WO2022004894A1

WO2022004894A1 - Transmission source terminal, communication system, communication method, and program

Info

Publication number: WO2022004894A1
Application number: PCT/JP2021/025226
Authority: WO
Inventors: 重明白水
Original assignee: 株式会社Gdi
Priority date: 2020-07-03
Filing date: 2021-07-02
Publication date: 2022-01-06
Also published as: JP7128565B2; JPWO2022004894A1

Abstract

To provide a multiple-factor tripartite authentication routing system that enables efficient communications.　A transmission source peer (2-1) serving as a data transmission source from among a plurality of communication terminals, which are connected via a network (N) and perform peer-to-peer communications, establishes a direct route (R0), which is directly connected to a transmission source peer (2-2) serving as a data transmission source, with the assistance of an authentication peer (2-11) that assists the establishment of connection routes among the communication terminals. After the establishment of the direct route (R0), alternative routes (sub routes) (R4 to R6, R12, R13) connected to the transmission source peer (2-2) via intermediate peers (2-4 to 2-6, 2-12, 2-13) are established.

Description

Source terminal, communication system, communication method, and program

The present invention relates to a source terminal, a communication system, a communication method, and a program, and particularly to a source terminal, a communication system, a communication method, and a program capable of realizing efficient communication.

By becoming a group owner that operates as an access point, one of a plurality of communication devices (peers) in an equal state connected to each other, instead of a specific server computer, becomes a communication device (peer) in the group. ) Are known as a communication method called peer-to-peer that enables communication between each other (see, for example, Patent Document 1). The specification of Patent Document 1, the scope of claims, and the entire drawing shall be incorporated into this specification as a reference.

Japanese Unexamined Patent Publication No. 2005-100419

However, in peer-to-peer, when multiple connection paths between communication devices (peers) in a group are established and multiplexing is performed, the dependence on hardware is high, and depending on the path, media access and the phase of the physical layer It is not possible to easily multiplex the connection path and it is difficult to communicate efficiently because the multiplexing does not occur as intended by the application layer when they are in competition with each other and problems such as cost occur. There was a problem that it was.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a source terminal, a communication system, a communication method, and a program capable of realizing efficient communication.

In order to achieve the above object, the source terminal (2-1) according to the first aspect of the present invention is connected via the network (N), and a plurality of communications communicating in a peer-to-peer manner. The communication terminal (2-1) that is the source of data among the terminals (2-m) and supports the establishment of a connection path between the communication terminals (2-m). With the support of the support terminal (2-11) which is 2-m), the connection route is directly connected to the destination terminal (2-2) which is the communication terminal (2-m) which is the transmission destination of the data. After establishing a certain first connection route (R0) and establishing the first connection route (R0), the relay terminal (2) of the communication terminals (2-m) different from the support terminal (2-11). -4 to 2-6, 2-12, 2-13) to connect to the destination terminal (2-2) via the second connection route (R4 to R6, R12, R13), which is the connection route. It is characterized by being established.

After the establishment of the first connection path (R0), the source terminal (2-1) supports the support terminal (2-11) to establish the second connection path (R4 to R6). The second connection path (R4 to R6) may be established by requesting via (N).

After the first connection path (R0) is established, the source terminal (2-1) connects to the relay terminal (2-12, 2-13) via the network (N), and the transmission is made. The second connection path (R4 to R6) may be established by requesting the connection with the destination terminal (2-2) via the network (N).

In the source terminal (2-1), after the establishment of the first connection path (R0), the communication terminal (2-m) connected via the first connection path (R0) is the transmission destination. The reliability of being a terminal (2-2) is calculated, and the connection with the destination terminal (2-2) is made to the relay terminal (2-) on condition that the reliability is less than a predetermined threshold value. 12, 2-13) may be requested via the network (N).

The source terminal (2-1) is a connection request requesting a connection with the destination terminal (2-2), and includes the first connection request identification information for specifying the connection request. The first connection request identification transmitted via the network (N) to the support terminal (2-11) and transmitted from the destination terminal (2-2) via the network (N). In response to receiving the information and the connection information necessary for connecting to the destination terminal (2-2), the first connection request identification information received from the destination terminal (2-2) The destination terminal (2-2) uses the connection information of the destination terminal (2-2) on condition that it matches the first connection request identification information transmitted to the support terminal (2-11). The first connection path (R0) may be established by connecting to and via the network (N).

After establishing the first connection path (R0), the source terminal (2-1) connects to the relay terminal (2-12, 2-13) via the network (N), and the first connection terminal (2-1) is connected to the relay terminal (2-12, 2-13) via the network (N). The second connection path (R4 to R6) is established by transmitting the connection request including the second connection request identification information different from the first connection request identification information via the network (N). May be good.

The source terminal (2-1) has the right to connect to the destination terminal (2-2) and the support terminal issuance information issued by the support terminal (2-11). The connection request identification information may be generated, and the second connection request identification information may be generated from the right and the relay terminal issuance information issued by the relay terminal (2-12, 2-13). ..

The source terminal (2-1) registers the user of the source terminal (2-1) as the disposal right holder of the connection request table (5) for registering the first connection request identification information, and the first connection request identification information is registered. 1 After the connection route (R0) is established, the disposal right of the connection request table (5) can be changed by changing the disposal right holder of the connection request table (5) to the user of the support terminal (2-11). It may be transferred to the user of the support terminal (2-11).

The communication system (1) according to the second aspect of the present invention is a communication system including a plurality of communication terminals (2-m) connected via a network (N) and communicating in a peer-to-peer system. In (1), the source terminal (2-1), which is the source of data among the plurality of communication terminals (2-m), establishes a connection route between the communication terminals (2-m). With the support of the support terminal (2-11), which is the communication terminal (2-m) that supports the data, the destination terminal (2-2), which is the communication terminal (2-m), is the destination of the data. ) Is established, and after the first connection path (R0) is established, the support terminal (2-m) of the communication terminals (2-m) is established. The second connection route (2-2), which is the connection route for connecting to the destination terminal (2-2) via a relay terminal (2-4 to 2-6, 2-12, 2-13) different from 11). It is characterized by establishing R4 to R6, R12, R13).

In the communication system (1), the source terminal (2-1) is a destination terminal (2-2) transmitted from the destination terminal (2-2) via the network (N). After receiving the connection information necessary for connection with and establishing the first connection path (R0), the connection information table (6) for registering the connection information of the destination terminal (2-2) is generated, and the above The support terminal (2-11) is requested to support the establishment of the second connection route (R4 to R6) via the network (N), and the destination terminal (2-2) and the relay terminal (2-) are requested. After the 4 to 2-6) are connected via the network (N), the relay terminal (2-4 to 2) transmitted from the support terminal (2-11) via the network (N). By connecting to the relay terminal (2-4 to 2-6) via the network (N) using the connection information necessary for the connection with -6), the second connection path (R4 to R6) is used. ) Is established, and the support terminal (2-11) includes a first storage unit (22-11) that stores the connection information of the relay terminal (2-4 to 2-6), and the source terminal. Connection with the destination terminal (2-2) in response to a request from (2-1) to support the establishment of the second connection path (R4 to R6) via the network (N). Is requested to the relay terminal (2-4 to 2-6) via the network (N), and the transmission destination terminal (2-2) and the relay terminal (2-4 to 2-6) are described. After being connected via the network (N), the connection information of the relay terminal (2-4 to 2-6) is transmitted to the source terminal (2-1) via the network (N), and the above is described. The relay terminal (2-4 to 2-6) responds to the request for connection from the support terminal (2-11) to the destination terminal (2-2) via the network (N). Then, the connection information of the destination terminal (2-2) is acquired from the connection information table (6), and the connection information of the destination terminal (2-2) is used to obtain the connection information of the destination terminal (2-2). ) And the network (N).

