WO2007025952A1

WO2007025952A1 - Communication method using intermediate unit and communication system thereof

Info

Publication number: WO2007025952A1
Application number: PCT/EP2006/065737
Authority: WO
Inventors: Christian Haendel
Original assignee: Nokia Siemens Networks Gmbh & Co. Kg
Priority date: 2005-08-31
Filing date: 2006-08-28
Publication date: 2007-03-08
Also published as: CN1925391A

Abstract

The present invention provides a communication method which uses an intermediate unit in a communication network. This communication network comprises at least two terminal units and at least one intermediate unit, and the intermediate unit and one of the terminal units constitute one network. The procedure in this communication method is that the other terminal unit sends a communication request to the intermediate unit, and the intermediate unit implements authentication in respect of the terminal unit which has sent this request. The intermediate unit wakes the terminal unit which is in the abovenoted network, and the two terminal units conduct communication. The invention further provides a communication system in which the abovedescribed communication method is employed. When the method of the invention is used, network units in a local area network do not need to be constantly connected to the local area network, and so energy is economized, there is further assurance of the security of data, and the risk of terminal users in the local area network being subjected to network attack is reduced.

Description

DESCRIPTION

Communication method using intermediate unit and communication system thereof

(I) Technical field

The present invention relates to a communication method, and, more particularly, it relates to a communication method using an intermediate unit and to a communication system in which this method is used.

(II) Background technology

Along with the rapid development of computer network (net) and mobile telephone technology, the exchange of business data between computer networks and terminal users is becoming ever more frequent. In order to ensure the security of communication between a computer network and a terminal user and to prevent penetration and eavesdropping of data by an illegal user, it is necessary, in the execution of such data exchanges, to give consideration to questions of identity verification, access control and the secrecy of messages in the performance of such data exchanges, and it is commonly necessary to resolve these questions through authentication and encryption.

Usually, a challenge-response scheme is used for authentication, and one-time authentication or two-times authentication may be needed in the process of establishing a connection. Authentication makes it possible to prevent unauthorized use and mistaken use. Encryption technology rules increase the system security, the length of a key secret code may be 0, 40 or 64 bits, and the secret code is generally managed by higher layer software. If users require a still higher level of secrecy assurance, they can use special security mechanisms on a transport layer and an application layer. An example is shown in Fig. 1 in order to describe the above situation when a terminal user A and a computer C conduct communications. In Fig. 1, A is a mobile terminal (MT) and C is a personal computer (PC) . If A intends to connect to C and then conduct communication with C, it is first necessary that C implement authentication in respect of A and thereby recongnize A's identity. C further needs to encrypt the data that are transmitted to A and unclassify the data that are transmitted to A. Similarly, A must implement authentication in respect of C, encrypt the data that are transmitted to C, and unclassify the data that are transmitted to C.

Although the abovedescribed communication system permits normal communications to be conducted, it is still associated with the following problems.

First, if the terminal user wishes to communicate with the personal computer at any time this communication may be required, the personal computer must be constantly connected to a network. If the personal computer is not connected to the network at a particular instant, then it is impossible for it to communicate with the terminal user at that instant.

Second, since the network between the terminal user and the personal computer is not completely secure, there is an increased risk of an unauthenticated user managing to obtain personal computer data when the personal computer, having implemented authentication in respect of the terminal user, transmits data to the terminal user.

Third, if a terminal user effects one-time mistaken accessing of the personal computer, such as in the case in which a user miskeys a connection number or access address, the personal computer must first implement authentication in respect of this terminal user, and the process of this authentication has to continue for a period of time. As far as the mistakenly accessing terminal user is concerned, it is necessary to wait a period of time before being informed that the authentication has failed; as far as the personal computer is concerned, there is wasteful use of its capacity, since there is mistaken accessing by a terminal user and implementation of one-time authentication.

(Ill) Content of the invention

It is accordingly a main object of the present invention to provide a communication method which makes it possible for a terminal user to communicate with other terminal users without constant connection to a network being necessary, and with which the possibility of this terminal user being subjected to network attack can be reduced, and the security of the communication network can be increased.

In order to achieve the above object, the present invention provides a communication method in which an intermediate unit is used in a communication network, this communication network comprises at least two terminal units and an intermediate unit, the intermediate unit and one of the terminal units constitute one network and the abovenoted method comprises the following steps:

(1) the other of the abovenoted terminal units issues a communication request to the intermediate unit;

(2) the intermediate unit implements authentication in respect of the terminal unit which has issued this communication request;

(3) the intermediate unit wakes the terminal unit which is in the abovenoted network;

(4) the abovenoted two terminal units conduct communication .

