Communication between the access terminal and the proxy server is objectively proved by the proxy certificate from the certificate authority. Communication between the proxy server and the user home device is proved by a user certificate based on the self-signature of the user home device.

  Japanese Patent Laid-Open No. 2004-26883 describes a device in which an individual ID of a terminal is registered in a server, and access to the server is managed based on the presence or absence of the registration.

JP 2005-80249 A JP 2012-108739 A JP 2007-334753 A JP 2003-345754 A

  Whether or not to allow access from the information processing terminal to the server is particularly determined by a server (hereinafter referred to as “local server”) in a local area network (hereinafter also referred to as “LAN”). This is important in a server that distributes content such as video to an information processing terminal. The local server is a terminal in a network different from the LAN (for example, a terminal that can connect to the global network and establish a communication path with the LAN, or connect to another LAN and pass through the global area network. If a communication path is established with a terminal that can establish a communication path with the LAN, not only the security of the local server itself becomes a problem, but also the local server It is possible to access the information processing apparatus in the LAN via the network. Therefore, allowing the local server to access from an information processing terminal outside the LAN may cause a security problem for the entire information processing apparatus in the LAN.

  For example, a home server or the like is assumed to be used at home. The server administrator is assumed to be an amateur and cannot expect advanced skills and knowledge. Therefore, in order to manage the local server, it is desirable that advanced skills and knowledge about the local server and the information processing terminal are not required, and instructions from the server administrator and the user of the information processing terminal should be kept simple. .

  In the technique described in Patent Document 1, security is ensured by the communication support apparatus, and data access is routed through the relay server, so security of the entire LAN is also ensured. However, the transmission side terminal and the reception side terminal need to perform user registration. Such user registration generally uses a password or the like. Users often lose or forget passwords. Therefore, in daily use, the burden on the server administrator and the user of the information processing terminal is large. In addition, since data is transmitted and received via the relay server, the load on the relay server increases. Further, the transmission side terminal needs to make the same data exist in the relay server and maintain the state.

  The technology described in Patent Document 2 does not require advanced knowledge / skills from the administrator of the video providing server in the home or the like in that the video usage management server authenticates the user instead of the video providing server. However, similarly to the technique described in Patent Document 1, the technique described in Patent Document 2 pays attention to people, and the burden on the information processing terminal user and the like is large in daily operation. Furthermore, individual access cannot be managed by the information processing terminal in the moving image providing server. Therefore, the degree of freedom of management by the server administrator is reduced.

  The technique described in Patent Document 3 focuses on hardware, and the burden on the server administrator and the user of the information processing terminal in daily operation is reduced. However, security within the LAN is ensured by the self-signature of the user home device. For this reason, the server administrator is required to have advanced knowledge and skills.

  Similarly to the technique described in Patent Document 3, the technique described in Patent Document 4 focuses on hardware. However, since access to the terminal is permitted if registered in the local server, it is assumed that the server administrator has a certain knowledge about the local server and the terminal in order to ensure the safety of the local server. . Therefore, high-level knowledge and skills are expected from the server administrator.

  Therefore, the present invention provides an information processing terminal that secures security for a local device in a LAN, such as a local server, without requiring a high level of knowledge and skill for an administrator and connects to a network different from this LAN. An object of the present invention is to propose a communication control method suitable for enabling connection to a local device in a LAN.

  A first aspect of the present invention is a communication control method for controlling whether or not a communication path between an information processing terminal and a local device connected to a local area network is established, the local area network An authentication unit provided in an authentication server connected to a different network, an authentication step for authenticating one or a plurality of information processing terminals, a local registration unit provided in the local device, a local device storage unit provided in the local device, A local registration step for registering one or a plurality of information processing terminals authenticated by the authentication server, and a terminal communication control means provided in an information processing terminal connected to a network different from the local area network are provided in the local device. When a communication path establishment request is sent to the local device, A local communication control unit that allows the local device storage unit to establish a communication path between the information processing terminal and the local device when the information processing terminal is registered in the local device storage unit; Including a communication path establishment control step for refusing to establish a communication path between the information processing terminal and the local device when the information processing terminal is not registered in the device storage unit It is.

  A second aspect of the present invention is a communication control method according to the first aspect, wherein, in the local registration step, the information processing terminal is connected to the local area network, and the local apparatus includes The local registration means obtains identification information of the information processing terminal from the information processing terminal connected to the local area network and registers it in the local device storage means.

  A third aspect of the present invention is the communication control method according to the second aspect, wherein, in the authentication step, the authentication means assigns device identification information to each of the information processing terminals, and In the registration step, the local registration unit registers the device identification information given from the authentication unit as identification information of the information processing terminal from the information processing terminal.