In the above communication system (1), the source terminal (2-1) uses the source identification information for identifying the source terminal (2-1) and the destination terminal (2-2). After the establishment of the first connection path (R0), the source identification information and the destination identification information include a second storage unit (22-1) for storing the destination identification information for identification. , The connection information table (6) for registering the connection information of the destination terminal (2-2) in association with each other is generated, and the source identification information and the destination identification information are stored in the network ( By transmitting to the support terminal (2-11) via N), the support terminal (2-11) is requested to support the establishment of the second connection route (R4 to R6), and the support terminal (2-11) is requested. 2-11) responds to receiving the source identification information and the destination identification information transmitted from the source terminal (2-1) via the network (N). By transmitting the source identification information and the destination identification information to the relay terminal (2-4 to 2-6) via the network (N), the destination terminal (2-2) The relay terminal (2-4 to 2-6) is requested to connect to the relay terminal (2-4 to 2-6), and the relay terminal (2-4 to 2-6) is connected to the support terminal (2-11) via the network (N). In response to receiving the source identification information and the destination identification information transmitted, the received source identification information and the destination identification information are each in the connection information table. The destination terminal is used with the connection information of the destination terminal (2-2) on condition that the source identification information registered in (6) and the destination identification information match. (2-2) may be connected via the network (N).

In the above communication system (1), the source terminal (2-1) is a second storage unit (22-) that stores connection information necessary for connection with the relay terminal (2-12, 2-13). 1) is included, and the connection information of the relay terminal (2-12, 2-13) is used to connect to the relay terminal (2-12, 2-13) via the network (N), and the transmission is performed. The relay terminal (2-12, 2-13) is requested to connect to the destination terminal (2-2) via the network (N), and the relay terminal (2-12, 2-13) is said. The network (N) from the source terminal (2-1) includes a fourth storage unit (2-12, 2-13) that stores connection information necessary for connecting to the destination terminal (2-2). In response to a request for connection to the destination terminal (2-2) via And the second connection path (R12, R13) may be established by connecting via the network (N).

In the above communication system (1), the source terminal (2-1) is the communication terminal (2-1) connected via the first connection path (R0) after the establishment of the first connection path (R0). Calculate the reliability that 2-m) is the destination terminal (2-2), and with the destination terminal (2-2) on condition that the reliability is less than a predetermined threshold value. The connection may be requested to the relay terminal (2-12, 2-13) via the network (N).

In the above communication system (1), the relay terminal (2-12, 2-13) includes a first relay terminal (2-12) and a second relay terminal (2-13), and the transmission is made. The original terminal (2-1) is connected to the first connection after establishing a second connection path (R12) to be connected to the destination terminal (2-2) via the first relay terminal (2-12). The reliability that the communication terminal (2-m) connected via the route (R0) and the second connection route (R12) is the destination terminal (2-2) is calculated, and the reliability is calculated. Is requested to the second relay terminal (2-13) via the network (N) to connect to the destination terminal (2-2) on condition that is less than the predetermined threshold. You may.

The communication method according to the third aspect of the present invention is a communication method according to a third aspect of the present invention with a data source among a plurality of communication terminals (2-m) connected via a network (N) and communicating by a peer-to-peer method. A support terminal (2-m) that is a communication method using a source terminal (2-1) and is a communication terminal (2-m) that supports the establishment of a connection path between the communication terminals (2-m). With the support of 11), the first connection route (R0), which is the connection route directly connected to the transmission destination terminal (2-2), which is the communication terminal (2-m) to which the data is transmitted, is established. After the establishment of the first connection path (R0), the relay terminal (2-4 to 2-6, 2-12) different from the support terminal (2-11) among the communication terminals (2-m), It is characterized in that a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the transmission destination terminal (2-2) via 2-13), is established.

The program according to the fourth aspect of the present invention is connected via a network (N) and is a source of data among a plurality of communication terminals (2-m) that communicate in a peer-to-peer manner. Support for the support terminal (2-11), which is the communication terminal (2-m), which supports the establishment of a connection path between the communication terminals (2-m) in the computer of the source terminal (2-1). A procedure for establishing a first connection route (R0), which is a connection route that directly connects to a transmission destination terminal (2-2), which is the communication terminal (2-m) to which the data is transmitted, and the above. After the establishment of the first connection path (R0), among the communication terminals (2-m), the relay terminals (2-4 to 2-6, 2-12, 2-) different from the support terminals (2-11). The procedure for establishing a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the transmission destination terminal (2-2) via 13), is executed.

According to the present invention, it is possible to provide a source terminal, a communication system, a communication method, and a program capable of realizing efficient communication.

It is a figure which shows the configuration example of the three-point authentication system which concerns on this embodiment. It is a block diagram which shows the configuration example of a communication terminal. It is a conceptual diagram of the P2P type network which concerns on this embodiment. It is a figure which shows the configuration example of a seed table. (A) is a diagram showing a configuration example of a token table before using a token, and (b) is a diagram showing a configuration example of a token table after using a token according to the present embodiment. It is a figure which shows the configuration example of a multiplexing table. It is a flowchart which shows the details of a seed issuance process. It is a flowchart which shows the detail of the three-point authentication process which concerns on this embodiment. It is a flowchart which shows the continuation of a three-point authentication process. It is a flowchart which shows the continuation of a three-point authentication process. It is a flowchart which shows the continuation of a three-point authentication process. It is a flowchart which shows the continuation of a three-point authentication process. It is a flowchart which shows the continuation of a three-point authentication process. It is a flowchart which shows the continuation of a three-point authentication process. It is a conceptual diagram of the P2P type network which concerns on a modification. It is a flowchart which shows the detail of the three-point authentication process which concerns on a modification. It is a flowchart which shows the continuation of the three-point authentication process which concerns on a modification. It is a flowchart which shows the continuation of the three-point authentication process which concerns on a modification. It is a flowchart which shows the continuation of the three-point authentication process which concerns on a modification. It is a figure which shows the configuration example of the token table after using the token which concerns on the modification.

Hereinafter, embodiments for carrying out the present invention will be described.

The present invention was invented based on the following technical ideas.

The present inventor has invented a communication system that logically establishes a plurality of connection paths on an overlay network in which a logical layer exists in a peer-to-peer system. In order to realize such a communication system, there are many layer 2 (data link layer) or lower communication standards such as LTE (Long Term Evolution) and Wi-Fi (Wireless Fidelity). It has become necessary to perform lightweight authentication, connection, and routing of communication terminals (peers) constituting the (P2P) type network by software without depending on hardware. Therefore, the present inventor has invented a multi-factor three-point authentication routing system according to the present invention in order to solve such a problem and realize efficient communication.

First, the configuration of the three-point authentication system (communication system) according to the embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a configuration example of a three-point authentication system according to this embodiment.

As shown in FIG. 1, the three-point authentication system 1 includes a plurality of communication terminals 2-m (m is a natural number). The plurality of communication terminals 2-m are connected to each other so as to be able to communicate with each other via a network N such as the Internet, and communicate by a peer-to-peer method. A communication terminal that communicates by a common procedure is called a peer. The communication terminal 2-m for understanding the procedure of the present invention is a peer, and a plurality of communication terminals 2-m (peers) constitute a peer-to-peer (P2P) type network. Further, the three-point authentication system 1 uses a distributed ledger technology such as a block chain composed of a plurality of communication terminals (peers) 2-m on the network N and a distributed hash table (DHT) to obtain data. A shared ledger 20 for distributed management is provided.