In step (3) , the intermediate unit, after having implemented authentication in respect of the terminal unit which has made the communication request, wakes the terminal unit which is in the abovenoted network. The wake-up scheme can use a wired system such as that of network wake-up technology (Wake on Lan; WoL) ; the wake-up scheme can also use a wireless system such as that of Bluetooth technology.

Further, in step (4), the two terminal units conduct communication in an ordinarily employed encryption scheme. For example, encryption can be effected using a secure sockets layer (SSL) protocol, or encryption can be effected using a protocol succeeding SSL protocol, specifically, transport layer security (TLS) protocol.

The invention further provides a communication system in which the abovedescribed communication method is applied. This system comprises at least two terminal units. The communication system further comprises an intermediate unit, and this intermediate unit and one of the terminal units constitute a network.

The intermediate unit here possesses a receiver, and this receiver receives signals of the other of the abovenoted terminal units; the intermediate unit possesses an authentication device which, after reception of a signal of the abovenoted terminal unit, implements authentication in respect of this terminal unit; the intermediate unit has an emitter which, if the terminal unit is successfully authenticated, follows this authentication by emitting signals to the terminal unit which is in the abovenoted network. Usually, these emitted signals contain a wake-up frame, so making it possible for the terminal unit which is in the network to be activated after reception of the wake-up frame.

It can be seen that the communication method which is provided by the invention and uses an intermediate unit in a communication network has the following advantages and special features.

(1) When communications are conducted using the method of the invention, the intermediate unit is simultaneously connected to two networks, and this makes things such that a unit in the intermediate unit wake-up network does not need to be constantly connected to the network, and so energy is economized.

(2) The work of authentication which was originally performed by a terminal unit is performed by the intermediate unit instead, and authentication work and work data are dealt with separately by different units. This further ensures the security of data and reduces the possibility of the relevant terminal user being subjected to network attack.

(3) In a situation in which mistaken accessing is made by a terminal user, the intermediate unit can immediately implement authentication and notify the user that the authentication has failed, and so the user does not have to wait too long. As far as terminal users on the network are concerned, there is no need for successive waste of energy because of one-time mistaken accessing and activation.

(IV) Description of attached drawings

Fig. 1 is a conceptual representation of the procedure of a communication method in existing technology. Fig. 2 is a conceptual representation of the communication method of the invention and its communication system.

Fig. 3 is a conceptual representation of an example of implementation of the invention.

(V) Specific form of implementation

Below, a detailed description of the invention will be given by means of a specific example of implementation, together with the attached drawings. This example of implementation is illustrative, and is non-limiting. Fig. 2 is a conceptual representation of the communication method and the communication system of the invention. The units in Fig. 2 comprise a terminal user A, an intermediate unit B, and a terminal user C. A and B are simultaneously located in a communication network 1, and B and C are simultaneously located in a communication network 2. The intermediate unit possesses a function for authentication in respect of signals which come from A.

If A wishes to communicate with C, the communication procedure which is performed is as follows. First, A asks the intermediate unit B whether communication with C is possible. After that, the intermediate unit B implements authentication in respect of A, ie it verifies A's legal identity. Further, after that, if B passes the authentication in respect of A, then B wakes C and causes C to make proper preparation for communication with A. Finally A and C conduct communication via an encryption system.

Fig. 3 shows an example of implementation of the invention. In the communication network shown in Fig. 3 there are two terminal users and one intermediate unit, one of the terminal users is a handset mobile terminal (MT) , the other of the terminal users is a personal computer (PC) , and the intermediate unit can be a server for home-use equipment (EasyHome Server) . The home server has a receiver and can receive signals of the handset. The home server also has an authentication device, and it can implement authentication in respect of the handset after receiving a signal of the handset. Further, the home server has an emitter, and, if the handset is successfully authenticated, this emitter issues wake-up frame signals to the personal computer.

Further, the home server supports internet protocol, and communications between it and the handset are conducted on the basis of internet protocol, as indicated by the elliptical frame in Fig. 3. The home server also supports a wireless local area network (WLAN) protocol based on IEEE Standard 802.11b (also called Wi-Fi); it constitutes a local area network (LAN) together with the personal computer, and conducts communications by means of the WLAN protocol, as indicated by the square frame in Fig. 3.