  A fourth aspect of the present invention is the communication control method according to any one of the first to third aspects, wherein in the communication path establishment control step, the support means for connecting to a network different from the local area network includes: When the information processing terminal is authenticated by the authentication server when the information processing terminal makes the communication path establishment request in a state of being connected to a network different from the local area network, the information processing terminal and the information processing terminal It supports NAT traversal for establishing a communication path with a local device.

  According to a fifth aspect of the present invention, there is provided a communication control method according to the fourth aspect, wherein, in the authentication step, the authentication means provides device identification information for identifying the local device to the local device. In the local registration step, terminal registration means included in the information processing terminal registers device identification information of the local device, and in the communication path establishment control step, the information processing terminal The support unit is notified of the device identification information of the local device, and the support unit obtains information for accessing the local device using the device identification information of the local device, and sends the information to the terminal communication control unit. On the other hand, the local device is communicated as a connection destination, and a communication path between the information processing terminal and the local device It is intended to support the NAT traversal to establish.

  A sixth aspect of the present invention is a local device connected to a local area network, which stores one or more information processing terminals authenticated by an authentication server connected to a network different from the local area network. A local communication control unit that controls whether to establish a communication path between the storage unit and the information processing terminal that has requested communication path establishment, and the local communication control unit is a network different from the local area network When the terminal communication control means included in the information processing terminal connected to the local device makes a communication path establishment request to the local device, the information processing terminal is not registered in the local device storage means. It is characterized by refusing to establish a communication path with a terminal.

  A seventh aspect of the present invention is an information processing terminal that makes a communication path establishment request to a local device connected to a local area network, and for an authentication server connected to a network different from the local area network, Terminal authentication processing means for requesting authentication of the information processing terminal; terminal local registration (LR) processing means for requesting registration of the information processing terminal to local registration means included in the local device; and the local area Terminal communication control means for making a communication path establishment request to the local device while connected to a network different from the network is provided.

  An eighth aspect of the present invention is a communication path establishment support apparatus that supports an information processing terminal to establish a communication path with a local apparatus connected to a local area network, wherein the information processing terminal When the information processing terminal is authenticated by an authentication server connected to a network different from the local area network when a connection request is made to the local device while connected to a network different from the local area network The information processing terminal further includes support means for supporting NAT traversal for establishing a communication path with the local device.

  According to a ninth aspect of the present invention, there is provided one or a plurality of information processing terminals in which a computer connected to a local area network is authenticated by an authentication server connected to a network different from the local area network with respect to local device storage means. Is stored as an information processing terminal capable of establishing a communication path with the computer in a state of being connected to a network different from the local area network.

  According to a tenth aspect of the present invention, there is provided terminal authentication processing means for requesting authentication of a computer to an authentication server that connects the computer to a network different from a local area network to which the local device is connected. A terminal LR processing means for requesting registration of the computer to the local registration means, and a terminal communication control for making a communication path establishment request to the local device while connected to a network different from the local area network. It is a program for functioning as a means.

  Note that the present invention may be regarded as a program for causing a computer to function as the communication path establishment support device described in the eighth aspect. Further, the present invention may be regarded as a computer-readable recording medium that regularly records the program described in the ninth or tenth aspect.

  According to each aspect of the present invention, a communication path between a local device and an information processing terminal is established on the premise of authentication by an authentication server for a device. Therefore, since the focus is on the device without focusing on the person, the burden on the person is reduced. Furthermore, the safety of the device can be managed by an expert using the authentication server. The administrator of the local device does not require any special knowledge or skill. Further, as local registration, the administrator of the local device registers information that permits communication from outside the LAN for each information processing terminal. An administrator can control whether or not each information processing terminal can be accessed from outside the LAN by an intuitive operation focusing on a device called an information processing terminal. In this way, while reducing the burden on the user, not only the reliability with which the expert manages the device but also the reliability with which the user intuitively determines whether or not the connection is possible is ensured from outside the LAN. It becomes possible to manage access.

  Further, according to the second aspect of the present invention, the local registration is performed in a state where the information processing terminal is connected to the LAN. If the information processing terminal is in the same LAN, the local device can know and access the address of the information processing terminal. Furthermore, it is necessary for the information processing terminal not only to be authenticated by the authentication server but also to be connected to the same LAN as the local device, so that safety can be ensured.

  Furthermore, according to the third aspect of the present invention, by using the identification information given to each information processing terminal in the authentication by the authentication server, it is possible to register only those that have been reliably authenticated by the authentication server. It becomes possible.

  Further, according to the fourth and eighth aspects of the present invention, the communication path establishment support means or the like supports NAT traversal from outside the LAN on the assumption that the information processing terminal is authenticated by the authentication server. Generally, in order to realize NAT traversal, it is necessary to use a server outside the LAN. Whether or not to support NAT traversal can be controlled depending on the presence or absence of authentication, and it is possible to further ensure safety.