The communication terminal (peer) 2-m is a CPU (Central Processing Unit) having an IP (Internet Protocol) communication function for, for example, a general-purpose personal computer, a general-purpose server computer, a tablet computer, a smartphone, and a digital home electric appliance. It consists of equipped smart devices and the like.

FIG. 2 is a block diagram showing a configuration example of a communication terminal.

As shown in FIG. 2, the communication terminal (peer) 2-m includes a communication unit 21-m, a storage unit 22-m, and a control unit 23-m, respectively, which are via a bus or the like. Be connected.

The communication unit 21-m is composed of, for example, a wireless communication device or the like. The communication unit 21-m transmits / receives data to / from another communication terminal (peer) 2-m via the network N by the P2P communication method.

The storage unit 22-m is composed of, for example, a non-volatile memory such as a general-purpose flash memory. The storage unit 22-m holds (stores) a user ID (Identification) for identifying a user of the communication terminal (peer) 2-m. The user ID is composed of, for example, 32 bytes of binary data.

The control unit 23-m is composed of, for example, a CPU, a ROM (ReadOnlyMemory), a RAM (RandomAccessMemory), and the like. The CPU uses the RAM as a work memory, and controls various operations of the communication terminal (peer) 2-m by appropriately executing a program or the like stored in the ROM and the storage unit 22.

FIG. 3 is a conceptual diagram of a P2P type network according to this embodiment.

As shown in FIG. 3, the communication terminal (peer) 2-m includes a communication terminal (hereinafter referred to as "source peer (source terminal)") 2-1 that is a source of data and data transmission. A seed issuing peer that issues a seed that is the right to connect to the destination communication terminal (hereinafter referred to as "destination peer (destination terminal)") 2-2 and the destination terminal 2-2 (hereinafter referred to as "destination peer"). A communication terminal having an authentication function, a connection function, and a routing function between the source peer 2-1 and the destination peer 2-2 (hereinafter referred to as "seed issuing peer") (hereinafter, "authentication peer (support terminal)"). ) ”.) Three communication terminals that relay data communication between 2-11, source peer 2-1 and destination peer 2-2 (hereinafter referred to as“ relay peer (relay terminal) ”) 2 -4 to 2-6 and so on. The number of relay peers is not limited to "3" and is arbitrary.

The source peer 2-1 is a user ID of the source peer 2-1 (source identification information for identifying the source peer 2-1) and a user ID of the destination peer 2-2 (destination peer 2-). Destination identification information for identifying 2), connection information such as the IP address required to connect to the source peer 2-1 and the authentication peer that is the parent (group owner) of the connection group to which the user belongs, which will be described later. The connection information necessary for connecting to 2-11 is stored (stored) in the storage unit (second storage unit) 22-1. On the other hand, the source peer 2-1 does not hold the connection information of the destination peer 2-2 in the storage unit 22-1. In the present embodiment, the source peer 2-1 authenticates the destination peer 2-2 from the seed purchased and issued from the seed issuing peer 2-3, and the source peer 2-1 and the destination peer 2 -Generate tokens (first and second connection request identification information) for improving the validity and efficiency of connection and routing with -2. Here, the "first and second connection request identification information" according to the present invention is not limited to the token itself, but is the authentication of the communication terminal 2-m and the connection path between the communication terminals 2-m. Any digital data that can be used for establishment and multiplexing is arbitrary, and may be, for example, a hash value of a token. The source peer 2-1 uses the token to authenticate the destination peer 2-2, and establishes and multiplexes a plurality of connection routes with the destination peer 2-2 to multiplex the destination peer 2. -Data can be efficiently communicated with -2.

The destination peer 2-2 has connection information such as the user IDs of the source peer 2-1 and the destination peer 2-2, the IP address necessary for connecting to the destination peer 2-2, and the connection to which the user belongs. The connection information required for connection with the authentication peer 2-11, which is the parent (group owner) of the group, is stored (stored) in the storage unit (third storage unit) 22-2. On the other hand, the destination peer 2-2 does not hold the connection information of the source peer 2-1 in the storage unit 22-2.

The seed issuing peer 2-3 provides a seed table for registering information regarding the seed issued by the seed issuing peer 2-3 in the storage unit 23-2.

FIG. 4 is a diagram showing a configuration example of a seed table.

As shown in FIG. 4, the seed table 4 is encrypted by using the hash value of the seed and the dedicated encryption key (hereinafter referred to as “seed-only key”) for each seed issued by the seed issuing peer 2-3. The converted seed (hereinafter referred to as "encrypted seed") and the expiration date of the seed are registered in association with each other.

The authentication peer 2-11 shown in FIG. 3 is a connection group to which the communication terminals (peers) 2-m such as the source peer 2-1 and the destination peer 2-2 and the relay peers 2-4 to 2-6 belong. Is the parent (group owner) of this connection group. The authentication peer 2-11 authenticates the communication terminal (peer) 2-m belonging to its own connection group, and supports the establishment of a connection route between the communication terminals (peer) 2-m. The authentication peer 2-11 stores (first storage) a graph database that registers (stores) the user ID of the communication terminal (peer) 2-m belonging to its own connection group and the connection information in association with each other. ) Prepare for 2-11. The control unit 23-11 of the authentication peer 2-11 occasionally sends a heartbeat to the communication terminal (peer) 2-m belonging to its own connection group, and the communication terminal (peer) belonging to its own connection group. Acquire the 2-m user ID and connection information and register them in the graph database. With such a graph database, the authentication peer 2-11 maintains and manages the graph relationship that the communication terminal (peer) 2-m belongs to the connection group of the authentication peer 2-11. Further, the graph database stores the reliability and connectivity evaluation of the communication terminal (peer) 2-m belonging to the connection group of the authentication peer 2-11. In the present embodiment, the source peer 2-1 and the destination peer 2-2, and the relay peers 2-4 to 2-6 all belong to the connection group of the authentication peer 2-11. Therefore, in the authentication peer 2-11, (1) the source peer 2-1 belongs to the connection group of the authentication peer 2-11, and (2) the destination peer 2-2 is the authentication peer 2-11. It maintains and manages the graph relationship that it belongs to the connection group and (3) the relay peers 2-4 to 2-6 belong to the connection group of the authentication peer 2-11. Specifically, the graph database included in the storage unit (first storage unit) 2-11 according to the present embodiment includes the source peer 2-1 and the destination peer 2-2, and the relay peers 2-4 to 2-6. The user ID of the user and the connection information are registered (stored) in association with each other.

The relay peers 2-4 to 2-6 store their own user IDs and the connection information necessary for connecting to the authentication peer 2-11, which is the parent (group owner) of the connection group to which they belong. Hold (remember) at 22-6. On the other hand, the relay peers 2-4 to 2-6 do not hold the connection information of the source peer 2-1 and the destination peer 2-2 in the storage units 22-4 to 22-6.

The shared ledger 20 shown in FIG. 1 is a mechanism for proving the authenticity that the seed is issued to an appropriate source peer 2-1 or a user, rather than simply consisting of one server computer. , Resistant to accidents. The shared ledger 20 multiplexes the token table (connection request table) for registering information about the token generated by the source peer 2-1 and the route between the source peer 2-1 and the destination peer 2-2. It is provided with a connection information table used when the operation is performed.

FIG. 5A is a diagram showing a configuration example of a token table before using a token, and FIG. 5B is a diagram showing a configuration example of a token table after using a token according to the present embodiment.