The home server can communicate with the handset as and when required, and the personal computer does not need to be constantly connected to the local area network. If the handset wishes to access data held by the personal computer in the home, the procedure is that the handset must first submit a communication request to the home server, and, after the receiver of the home server receives this signal, the home server issues an enquiry command to the handset. On receiving this enquiry command, the handset sends a string of information to the home server to prove its own identity. After receiving this information, the home server can verify the identity of the handset.

If the above authentication is passed, the home server emits a wake-up frame and wakes the personal computer via a network wake-up (Wake on LAN; WoL) system. The home server is provided with remote network management software, and the personal computer possesses a network card which supports a network wake-up master right. The network card which supports network wake-up constantly monitors the entire network. There are many judgement schemes for discerning whether a wake-up frame is present in the network. For example, it is possible to effect 16 times uninterrupted repetition of a media access control (MAC) address which is set in a wake-up frame. The network card possesses a continuously uninterrupted power supply and can activate the computer. Generally, the personal computer's master board also includes a special-purpose CMOS which is used for network wake-up technology.

When the network card on the personal computer receives a wake-up frame, the computer can be opened, and communication between the handset and the personal computer can be started.

Generally, encrypted communication is used between the handset and the personal computer. For example, encryption can be effected using secure sockets layer SSL protocol, or encryption can be effected using protocol succeeding SSL protocol, specifically, transport layer security TLS protocol. SSL/TLS is an industry standard secure protocol, and the use of SSL/TLS produces a numeric secret code which is shared by transmission and reception, and compilation and decoding of messages by means of this secret code can only be effected in message-carrying transmission and reception. No other parties, even if they are servers which transfer these messages, can decipher SSL/TLS transmissions.

When communication between the handset and the personal computer is completed, the personal computer sends a message notifying the home server, and the home server acts through the remote network management software to tell the computer to switch off or to enter a sleep state.

It can be seen from the example of implementation described above that, when the method of the invention is used, a network unit awaiting wake-up does not need to be constantly connected to a network, and so energy is economized. In addition, since an independent intermediate unit is used to realize an authentication function, the security of data is further ensured, and the possibility of terminal users on the network being subjected to network attack is reduced.

Claims

WHAT IS CLAIMED IS

1. A communication method which uses an intermediate unit in a communication network, said communication network comprising at least two terminal units and an intermediate unit, and one network being constituted by said intermediate unit and one of said terminal units, and which is characterized in that said method comprises the following steps : (1) the other of said terminal units issues a communication request to said intermediate unit;

(2) said intermediate unit implements authentication in respect of said terminal unit which has issued this communication request; (3) said intermediate unit wakes the terminal unit which is in said network;

(4) said two terminal units conduct communication.

2. The communication method using an intermediate unit in a communication network as claimed in claim 1 which is characterized in that, in said step (3), said intermediate unit wakes the terminal unit which is in said network through a wired system.

3. The communication method using an intermediate unit in a communication network as claimed in claim 1 which is characterized in that, in said step (3), said intermediate unit wakes the terminal unit which is in said network through a wireless system.

4. The communication method using an intermediate unit in a communication network as claimed in claim 2 which is characterized in that said wired system is a network wake-up system.

5. The communication method using an intermediate unit in a communication network as claimed in claim 3 which is characterized in that said wireless system is a Bluetooth system.

6. The communication method using an intermediate unit in a communication network as claimed in claim 1 which is characterized in that, in said step (4), said two terminal units conduct communication using an encryption system.

7. The communication method using an intermediate unit in a communication network as claimed in claim 6 which is characterized in that said encryption communication uses secure sockets layer protocol or transport layer security protocol .

8. A communication system in which the abovedescribed communication method is used, said system comprising at least two terminal units, and being characterized in that said communication system further comprises an intermediate unit, and said intermediate unit and one of said terminal units constitute one network.

9. The communication system as claimed in claim 8 which is characterized in that said intermediate unit possesses a receiver, and said receiver receives signals of the other one of said terminal units; said intermediate unit possesses an authentication device, and, after the reception of a signal of said terminal unit, said authentication device implements authentication in respect of said terminal unit; said intermediate unit possesses an emitter, and, after authentication in respect of said authentication is successful, said emitter emits signals to the terminal unit which is in said network.

10. The communication system as claimed in claim 9 which is characterized in that the signals emitted by said emitter of said intermediate unit contain a wake-up frame.