  Furthermore, according to the fifth aspect of the present invention, the local device is also authenticated by the authentication server, and safety is improved. Furthermore, since the information processing terminal is connected to the local device using the device identification information given to the local device by the authentication server, and further assumes that both the information processing terminal and the local device are authenticated. Even if information (endpoint) for connecting to the local device leaks, it becomes difficult to enter the LAN. Furthermore, it is possible to realize the server side and client side application software as a similar system.

It is a block diagram which shows an example of the state in which local registration is performed about the structure of the content delivery system 1 which concerns on this invention. It is a block diagram which shows an example of the state which delivers a content about the structure of the content delivery system 1 which concerns on this invention. FIG. 3 is a flowchart showing overall processing in the content distribution system 1 of FIGS. 1 and 2. It is a sequence diagram which shows the example of the process in the local registration of step ST2 of FIG. It is a figure which shows an example of the process which deletes the locally registered device of step ST4 of FIG. It is a figure which shows another example of the process which deletes the locally registered device of step ST4 of FIG. It is a sequence diagram which shows the example of the process for implement | achieving the content delivery service of step ST6-9 of FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The present invention is not limited to this embodiment.

  FIG. 1 is a block diagram illustrating an example of the configuration of the content distribution system 1 in a state where local registration is performed. FIG. 2 is a block diagram showing an example of the configuration of the content distribution system 1 in a state where content is distributed.

  1 and 2 includes an information processing terminal 5 (an example of an “information processing terminal” in the claims of the present application), a local device 7 (an example of the “local device” in the claims of the present application), an authentication server, and the like. 9 (an example of “authentication server” in the claims of the present application), a NAT traversal support server 11 (an example of “communication path establishment support device” in the claims of the present application), and a NAT 12.

  The information processing terminal 5 includes a terminal authentication processing unit 13 (an example of “terminal authentication processing unit” in the claims of the present application), a terminal authentication storage unit 15, and a terminal communication control unit 17 (“terminal communication control unit” of the present application claims). ), A terminal registration unit 19 (an example of “terminal registration unit” in the claims of the present application), a terminal device storage unit 21 (an example of “terminal device storage unit” in the claims of the present application), and a terminal LR processing unit 23 (An example of “terminal LR processing means” in the claims of the present application) and a terminal distribution processing unit 25. The RAG-CP 27 is a combination of the terminal communication control unit 17, the terminal registration unit 19, and the terminal device storage unit 21. A combination of the terminal LR processing unit 23 and the terminal distribution processing unit 25 is a DMP 29.

  The local device 7 includes a local authentication processing unit 31, a local authentication storage unit 33, a local communication control unit 35 (an example of “local communication control unit” in the claims of the present application), and a local registration unit 37 (“ An example of “local registration unit”, a local device storage unit 39 (an example of “local device storage unit” in the claims of the present application), a local LR processing unit 41, and a local distribution processing unit 43. A combination of the local communication control unit 35, the local registration unit 37, and the local device storage unit 39 is RAG-D45. A combination of the local LR processing unit 41 and the local distribution processing unit 43 is a DMS 47.

  The authentication server 9 includes an authentication unit 49 (an example of “authentication unit” in the claims). The NAT traversal support server 11 includes STUN 50 and SIP 51 (a combination of STUN 50 and SIP 51 is an example of “support means” in the claims of the present application) and TURN 52. The STUN 50 detects a global IP address and a mapping port that can be connected to the NAT type where the device is located. The SIP 51 relays an ICE message for establishing a P2P tunnel between RAGs. The TURN 52 relays when the P2P communication path cannot be established.

  In FIG. 1, both the information processing terminal 5 and the local device 7 exist in the LAN 3 (an example of “local area network” in the claims of the present application). Here, when an information processing apparatus exists in the LAN 3, the information processing apparatus converts identification information on the network when communicating with another information processing apparatus existing in the LAN 3. (That is, for example, in the Internet protocol, NAT 12 does not need to perform network address conversion of an IP address), and that an information processing apparatus does not exist in LAN 3 means that the information processing When a device communicates with another information processing device existing in the LAN 3, it is necessary to convert identification information on the network (that is, for example, in the Internet protocol, the NAT 12 It means that the IP address needs to be converted into an external IP address). An information processing device connected to the LAN 3 means a case where the information processing device exists in the LAN 3, and a certain information processing device connected to another network other than the LAN 3 does not exist in the LAN 3, and the global network It is assumed that this means a state in which an information processing apparatus in the LAN 3 can be accessed by connecting to another network.

  On the other hand, in FIG. 2, the local device 7 exists in the LAN 3, and the information processing terminal 5 does not exist in the LAN. The information processing terminal 5 and the local device 7 construct a secure tunnel using the NAT traversal technology with the support of the NAT traversal support server 11. The local device 7 distributes content to the information processing terminal 5 as a local server. When both the information processing terminal 5 and the local device 7 exist in the LAN 3, the local device 7 and the information processing terminal 5 can communicate with each other without performing NAT or the like. The local device 7 may distribute the content to the information processing terminal 5 using the state.