As shown in FIGS. 5A and 5B, the token table 5 shows the token, the hash value of the seed used as the basis for generating the token, the expiration date of the seed, and the user of the issuer of the token. The ID (“user ID of source peer 2-1” in this embodiment) and the user ID of the current disposal right holder in the token table 5 are registered in association with each other. Here, the disposal right of the token table 5 means the right to edit or delete the data of the token table 5.

As shown in FIG. 5 (a), the direct route (first) shown in FIG. 3 in which the source peer 2-1 directly connects the source peer 2-1 and the destination peer 2-2 using a token. Before the connection route) R0 is established, the user ID of the source peer 2-1 which is the issuer of the token is registered in the token table 5 as the user ID of the disposal right holder of the token table 5.

As shown in FIG. 5B, after the source peer 2-1 uses the token to establish the direct route R0, the direct route R0 is established as the user ID of the disposal right holder of the token table 5. The user ID of the contributing authentication peer 2-11 is registered in the token table 5.

FIG. 6 is a diagram showing a configuration example of the connection information table.

As shown in FIG. 6, the connection information table 6 contains a token, a user ID of a communication terminal (peer) 2-m (“source peer 2-1” in the present embodiment) that is a source of data, and data. The user ID and connection information of the communication terminal (peer) 2-m (“destination peer 2-2” in this embodiment) to be the destination of the call are registered in association with each other.

Next, various processes executed by the three-point authentication system 1 having the above configuration will be described with reference to the drawings.

In response to the user's request for seed issuance at the sender peer 2-1 the three-point authentication system 1 executes the seed issuance process.

FIG. 7 is a flowchart showing the details of the seed issuance process.

In the seed issuance process shown in FIG. 7, first, the control unit 23-1 of the source peer 2-1 makes a seed issuance request from the communication unit 21-1 via the network N to the seed issuance peer. It is transmitted to 2-3 (step S701). The seed issuance request includes the user ID of the source peer 2-1 and the like.

The control unit 23-3 of the seed issuing peer 2-3 responds to the communication unit 21-3 receiving the seed issuing request transmitted from the source peer 2-1 via the network N (step S702). , Issuing a seed and a seed-only key (step S703).

Next, the control unit 23-3 of the seed issuing peer 2-3 calculates the hash value of the seed (step S704).

Subsequently, the control unit 23-3 of the seed issuing peer 2-3 uses the seed-only key to encrypt the seed and generate an encrypted seed (step S705).

Then, the control unit 23-3 of the seed issuing peer 2-3 generates a seed table 4 in the storage unit 22-3 to register the hash value of the seed and the encrypted seed in association with each other (step S706).

Further, the control unit 23-3 of the seed issuing peer 2-3 transmits the hash value of the seed and the seed-dedicated key from the communication unit 21-3 to the source peer 2-1 via the network N (step S707).

The control unit 23-1 of the source peer 2-1 receives the hash value of the seed and the seed-only key transmitted from the seed issuing peer 2-3 via the network N in the communication unit 21-1 (step S708). ), After saving in the storage unit 22-1 (step S709), the seed issuance process is terminated.

Further, in response to the user requesting the communication of data with the destination peer 2-2 in the source peer 2-1 the three-point authentication system 1 executes the three-point authentication process (communication method). ..

8 to 14 are flowcharts showing the details of the three-point authentication process according to the present embodiment.

In the three-point authentication process shown in FIGS. 8 to 14, first, the control unit 23-1 of the source peer 2-1 uses the connection information of the authentication peer 2-11 stored in the storage unit 22-1 to be used. It is communicably connected to the authentication peer 2-11 via the network N (step S801 shown in FIG. 8).

Then, the control unit 23-1 of the source peer 2-1 authenticates the first connection inquiry asking whether the connection with the destination peer 2-2 is possible from the communication unit 21-1 via the network N. It is transmitted to peer 2-11 (step S802). The first connection inquiry includes the user IDs of the source peer 2-1 and the destination peer 2-2.

The control unit 23-11 of the authentication peer 2-11 responds to the reception of the first connection inquiry transmitted from the source peer 2-1 via the network N by the communication unit 21-11 (step S803). , Whether or not the destination peer 2-2 can be authenticated is determined based on whether or not the user ID of the destination peer 2-2 included in the first connection inquiry is registered in the graph database (step S804).

When the control unit 23-11 of the authentication peer 2-11 determines that the user ID of the destination peer 2-2 is not registered in the graph database and the authentication of the destination peer 2-2 is impossible (step). S804; No), by transmitting the first connection inquiry from the communication unit 21-11 to another authentication peer via the network N, the authentication of the destination peer 2-2 is outsourced to the other authentication peer (step S805). ). The other authentication peer performs the same processing as the authentication peer 2-11 in response to receiving the authentication inquiry transmitted from the authentication peer 2-11 via the network N by the communication unit.

On the other hand, when the control unit 23-11 of the authentication peer 2-11 determines that the user ID of the destination peer 2-2 is registered in the graph database and the destination peer 2-2 can be authenticated (). Step S804; Yes), the authentication serial ID (support terminal issuance information) is issued (step S806).

Then, the control unit 23-11 of the authentication peer 2-11 makes a second connection inquiry asking whether or not the connection with the source peer 2-1 is possible from the communication unit 21-11 via the network N, and the user ID. It is transmitted to the destination peer 2-2 specified from (step S807 shown in FIG. 9). The second connection inquiry includes an authentication serial ID and the like.

The control unit 23-2 of the destination peer 2-2 responds to the reception of the second connection inquiry transmitted from the authentication peer 2-11 via the network N by the communication unit 21-2 (step S808). , The answer as to whether or not the connection with the source peer 2-1 is possible (hereinafter referred to as "the answer as to whether or not the second connection is possible") is transmitted from the communication unit 21-2 to the authentication peer 2-11 via the network N. (Step S809). The answer as to whether or not the connection with the source peer 2-1 is possible includes the authentication serial ID and the like.

The control unit 23-11 of the authentication peer 2-11 gives a second connection response that the connection with the source peer 2-1 transmitted from the destination peer 2-2 via the network N is possible. In response to the reception in No. 11 (step S810), the destination peer 2-2 is used as an answer as to whether or not the connection with the destination peer 2-2 is possible (hereinafter referred to as "first connection answer"). The first connection answer that the connection with is possible is transmitted from the communication unit 21-11 to the source peer 2-1 via the network N (step S811). The first connection response includes an authentication serial ID and the like.

The control unit 23-1 of the source peer 2-1 gives the first connection response that the connection with the destination peer 2-2 transmitted from the authentication peer 2-11 via the network N is possible in the communication unit 21-. In response to the reception in 1 (step S812), the encrypted seed corresponding to the hash value of the seed stored in the storage unit 22-1 and the expiration date of the seed are set from the communication unit 21-1 to the network N. Obtained from the seed table 4 of the seed issuing peer 2-3 via the seed table 4 (step S813).

Subsequently, the control unit 23-1 of the source peer 2-1 uses the seed-only key to decrypt the seed issued by the seed issuing peer 2-3 from the encrypted seed acquired from the seed issuing peer 2-3. (Step S814 shown in FIG. 10).

Then, the control unit 23-1 of the source peer 2-1 issues (generates) a token consisting of a hash value of the seed and the authentication serial ID from the seed and the authentication serial ID (step S815). The token is attached to a communication packet when communicating data with the authentication peer 2-11.

Then, the control unit 23-1 of the source peer 2-1 includes the token, the hash value of the seed used as the base when the token is generated, and the user ID of the source peer 2-1 as the issuer of the token. , The token table 5 shown in FIG. 5A, which registers the expiration date of the seed and the user ID of the source peer 2-1 as the disposal right holder of the token table 5 in association with each other, is registered from the communication unit 21-1. Generated in the shared ledger 20 via the network N (step S816).

Further, the control unit 23-1 of the source peer 2-1 transmits a connection request requesting a connection with the destination peer 2-2 from the communication unit 21-1 to the authentication peer 2-11 via the network N. (Step S817). The connection request includes the hash value of the token and the seed. The token included in the connection request becomes the connection request identification information for specifying the connection request. In this way, the source peer 2-1 directly connects the source peer 2-1 and the destination peer 2-2 to the authentication peer 2-11 as shown in FIG. 3 (first connection route). Request support for the establishment of R0 via network N.

The control unit 23-11 of the authentication peer 2-11 responds to the reception of the connection request transmitted from the source peer 2-1 via the network N by the communication unit 21-11 (step S818), and connects. The user ID of the issuer of the token corresponding to the hash value of the seed included in the request and the expiration date of the seed are acquired from the communication unit 21-11 via the network N from the token table 5 of the shared ledger 20 (step S819). ..

Then, the control unit 23-11 of the authentication peer 2-11 determines whether or not the user ID of the issuer of the token matches the user ID of the sender peer 2-1 included in the authentication inquiry, and within the expiration date of the seed. By determining whether or not it is, the authenticity of the token included in the connection request is confirmed (step S820).

After confirming the authenticity, the control unit 23-11 of the authentication peer 2-11 uses the connection information of the destination peer 2-2 stored in the storage unit 22-11 to connect the destination peer 2-2 and the network N. The alternative route (secondary route) R11 shown in FIG. 3 via the authentication peer 2-11 is established by connecting to the communication via the communication peer (step S821).

Then, the control unit 23-11 of the authentication peer 2-11 transmits the token and the connection information of the source peer 2-1 from the communication unit 21-11 to the source peer 2-2 via the network N (FIG. 11). Step S822).

The control unit 23-2 of the destination peer 2-2 receives the token transmitted from the authentication peer 2-11 via the network N and the connection information of the source peer 2-1 in the communication unit 21-2. In response (step S823), using the connection information of the source peer 2-1, the token and the connection information of the destination peer 2-2 are transmitted from the communication unit 21-2 via the network N to the source peer 2-1. (Step S824).

The control unit 23-1 of the source peer 2-1 has received the connection information and token of the destination peer 2-2 transmitted from the destination peer 2-2 via the network N in the communication unit 21-1. In response to (step S825), the authenticity of the token is determined by determining whether or not the token received from the destination peer 2-2 matches the token generated by itself and transmitted to the authentication peer 2-11. Confirm the sex (step S826). In this way, the source peer 2-1 uses the token to authenticate that the communication terminal 2-m connected via the alternative route (secondary route) R11 is the destination peer 2-2. conduct.

After confirming the authenticity, that is, on condition that the token received from the destination peer 2-2 matches the token transmitted to the authentication peer 2-11, the control unit 23-1 of the source peer 2-1 makes a call. Using the connection information of the destination peer 2-2, the direct route R0 shown in FIG. 3 that directly connects the source peer 2-1 and the destination peer 2-2 is established (step S827). As a result, the authentication of the destination peer 2-2 by the source peer 2-1 using the token and the direct connection between the source peer 2-1 and the destination peer 2-2 are realized.

Subsequently, as shown in FIG. 5B, the control unit 23-1 of the source peer 2-1 sets the user ID of the disposal right holder of the token table 5 from the communication unit 21-1 via the network N. By digitally signing the user ID of the source peer 2-1 to the user ID of the authentication peer 2-11, the right to dispose of the token table 5 is given by the user of the source peer 2-1 to the authentication peer 2-11. (Step S828 shown in FIG. 12). The user of the authentication peer 2-11 who has acquired the disposal right of the token table 5 can edit or delete the data of the token table 5. Further, the user of the authentication peer 2-11 who has acquired the disposal right of the token table 5 obtains a new seed or the like from the seed issuing peer 2-3 in exchange for the data of the token table 5 via the external system of the network N. Can be obtained. Since the data that can be acquired in exchange for the data in the token table 5 is an external system of network N, it is not limited to the seed, and is arbitrary as long as it can be used to enjoy some network service. Is.

Then, the control unit 23-1 of the source peer 2-1 reports from the communication unit 21-1 to the authentication peer 2-11 via the network N that the transfer of the disposal right of the token table 5 is completed (). Step S829).

Further, the control unit 23-1 of the source peer 2-1 includes a token, a user ID of the source peer 2-1 as a communication terminal (peer) 2-m that is a source of data, and a data transmission destination. The connection information table 6 for registering the user ID and connection information of the destination peer 2-2 in association with each other as the communication terminal (peer) 2-m is registered from the communication unit 21-1 via the network N in the shared ledger 20. (Step S830).

Then, the control unit 23-1 of the source peer 2-1 makes an authentication peer from the communication unit 21-1 via the network N to request the multiplexing requesting the multiplexing of the connection path with the destination peer 2-2. It is transmitted to 2-11 (step S831). The multiplexing request includes tokens, user IDs of source peer 2-1 and destination peer 2-2, and the like. In this way, the source peer 2-1 connects the source peer 2-1 and the destination peer 2-2 to the authentication peer 2-11 via the relay peers 2-4 to 2-6. We request support for establishing alternative routes (secondary routes) (second connection routes) R4 to R6 shown in FIG.

The control unit 23-11 of the authentication peer 2-11 responds to the communication unit 21-11 receiving the multiplexing request transmitted from the source peer 2-1 via the network N (step S832). A relay request for relaying data communication between the source peer 2-1 and the destination peer 2-2 is transmitted from the communication unit 21-11 to the relay peers 2-4 to 2-6 via the network N. (Step S833). The relay request includes the token and the user IDs of the source peer 2-1 and the destination peer 2-2.

The control units 23-4 to 23-6 of the relay peers 2-4 to 2-6 receive the relay request transmitted from the authentication peer 2-11 via the network N by the communication units 21-4 to 21-6, respectively. In response to the request (step S834), the user ID of the communication terminal (peer) 2-m, which is the source of the data corresponding to the token included in the relay request, and the communication terminal (peer), which is the destination of the data. The 2-m user ID and connection information are acquired from the connection information table 6 of the shared ledger 20 from the communication units 21-4 to 21-6 via the network N (step S835 shown in FIG. 13).

The control units 23-4 to 23-6 of the relay peers 2-4 to 2-6 are the sources of the data acquired from the connection information table 6 by the user ID of the source peer 2-1 included in the relay request, respectively. Whether or not it matches the user ID of the communication terminal (peer) 2-m, and whether or not the user ID of the destination peer 2-2 matches the user ID of the communication terminal (peer) 2-m to which the data is transmitted. By determining whether or not it is, the authenticity of the token is confirmed (step S836).

After confirming the authenticity, that is, the user ID of the source peer 2-1 and the user ID of the destination peer 2-2 received from the authentication peer 2-11 are the source of the data acquired from the connection information table 6, respectively. Control of relay peers 2-4 to 2-6 on condition that the user ID of the communication terminal (peer) 2-m and the user ID of the communication terminal (peer) 2-m to which the data is transmitted match. Units 23-4 to 23-6 are connected to the destination peer 2-2 via the network N so as to be able to communicate with each other by using the connection information of the destination peer 2-2 (step S837).

Then, the relay peers 2-4 to 2-6 send a connection completion report from the communication unit 21-4 to 21-6 via the network N to report that the connection with the destination peer 2-2 is completed, respectively. It is transmitted to the authentication peer 2-11 (step S838).