  1 and 2, the authentication server 9 does not exist in the LAN 3. This is because the authentication server 9 is made independent of the management of the LAN 3 to ensure the reliability of authentication by the authentication server 9.

  The terminal authentication processing unit 13 and the local authentication processing unit 31 are for performing authentication by the authentication server 9. The terminal authentication storage unit 15 and the local authentication storage unit 33 store a device certificate and a service certificate issued by the authentication server 9.

  The terminal registration unit 19, the terminal LR processing unit 23, the local registration unit 37, and the local LR processing unit 41 perform local registration processing. An example of specific processing of local registration will be described with reference to FIG. The terminal device storage unit 21 stores the locally registered local device. The local device storage unit 39 stores the locally registered information processing terminal. An example of processing for deleting a device stored in the terminal device storage unit 21 and the local device storage unit 39 will be described with reference to FIGS. 5 and 6.

  The terminal communication control unit 17 and the local communication control unit 35 are for realizing communication between the information processing terminal 5 and the local device 7. The terminal distribution processing unit 25 and the local distribution processing unit 43 are for realizing a process in which the local device 7 distributes content to the information processing terminal 5. An example of this process will be described with reference to FIG. The NAT traversal support server 11 does not exist in the LAN 3 in order to support the NAT traversal between the information processing terminal 5 outside the LAN 3 and the local device 7 in the LAN 3.

  With reference to FIGS. 1 and 2, according to the present embodiment, the information processing terminal 5 and the local device 7 can be realized by the same configuration. Therefore, one program for realizing the authentication processing unit, the authentication storage unit, the communication control unit, the registration unit, the device storage unit, the LR processing unit, and the distribution processing unit is distributed. Alternatively, each unit of the information processing terminal 5 and / or each unit of the local device 7 may be realized by an instruction of a user of the local device 7. Note that programs for realizing the information processing terminal 5 and the local device 7 may be different. This program can be realized as application software and does not require administrator authority. Therefore, even if the information processing terminal 5 is a smartphone, a tablet, or the like, the application program can be easily distributed and realized.

  Next, the outline of the operation of the content distribution system 1 will be described with reference to FIG. FIG. 3 is a flowchart showing an outline of processing in the content distribution system 1.

  The authentication server 9 authenticates the information processing terminal 5 and the local device 7 (step ST1 in FIG. 3). Note that the authentication processing of the information processing terminal 5 and the local device 7 only needs to be performed before the local registration (step ST2), and the order of authentication of the information processing terminal 5 and the local device 7 is not limited.

  An example of the process of step ST1 in FIG. 3 will be specifically described.

  The terminal authentication processing unit 13 of the information processing terminal 5 requests the authentication unit 49 of the authentication server 9 to issue a device certificate. The authentication unit 49 performs authentication processing of the information processing terminal 5 and issues a device certificate. This device certificate includes device identification information (for example, a serial number, etc. for distinguishing the information processing terminal 5 from other authenticated information processing apparatuses. An example.) Is included. In addition, a service certificate is issued simultaneously with the device certificate. The terminal authentication processing unit 13 stores the issued device certificate and service certificate in the terminal authentication storage unit 15.

  Similarly, the local authentication processing unit 31 of the local device 7 requests the authentication unit 49 of the authentication server 9 to issue a device certificate. The authentication unit 49 of the authentication server 9 performs authentication processing of the local device 7 and issues a device certificate. The device certificate includes device identification information for distinguishing the local device 7 from other authenticated information processing devices (for example, the information processing terminal 5). In addition, a service certificate is issued simultaneously with the device certificate. The local authentication processing unit 31 stores the issued device certificate and service certificate in the local authentication storage unit 33.

  Further, the authentication unit 49 obtains NAT traversal support information for accessing the local device 7 from outside the LAN 3 by traversing the NAT with the local authentication processing unit 31. This only needs to be performed before the construction of the secure tunnel (step ST6). Therefore, for example, the NAT traversal support information may be updated by collecting once at the time of authentication and correcting when the local IP address of the local device 7 is changed.

  Subsequently, as shown in FIG. 1, the local registration process (step ST2 in FIG. 3; an example of “local registration step” in the claims of the present application) is performed by the information processing terminal 5 and the local device 7 on the same LAN 3. It is done in a state that exists inside.

  An example of local registration processing will be specifically described with reference to FIG. FIG. 4 is a sequence diagram showing an example of processing in the local registration in step ST2 of FIG.

  As shown in FIG. 1, the local registration is performed in a state where the information processing terminal 5 and the local device 7 exist in the same LAN 3. When the information processing terminal 5 and the local device 7 exist in the same LAN 3, the terminal communication control unit 17 and the local communication control unit 35 can detect addresses from each other. Therefore, communication between the information processing terminal 5 and the local device 7 is possible.