The control unit 23-11 of the authentication peer 2-11 responds to the communication unit 21-11 receiving the connection completion report transmitted from the relay peers 2-4 to 2-6 via the network N, respectively. (Step S839), a data transmission request requesting transmission of data to the relay peers 2-4 to 2-6 is transmitted from the communication unit 21-11 to the source peer 2-1 via the network N (step S839). S840). The data transmission request includes the user IDs of the relay peers 2-4 to 2-6, connection information, and the like.

The control unit 23-1 of the source peer 2-1 responds to the reception of the data transmission request transmitted from the authentication peer 2-11 via the network N by the communication unit 21-1 (step S841). By using the connection information of the relay peers 2-4 to 2-6 included in the data transmission request to connect to the relay peers 2-4 to 2-6 via the network N so as to be communicable, the relay peer 2-4 The alternative routes (secondary routes) R4 to R6 shown in FIG. 3 via ~ 2-6 are established (step S842 shown in FIG. 14). As a result, multiplexing of the connection route between the source peer 2-1 and the destination peer 2-2 using the token is realized.

Then, the control unit 23-1 of the source peer 2-1 receives data from the communication unit 21-1 with the destination peer 2-2 via the direct route R0, the alternative route (sub route) R4 to R6, and R11. After the communication is started (step S843), the three-point authentication process is terminated.

As described above, the three-point authentication system 1 according to the present embodiment includes a plurality of communication terminals (peers) 2-m that are connected via the network N and communicate in a peer-to-peer manner. The plurality of communication terminals (peers) 2-m are located between the source peer 2-1 that is the source of data, the destination peer 2-2 that is the destination of data, and the communication terminal (peer) 2-m. It comprises an authentication peer 2-11, which assists in establishing a connection path. The source peer 2-1 identifies the user ID of the source peer 2-1 which is the source identification information for identifying the source peer 2-1 and the destination identification for identifying the destination peer 2-2. Includes a second storage unit 22-1 that stores the user ID of the destination peer 2-2, which is information. The destination peer 2-2 includes a storage unit 22-2 that stores connection information necessary for connection with the destination peer 2-2. The authentication peer 2-11 includes a storage unit 22-11 that stores connection information necessary for connecting to the source peer 2-1 and connection information necessary for connecting to the relay peers 2-4 to 2-6. ..

In the present embodiment, the source peer 2-1 establishes a direct route R0 which is a connection route directly connected to the destination peer 2-2 with the support of the authentication peer 2-11, and after the establishment of the direct route R0, An alternative route (sub-route) R4 to R6 that connects the authentication peer 2-11 to the destination peer 2-2 via the relay peers 2-4 to 2-6 different from the authentication peer 2-11. By requesting support for the establishment of the alternative route (secondary route) R4 to R6 via the network N.

Specifically, the source peer 2-1 identifies the connection request from the seed, which is the right to connect to the destination terminal 2-2, and the authentication serial ID issued by the authentication peer 2-11. Generate a token for. Next, the source peer 2-1 registers the user of the source peer 2-1 as the disposal right holder of the token table 5 for registering the token. Subsequently, the source peer 2-1 is a connection request requesting a connection with the destination peer 2-2, and transmits the connection request including the token to the authentication peer 2-11 via the network N. Further, the source peer 2-1 responds to receiving the token transmitted from the destination peer 2-2 via the network N and the connection information necessary for connecting to the destination peer 2-2. Then, on condition that the token received from the destination peer 2-2 matches the token transmitted to the authentication peer 2-11, the destination peer 2-2 is used using the connection information of the destination peer 2-2. Directly establishes the route R0 by connecting to and via the network N. Then, after the direct route R0 is established, the source peer 2-1 changes the disposal right holder of the token table 5 to the user of the authentication peer 2-11, so that the disposal right of the token table 5 is changed to the authentication peer 2-. Move to 11 users.

Further, after the direct route R0 is established, the source peer 2-1 receives the user ID of the source peer 2-1, the user ID of the destination peer 2-2, and the connection information of the destination peer 2-2. Generate a connection information table 6 to be registered in association with each other. Then, the source peer 2-1 is authenticated by transmitting the user ID of the source peer 2-1 and the user ID of the destination peer 2-2 to the authentication peer 2-11 via the network N. Request peers 2-11 to support the establishment of alternative routes (secondary routes) R4 to R6 via the network N.

The authentication peer 2-11 receives the user ID of the source peer 2-1 transmitted from the source peer 2-1 via the network N and the user ID of the destination peer 2-2, and substitutes the user ID. In response to the request for assistance in establishing routes (sub-routes) R4 to R6, the user ID of the source peer 2-1 and the user ID of the destination peer 2-2 are transmitted via the network N. By transmitting to the relay peers 2-4 to 2-6, the relay peers 2-4 to 2-6 are requested to connect to the transmission destination peer 2-2 via the network N.

The relay peers 2-4 to 2-6 receive the user ID of the source peer 2-1 and the user ID of the destination peer 2-2 transmitted from the authentication peer 2-11 via the network N. Then, in response to the request for connection with the destination peer 2-2, the connection information of the destination peer 2-2 is acquired from the connection information table 6. Then, in the relay peers 2-4 to 2-6, the user ID of the received source peer 2-1 and the user ID of the destination peer 2-2 are registered in the connection information table 6, respectively. The destination terminal 2-2 and the network N are used using the connection information of the destination peer 2-2 on condition that the user ID of the peer 2-1 and the user ID of the destination peer 2-2 are matched. Connect via.

The authentication peer 2-11 transfers the connection information of the relay terminals 2-4 to 2-6 to the network N after the transmission destination peer 2-2 and the relay peers 2-4 to 2-6 are connected via the network N. It is transmitted to the source peer 2-1 via.

The source peer 2-1 uses the connection information necessary for connecting to the relay peers 2-4 to 2-6 transmitted from the authentication peer 2-11 via the network N, and the relay peers 2-4-2 are used. By connecting to -6 via the network N, alternative routes (secondary routes) R4 to R6 are established.

As described above, the three-point authentication system 1 according to the present embodiment calculates the authentication peer 2-11 by authenticating the destination peer 2-2 in order to logically connect using the token. The amount can be reduced, and the authentication of the destination peer 2-2 can be speeded up and made highly efficient. Further, since the three-point authentication system 1 can logically multiplex the connection path (logical path) by software without depending on the hardware as in the conventional case, it is possible to solve problems such as cost. can. Further, since the authentication peer 2-11 can outsource the routing to the relay peers 2-4 to 2-6 by using the token, the three-point authentication system 1 puts the load of the routing work on the authentication peer 2. It can be distributed to a plurality of communication terminals 2-m such as -11 and relay peers 2-4 to 2-6.

In addition, the three-point authentication system 1 multiplexes the connection path between the source peer 2-1 and the destination peer 2-2, divides the data using an algorithm such as secret sharing, and delivers non-duplicate communication packets. By doing so, it is possible to prevent the entire data from being leaked even if any of the connection paths is hacked, and to conceal the contents of the data. Further, the three-point authentication system 1 can substantially prevent data leakage by subdividing the connection path or transmitting data concealed by exclusive OR (XOR). In addition, the three-point authentication system 1 divides the data according to the number of connection routes, adds a serial number, and distributes the data, so that the data can be transmitted with high efficiency, so that the communication speed of the data can be increased. Can be done.

On the other hand, the three-point authentication system 1 can avoid a bottleneck due to a specific connection route by delivering the same communication packet to a plurality of connection routes. Further, the three-point authentication system 1 distributes the same communication packet to a plurality of connection paths to improve the connection availability between the source peer 2-1 and the source peer 2-2, thereby making any connection. It is robust because it can be retransmitted via another connection route even if the route fails.

As a result, the three-point authentication system 1 according to the present embodiment can realize efficient communication.

Further, the history of tokens recorded in the token table 5 of the shared ledger 20 can be utilized as big data (not including personal information but including attribute information). Furthermore, the division of the connection path by multiplexing can be applied as distributed storage. A graph database can be formed by communication between communication terminals (peers) 2-m.

Furthermore, the three-point authentication system 1 can improve the efficiency of authentication, connection, and routing between the source peer 2-1 and the destination peer 2-2 by using the token. In addition, the three-point authentication system 1 quantifies and evaluates the contribution of the authentication peer 2-11 and the relay peers 2-4 to 2-6 to the network by using the disposal right of the token table 5 as an incentive. It can generate incentives and raise awareness of participation. The three-point authentication system 1 can improve the network performance and the availability by increasing and maintaining the peer density by the participation of a large number of communication terminals (peers) 2-m.

Further, the connection function and the routing function between the source peer 2-1 and the source peer 2-2, which have been conventionally implemented by the server computer, are streamlined by the token and replaced by the communication terminal (peer) 2-m. As a result, it is possible to dramatically improve end-to-end security and distribution efficiency by multiplexing connection routes.

The present invention is not limited to the above embodiment, and various modifications and applications are possible. Hereinafter, modifications of the above embodiment applicable to the present invention will be described.

In the above embodiment, the source peer 2-1 requests the authentication peer 2-11 to multiplex the connection route with the destination peer 2-2, and the authentication peer 2-11 is the source peer 2-1. By requesting relay peers 2-4 to 2-6 to relay data communication between the source peer 2-2 and the destination peer 2-2, the connection path between the source peer 2-1 and the destination peer 2-2 is multiplexed. Explained as what to do. However, the present invention is not limited to this, and the source peer 2-1 transmits a first connection inquiry asking whether or not the connection with the destination peer 2-2 is possible to a plurality of authentication peers. By doing so, the connection path between the source peer 2-1 and the destination peer 2-2 may be multiplexed.

FIG. 15 is a conceptual diagram of a P2P type network according to this modified example. The same components as those of the three-point authentication system 1 according to the above embodiment are designated by the same reference numerals, and the description thereof will be omitted.

As shown in FIG. 15, the communication terminal (peer) 2-m includes a source peer 2-1, a destination peer 2-2, a seed issuing peer 2-3, an authentication peer 2-11 to 2-13, and the like. Multiple authentication peers 2- (10 + n) (n is a natural number) are included. In this modification, the authentication peers 2- (10 + n) (n ≧ 2) such as the authentication peers 2-12 and 2-13 function as the relay peer (“relay terminal” in the present invention) in the above embodiment.

In this modification, the source peer 2-1 holds (stores) the user IDs of the source peer 2-1 and the destination peer 2-2 in the storage unit 22-1. Further, the source peer 2-1 belongs to a plurality of connection groups, and holds the connection information necessary for connection with the plurality of authentication peers (support terminal and relay terminal) 2- (10 + n) in the storage unit 22-1 (the storage unit 22-1). Remember. After the alternative route (sub route) R (10 + n) is established, the control unit 23-1 of the source peer 2-1 directly routes R0 and the alternative route (sub route) R (10 + n) according to the formula shown in Equation 1 below. ) Quantitative evaluation value fi (i is the depth of multiple factors (alternative route (secondary route) R (10 + n)) for the reliability that the communication terminal 2-m connected via) is the destination peer 2-2. ) Number)) is calculated.

Here, Cn is a constant (reliability constant) evaluated and quantified by a third party (P2P network) for the reliability of the authentication peer 2- (10 + n). Dn is a confidence constant for the destination peer 2-2 of the authentication peer 2- (10 + n). These reliability constants Cn and Dn are represented by numerical values of "0" to "1", and the larger the numerical value, the higher the reliability. The quantitative evaluation value fi is improved by adding an alternative route (secondary route) R (10 + n) (n ≧ 2) and multiplexing the connection route between the source peer 2-1 and the destination peer 2-2. do.

Authentication peer 2- (10 + n) has an authentication function, a connection function, and a routing function between the source peer 2-1 and the destination peer 2-2. The authentication peer 2- (10 + n) stores a graph database in which the user IDs of the source peer 2-1 and the destination peer 2-2 and the connection information are registered in association with each other, respectively, in the storage unit 2- (10 + n) (fourth storage). Part). The authentication peer 2- (10 + n) holds (stores) the confidence constants Cn and Dn in the storage unit 2- (10 + n). The reliability constants Cn and Dn are notified from the communication unit 21- (10 + n) to the source peer 2-1 via the network N. The product of the reliability constant Cn and the reliability constant Dn calculated in advance may be notified to the source peer 2-1.

16 to 19 are flowcharts showing the details of the three-point authentication process according to this modification.

In the three-point authentication process shown in FIGS. 16 to 19, after executing the processes of steps S801 to S829 according to the above embodiment, the control unit 23-1 of the source peer 2-1 is set to the authentication peer 2- (10 + n). ) And the confidence constant Dn (or the product of the confidence constant Cn and the confidence constant Dn) are acquired from the communication unit 21-1 via the network N from the authentication peer 2- (10 + n) (shown in FIG. 16). Step S1601).

Then, the control unit 23-1 of the source peer 2-1 calculates the quantitative evaluation value fi according to the mathematical formula shown in the following equation 1 (step S1602).

Subsequently, the control unit 23-1 of the source peer 2-1 determines whether or not the quantitative evaluation value fi is equal to or greater than a predetermined threshold value (step S1603).

When the control unit 23-1 of the source peer 2-1 determines that the quantitative evaluation value fi is less than a predetermined threshold value (step S1603; No), the direct route R0 and the alternative route (secondary route) R (10 + n) The alternative route (secondary route) R (10 + n) (n ≧ 2) is assumed to have insufficient reliability (security) that the communication terminal 2-m connected via) is the destination peer 2-2. ) Is added to increase the reliability, and the connection information of the authentication peer 2- (10 + n) (n ≧ 2) stored in the storage unit 22-1 is used to authenticate the authentication peer 2- (10 + n) (n ≧ 2). 2) is connected to the network N so as to be communicable (step S1604).

Then, the control unit 23-1 of the source peer 2-1 transmits the first connection inquiry from the communication unit 21-1 to the authentication peer 2- (10 + n) (n ≧ 2) via the network N (step). S1605).

The control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) sends a first connection inquiry transmitted from the source peer 2-1 via the network N to the communication unit 21. -In response to the reception in (10 + n) (n ≧ 2) (step S1606 shown in FIG. 17), is the user ID of the destination peer 2-2 included in the first connection query registered in the graph database? Depending on whether or not the call destination peer 2-2 can be authenticated, it is determined (step S1607).

In the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2), the user ID of the destination peer 2-2 is not registered in the graph database, and the destination peer 2 When it is determined that the authentication of -2 is impossible (step S1607; No), the first connection inquiry is transmitted from the communication unit 21- (10 + n) (n ≧ 2) to another authentication peer via the network N. Therefore, the authentication of the destination peer 2-2 is outsourced to another authentication peer (step S1608). The other authentication peer responds to the reception of the authentication inquiry transmitted from the authentication peer 2-11 via the network N by the communication unit, and performs the same processing as the authentication peer 2- (10 + n) (n ≧ 2). I do.