  The terminal LR processing unit 23 of the information processing terminal 5 presents a device certificate to the local LR processing unit 41 of the local device 7 in response to an instruction from the user of the information processing terminal 5 and requests local registration. (Step STLR1 in FIG. 4).

  When there is a request for local registration from the terminal LR processing unit 23, the local LR processing unit 41 sends a DMP 29 to the RAG-D 45 when the user of the local device 7 permits the local registration of the information processing terminal 5. And DMS 47 registration is instructed (step STLR2). The local communication control unit 35 notifies the terminal communication control unit 17 of the device identification information of the local device 7 and instructs local registration of the DMS 47 (step STLR3). The terminal registration unit 19 registers the DMS 47 by storing the device identification information of the local device 7 in the terminal device storage unit 21. The terminal communication control unit 17 notifies the local communication control unit 35 that the DMS 47 has been registered (step STLR4). When the local communication control unit 35 receives the notification, the local registration unit 37 registers the DMP 29 by storing the device identification information of the information processing terminal 5 in the local device storage unit 39. The RAG-D 45 notifies the local LR processing unit 41 that the DMP 29 and the DMS 47 are registered (step STLR 5). The local LR processing unit 41 notifies the terminal LR processing unit 23 that the local registration has ended (step STLR6).

  On the other hand, as shown in FIG. 2, when the local device 7 exists in the LAN 3 and the information processing terminal 5 exists outside the LAN 3, the terminal communication control unit 17 and the local communication control unit 35 assign addresses to each other. It cannot be detected. For this reason, in this embodiment, the local registration can be performed only in the case of FIG. 1, and the local registration cannot be performed in the case of FIG.

  Subsequently, it is determined whether or not to delete the locally registered device (step ST3 in FIG. 3). When deleting, a deletion process is performed (step ST4 in FIG. 3).

  An example of the deletion process will be described with reference to FIGS.

  FIG. 5 shows processing when a deletion request is made from a locally registered information processing terminal in the LAN 3. This is almost the same process as in FIG. That is, the terminal LR processing unit 23 issues a deletion request to the local LR processing unit 41 (step STD1). When receiving the deletion request, the local LR processing unit 41 instructs the RAG-D 45 to delete the registration of the DMP 29 and the DMS 47 (step STD2). The local communication control unit 35 instructs the terminal communication control unit 17 to delete the registration of the DMS 47 (step STD3). When the terminal communication control unit 17 receives the registration deletion instruction, the terminal registration unit 19 deletes the DMS 47 by deleting the device identification information of the local device 7 from the terminal device storage unit 21. The terminal communication control unit 17 notifies the local communication control unit 35 that the DMS 47 has been registered and deleted (step STD4). When the local communication control unit 35 receives the notification, the local registration unit 37 deletes the DMP 29 by deleting the device identification information of the information processing terminal 5 from the local device storage unit 39. The RAG-D 45 notifies the local LR processing unit 41 that the registration and deletion of the DMP 29 and the DMS 47 have been deleted (step STD5). The local LR processing unit 41 notifies the terminal LR processing unit 23 that the registration deletion has been completed (step STD6).

  FIG. 6 is an example of processing when the user of the local device 7 deletes. For example, the user of the information processing terminal 5 may maliciously connect to the LAN 3 and perform local registration with the local device 7. Therefore, the user of the local device 7 can delete the registration from the external server 53. The external server 53 requests the local LR processing unit 41 to delete a predetermined information processing terminal (step STSD1). When receiving the deletion request, the local LR processing unit 41 instructs the RAG-D 45 to delete the DMP registration of the information processing terminal (step STSD2). The local registration unit 37 deletes the DMP by deleting the device identification information of the information processing terminal from the local device storage unit 39. The local registration unit 37 notifies the local LR processing unit 41 that DMP registration has been deleted (step STSD3). The local LR processing unit 41 notifies the external server 53 that registration deletion has ended (step STSD4).

  Thus, in this embodiment, even if the local device 7 is registered in the terminal device storage unit 21 of the information processing terminal 5, the information processing terminal 5 is deleted from the local device storage unit 39 of the local device 7. there is a possibility.

  Subsequently, the information processing terminal 5 determines whether or not a service certificate exists (step ST5 in FIG. 3). If there is no service certificate, the terminal authentication processing unit 13 of the information processing terminal 5 requests the authentication unit 49 of the authentication server 9 to issue a service certificate (step ST6). Thereby, in the authentication server 9, for example, it is possible to grasp the status of content use in the information processing terminal 5, and it is possible to detect the possibility of illegal use etc. based on the frequency or the like. The reliability of authentication according to 9 is further increased. The authentication unit 49 of the authentication server 9 issues a new service certificate if no problem is recognized. If there is a service certificate in the information processing terminal 5, it is determined whether the service certificate is valid (step ST7). If the service certificate is invalid due to, for example, an expired state, the process returns to step ST3, and after deletion, the local registration is required to be performed again.

  If there is a valid service certificate, it is determined whether or not the information processing terminal 5 has made a connection request to the local device 7 (step ST8 in FIG. 3). The connection request is made according to an instruction from the user of the information processing terminal 5. For example, the user of the information processing terminal 5 instructs the local device 7 as a connection destination from the device list presented as a connectable device in the application software of the information processing terminal 5, or from the local device 7 before. A connection to the local device 7 is instructed by instructing to re-view the distributed content. If there is no connection request, the process returns to step ST3.

  When the information processing terminal 5 makes a connection request, if the information processing terminal 5 exists in the LAN 3 as shown in FIG. 1, the terminal communication control unit 17 and the local communication control unit 35 detect addresses from each other. be able to.

  When the information processing terminal 5 does not exist in the LAN 3 and makes a connection request in a state of being connected to a network different from the LAN 3 as shown in FIG. 2, the terminal communication control unit 17 and the local communication control unit 35 The address cannot be detected. Therefore, the terminal communication control unit 17 establishes a connection by establishing a secure tunnel with the local communication control unit 35 with the support of the NAT traversal support server 11. In the following, NAT traversal will be described as an example of NAT traversal using ICE, but other techniques may be used. An example of this processing will be specifically described with reference to FIGS.

  First, detection of a global IP address will be described. The global IP address is detected by using the request / response of STUN 50 of the NAT traversal support server 11 to detect the IP address and port assigned outside the NAT 12. The STUN 50 transmits a request to the STUN 50 from the terminal communication control unit 17 and the local communication control unit 35 using a client / server type protocol, and a port number mapped with an IP address outside the NAT is stored in the response. The STUN 50 detects the NAT type of the NAT 12. For example, when the NAT type of the NAT 12 is multistage, the NAT type is the most restrictive. What is finally obtained is a local IP address and port number, a global IP address and port number, and a NAT type. The information obtained here is transmitted to the SIP 51 and stored in the database in the NAT traversal server 11.

  First, the local communication control unit 35 communicates with the STUN 50 to acquire an end point (step STDE1). Subsequently, the local communication control unit 35 registers an endpoint in the SIP 51 (step STDE2).

  When the user of the information processing terminal 5 makes a connection request, the terminal distribution processing unit 25 makes a device list acquisition request to the terminal communication control unit 17 (step STDE3). The terminal communication control unit 17 transmits a device list to the terminal distribution processing unit 25 (step STDE4). The terminal distribution processing unit 25 makes a connection request to the local device 7 to the terminal communication control unit 17 (step STDE5).

  The terminal communication control unit 17 cannot acquire the address of the local communication control unit 35. Therefore, the terminal communication control unit 17 communicates with the STUN 50 and acquires an endpoint (step STDE6). Subsequently, the terminal communication control unit 17 registers an endpoint in the SIP 51 (step STDE7).

  The terminal communication control unit 17 transmits a proposal message for connection to the local communication control unit 35 to the SIP 51 (step STDE8). At this time, the device identification information given to the local device 7 is used as information for specifying the connection destination. The SIP 51 transmits this proposal message to the local communication control unit 35 (step STDE9). The local communication control unit 35 transmits a response message to the terminal communication control unit 17 to the SIP 51 (step STDE10). The SIP 51 transmits this response message to the terminal communication control unit 17 (step STDE11).

  Then, the terminal communication control unit 17 uses NAT traversal to establish a secure tunnel with the local communication control unit 35 (step ST9 in FIG. 3 and step STDE12 in FIG. 7). The NAT traversal is performed with the support of the NAT traversal support server 11 if necessary.

  Several techniques have been proposed for techniques beyond NAT. For example, UDP hole punching and TCP hole punching have been proposed. RFC 3489 defines NAT types as Full Cone, Restricted Cone, Port Restricted Cone, and Symmetric. With Open Internet, you can connect without doing anything. With Full Cone, you can connect using address resolution by STUN. In the case of Restricted Cone, Port Restricted Cone, and Symmetric, connection is possible by using STUN / TURN and Connection Reversal and / or hole punching, relay by TURN. As described above, whether or not NAT can be exceeded differs depending on the NAT type.

  When the information processing terminal 5 is stored in the local device storage unit 39, the local communication control unit 35 permits establishment of a connection with the terminal communication control unit 17. When the information processing terminal 5 is not stored in the local device storage unit 39, the local communication control unit 35 rejects establishment of a connection with the terminal communication control unit 17.

  Since the information processing terminal 5 is stored in the local device storage unit 39, certain reliability is ensured by the authentication processing by the authentication server 9 as a premise of local registration. Furthermore, since it is permitted by the user of the local device 7 by local registration and is not deleted after that, it is ensured that the user of the local device 7 is also trusted. Therefore, the construction of a secure tunnel by traversing NAT on the premise of these reliability has been realized.

  The terminal communication control unit 17 notifies the terminal distribution processing unit 25 that a secure tunnel has been established (step STDE13).

  Subsequently, content distribution processing is performed (step ST10 in FIG. 3). That is, the terminal distribution processing unit 25 presents a service certificate to the terminal communication control unit 17 and makes a content distribution request (step STDE14 in FIG. 7). The terminal communication control unit 17 relays with a secure tunnel (step STDE15 in FIG. 7). The local communication control unit 35 transmits a distribution request to the local distribution processing unit 43 (step STDE16 in FIG. 7). The local distribution processing unit 43 performs distribution processing of the content stored in the content storage unit (not shown) to the local communication control unit 35 (step STDE17 in FIG. 7). The local communication control unit 35 relays with a secure tunnel (step STDE18 in FIG. 7). The terminal communication control unit 17 transmits the distribution process to the terminal distribution processing unit 25 (step STDE19 in FIG. 7).

  Then, it is determined whether or not disconnection is instructed by the user of the information processing terminal 5 or the local device 7 (step ST11 in FIG. 3). When not cutting, it returns to the process of step ST10. When disconnection is instructed, the communication path between the information processing terminal 5 and the local device 7 is disconnected (step ST12 in FIG. 3).

  From the viewpoint of ensuring the safety of the local device 7, it is sufficient that at least the information processing terminal 5 is authenticated by the authentication server 9. In this case, information for NAT traversal from outside the LAN 3 to the local device 7 is given to the NAT traversal support server 11 separately from the authentication processing.

  1 content distribution system, 3 LAN, 5 information processing terminal, 7 local device, 9 authentication server, 11 NAT traversal support server, 12 NAT, 13 terminal authentication processing unit, 15 terminal authentication storage unit, 17 terminal communication control unit, 19 terminal Registration unit, 21 Terminal device storage unit, 23 Terminal LR processing unit, 25 Terminal distribution processing unit, 27 RAG-CP, 29 DMP, 31 Local authentication processing unit, 33 Local authentication storage unit, 35 Local communication control unit, 37 Local registration Unit, 39 local device storage unit, 41 local LR processing unit, 43 local distribution processing unit, 45 RAG-D, 47 DMS, 49 authentication unit, 50 STUN, 51 SIP, 52 TURN, 53 external server

Claims (10)

A communication control method for controlling whether to establish a communication path between an information processing terminal and a local device connected to a local area network,
The local device communicates with an information processing device connected to a network different from the local area network by performing network address conversion,
An authentication unit provided in an authentication server connected to a network different from the local area network authenticates one or a plurality of information processing terminals,
The local registration means provided in the local device communicates with the information processing terminal authenticated by the authentication server without performing NAT traversal, and the information processing terminal is stored in the local device storage means provided in the local device. A local registration step to register;
When the terminal communication control means provided in the information processing terminal connected to a network different from the local area network makes a communication path establishment request to the local apparatus by traversing the NAT, the local communication control means provided in the local apparatus includes: Determine whether the information processing terminal is registered in the local device storage means;
Allowing the communication path between the information processing terminal and the local device to be established when the information processing terminal is registered in the local device storage means;
Including a communication path establishment control step of refusing to establish a communication path between the information processing terminal and the local device when the information processing terminal is not registered in the local device storage unit. Communication control method. In the authentication step, the authentication means gives device identification information to each of the information processing terminals,
In the local registration step, said local registration means, wherein the information processing terminal, as the identification information of the information processing terminal, registering the device identification information issued from the authentication unit, the communication control method according to claim 1, wherein .   In the communication path establishment control step, when the support means for connecting to a network different from the local area network makes the communication path establishment request while the information processing terminal is connected to a network different from the local area network The communication control method according to claim 1, wherein when the information processing terminal is authenticated by the authentication server, NAT traversal between the information processing terminal and the local device is supported. In the authentication step, the authentication unit authenticates the local device with device identification information for identifying the local device,
In the local registration step, terminal registration means provided in the information processing terminal registers device identification information of the local device,
In the communication path establishment control step,
The information processing terminal notifies the support means of device identification information of the local device,
The support means obtains information for accessing the local apparatus using device identification information of the local apparatus, and notifies the terminal communication control means of the local apparatus as a connection destination, and the information processing terminal The communication control method according to claim 3, wherein NAT communication with the local device is supported. A communication control method for controlling whether to establish a communication path between an information processing terminal and a local device connected to a local area network,
The information processing terminal
A terminal LR processing means for requesting registration of the information processing terminal without going over the NAT to the local device;
Comprising a terminal communication control means for making a communication path establishment request by NAT traversal to the local device while connected to a network different from the local area network;
The local device needs to perform communication by performing network address conversion with an information processing device connected to a network different from the local area network,
Local device storage means for storing device identification information for identifying an information processing terminal;
Local registration means for registering device identification information of an information processing terminal requested to be registered by the terminal LR processing means with respect to the local device storage means;
When the terminal communication control means makes a communication path establishment request due to NAT traversal, the terminal communication control means comprises local communication control means for permitting or rejecting establishment of the communication path,
An authentication step in which an authentication unit provided in an authentication server connected to a network different from the local area network adds and authenticates device identification information for identifying each information processing terminal to one or a plurality of information processing terminals; ,
The terminal LR processing means requests the local device to register the information processing terminal without using NAT traversal, and the local registration means makes a registration request to the local device storage means. A local registration step for registering device identification information for
When the support means for connecting to a network different from the local area network, the terminal communication control means provided in the information processing terminal connected to a network different from the local area network makes a communication path establishment request to the local device. When the information processing terminal is authenticated by the authentication server, the information processing terminal supports NAT traversal between the information processing terminal and the local device, and the information processing terminal uses the NAT traversal to the local device. When the communication path establishment request is made to the local communication control means provided in the local device,
Allowing the communication path between the information processing terminal and the local device to be established when the device identification information of the information processing terminal is registered in the local device storage means;
A communication path establishment control step for refusing to establish a communication path between the information processing terminal and the local device when the device identification information of the information processing terminal is not registered in the local device storage unit; A communication control method comprising: An information processing apparatus connected to a local area network and connected to a network different from the local area network is a local apparatus that performs communication by performing network address conversion,
Local device storage means for storing device identification information for identifying an information processing terminal;
The local device storage means, a local registration means for registering device identification information of the information processing terminal authenticated by the authentication server,
Comprising a local communication control means for controlling whether or not to establish a communication path with an information processing terminal that has made a communication path establishment request;
The local registration unit registers device identification information of the information processing terminal in the local device storage unit when the information processing terminal authenticated by the authentication server makes a registration request without using NAT traversal. ,
The local communication control means, when a terminal communication control means provided in an information processing terminal connected to a network different from the local area network makes a communication path establishment request to the local device over NAT,
Allowing the communication path between the information processing terminal and the local device to be established when the device identification information of the information processing terminal is registered in the local device storage means;
A local device that refuses to establish a communication path with an information processing terminal when the information processing terminal is not registered in the local device storage unit. An information processing apparatus connected to a local area network and connected to a network different from the local area network is an information processing terminal that makes a communication path establishment request to a local apparatus that performs communication by performing network address conversion. ,
Terminal authentication processing means for requesting authentication of the information processing terminal to an authentication server connected to a network different from the local area network;
A terminal LR processing means for requesting registration of the information processing terminal to the local registration means provided in the local device without using NAT traversal;
An information processing terminal comprising terminal communication control means for making a communication path establishment request to the local device by traversing a NAT while connected to a network different from the local area network. An information processing terminal is connected to a local area network, and establishes a communication path between the information processing apparatus connected to a network different from the local area network and performing communication by performing network address conversion. A communication path establishment support device for supporting
The local device is an authentication server connected to a network different from the local area network and authenticated by adding device identification information,
When the information processing terminal makes a connection request to the local device using the device identification information given to the local device in a state where the information processing terminal is connected to a network different from the local area network, the information processing terminal When authenticated by an authentication server connected to a network different from the local area network, access to the local device is specified using the device identification information, and the information processing terminal crosses the NAT with the local device. A communication path establishment support device comprising support means for supporting A computer connected to a local area network and performing communication by performing network address conversion with an information processing apparatus connected to a network different from the local area network,
Local device storage means for storing device identification information for identifying an information processing terminal;
The local device storage means, a local registration means for registering device identification information of the information processing terminal authenticated by the authentication server,
A program for functioning as a local communication control means for controlling whether or not to establish a communication path with an information processing terminal that has made a communication path establishment request,
The local registration unit registers device identification information of the information processing terminal in the local device storage unit when the information processing terminal authenticated by the authentication server makes a registration request without using NAT traversal. ,
The local communication control means, when a terminal communication control means provided in an information processing terminal connected to a network different from the local area network makes a communication path establishment request to the computer by crossing NAT,
Allowing the communication path between the information processing terminal and the computer to be established when the device identification information of the information processing terminal is registered in the local device storage means;
A program that refuses to establish a communication path with the information processing terminal when the information processing terminal is not registered in the local device storage means. Computer
Terminal authentication processing means for requesting authentication of the computer to an authentication server connected to a network different from the local area network to which the local device is connected;
A terminal LR processing means for making a request for registration of the computer by communicating with the local registration means provided in the local device without performing NAT traversal;
A program for functioning as a terminal communication control means for making a communication path establishment request to the local device by traversing a NAT while connected to a network different from the local area network.

Images