On the other hand, in the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2), the user ID of the call destination peer 2-2 is registered in the graph database, and the call destination peer When it is determined that the authentication of 2-2 is possible (step S1607; Yes), the authentication serial ID (relay terminal issuance information) is issued (step S1609). The authentication serial ID (relay terminal issuance information) issued by the authentication peer 2- (10 + n) (n ≧ 2) is different from the authentication serial ID (support terminal issuance information) issued by the authentication peer 2-11. There is. Further, the authentication serial ID (relay terminal issuance information) issued by the authentication peer 2- (10 + n) (n ≧ 2) is also different for each authentication peer 2-11.

Then, the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) gives the first connection answer that the connection with the destination peer 2-2 is possible, and the communication unit. It is transmitted from 21- (10 + n) (n ≧ 2) to the source peer 2-1 via the network N (step S1610).

The control unit 23-1 of the source peer 2-1 can be connected to the destination peer 2-2 transmitted from the authentication peer 2- (10 + n) (n ≧ 2) via the network N. In response to receiving the connection response in the communication unit 21-1 (step S1611), a token consisting of a hash value of the seed and the authentication serial ID is issued (generated) from the seed and the authentication serial ID (FIG. 18). Step S1612) shown in. When issuing a token, the same seed is used for authentication peer 2-11 and authentication peer 2- (10 + n) (n ≧ 2), while the authentication serial ID is authentication peer 2-11 and authentication. A different one is used for each peer 2- (10 + n) (n ≧ 2). Therefore, different tokens are issued for each of the authentication peer 2-11 and the authentication peer 2- (10 + n) (n ≧ 2). The token is attached to a communication packet when communicating data with the authentication peer 2- (10 + n) (n ≧ 2).

Then, the control unit 23-1 of the source peer 2-1 generates the token table 5 shown in FIG. 5A from the communication unit 21-1 to the shared ledger 20 via the network N (step S1613). Since different tokens are issued for each of the authentication peer 2-11 and the authentication peer 2- (10 + n) (n ≧ 2), the token table 5 also has the authentication peer 2-11 and the authentication peer 2- (10 + n). Different things are generated for each (n ≧ 2).

Further, the control unit 23-1 of the source peer 2-1 transmits a connection request from the communication unit 21-1 to the authentication peer 2- (10 + n) (n ≧ 2) via the network N (step S1614). ..

The control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) sends a connection request transmitted from the source peer 2-1 via the network N to the communication unit 21- (10 + n) (n ≧ 2). In response to the reception in 10 + n) (n ≧ 2) (step S1615), the user ID of the issuer of the token corresponding to the hash value of the seed included in the connection request and the expiration date of the seed are set by the communication unit 21-. (10 + n) (n ≧ 2) is acquired from the token table 5 of the shared ledger 20 via the network N (step S1616).

Then, the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) is a user of the source peer 2-1 in which the user ID of the token issuer is included in the authentication query. The authenticity of the token included in the connection request is confirmed by determining whether or not the ID matches and whether or not the seed has expired (step S1617).

After confirming the authenticity, the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) is stored in the storage unit 22- (10 + n) (n ≧ 2). FIG. 15 shows FIG. 15 via the authentication peer 2- (10 + n) (n ≧ 2) by connecting to the destination peer 2-2 via the network N so as to be communicable using the connection information of the destination peer 2-2. The indicated alternative route (secondary route) R (10 + n) (n ≧ 2) is established (step S1618).

Then, the control unit 23- (10 + n) (n ≧ 2) of the authentication peer 2- (10 + n) (n ≧ 2) has completed the establishment of the alternative route (secondary route) R (10 + n) (n ≧ 2). The alternative route establishment report is transmitted from the communication unit 21- (10 + n) (n ≧ 2) to the authentication peer 2- (10 + n) (n ≧ 2) via the network N (step S1619).

The control unit 23-1 of the source peer 2-1 has received the alternative route establishment report transmitted from the authentication peer 2- (10 + n) (n ≧ 2) via the network N by the communication unit 21-1. In response (step S1620 shown in FIG. 19), as shown in FIG. 20, the user ID of the disposal right holder of the token table 5 is transmitted from the communication unit 21-1 via the network N to the user of the source peer 2-1. By digitally signing the ID to rewrite the user ID of the authentication peer 2- (10 + n) (n ≧ 2), the right to dispose of the token table 5 is given by the user of the source peer 2-1 to the authentication peer 2- (10 + n). ) (N ≧ 2) (step S1621).

Then, the control unit 23-1 of the source peer 2-1 notifies that the transfer of the disposal right of the token table 5 is completed from the communication unit 21-1 via the network N to the authentication peer 2- (10 + n) (n). After reporting to ≧ 2) (step S1622), the process returns to the process of step S1601 in order to recalculate the quantitative evaluation value fi for the reliability after the addition of the alternative route (secondary route) R (10 + n). ..

Then, when the control unit 23-1 of the source peer 2-1 determines that the quantitative evaluation value fi is equal to or higher than a predetermined threshold value (step S1603; Yes), the direct route R0 and the alternative route (secondary route) R Assuming that the reliability that the communication terminal 2-m connected via (10 + n) is the transmission destination peer 2-2 is sufficiently high, the direct route R0 and the alternative route (secondary route) from the communication unit 21-1 After starting data communication with the destination peer 2-2 via R11 to R13 (step S1623), the three-point authentication process ends. The control unit 23-1 of the source peer 2-1 detects a quantitative evaluation value fi when the authentication peer 2- (10 + n) in which the product of the confidence constant Cn and the confidence constant Dn is “1” is detected. Is always "1" and exceeds a predetermined threshold value. Therefore, the multiplexing of the connection path may be terminated at that time. Further, the alternative route (secondary route) via the authentication peer 2- (10 + n) in which the product of the confidence constant Cn and the confidence constant Dn is “0” does not contribute to the improvement of the quantitative evaluation value fi. It may not be added.

As described above, in the three-point authentication system 1 according to this modification, the communication terminal 2-m connected via the direct path R0 after the direct path R0 is established is the transmission destination peer 2-2. Calculate the reliability of. Then, the three-point authentication system 1 connects to the authentication peers 2-12 and 2-13 via the network N on condition that the reliability is less than a predetermined threshold value, and connects to the destination peer 2-2. Is requested via the network N to establish alternative routes (secondary routes) R4 to R6.

Specifically, the source peer 2-1 includes a storage unit 22-1 that stores connection information necessary for connection with the authentication peers 2-12, 2-13, and the like. Further, the authentication peers 2-12 and 2-13 include storage units 2-12 and 2-13 for storing connection information necessary for connection with the destination peer 2-2, respectively.

After establishing the direct route R0, the source peer 2-1 calculates the reliability that the communication terminal 2-m connected via the direct route R0 is the destination peer 2-2. The source peer 2-1 connects to the authentication peer 2-12 via the network N by using the connection information of the authentication peer 2-12, provided that the reliability is less than a predetermined threshold value. Next, the source peer 2-1 is for specifying the connection request from the seed, which is the right to connect to the destination terminal 2-2, and the authentication serial ID issued by the authentication peer 2-12. Generate a token. Then, the source peer 2-1 requests the authentication peer 2-12 to connect to the destination peer 2-2 via the network N by transmitting the connection request including the token via the network N.

The authentication peer 2-12 uses the connection information of the destination peer 2-2 in response to the request from the source peer 2-1 to connect to the destination peer 2-2 via the network N. , An alternative route (secondary route) R12 is established by connecting to the destination peer 2-2 via the network N.

The source peer 2-1 establishes an alternative route (sub route) R12 that connects to the destination peer 2-2 via the authentication peer 2-12, and then goes through the direct route R0 and the alternative route (sub route) R12. The reliability that the communication terminal 2-m connected to the communication terminal 2-m is the destination peer 2-2 is calculated. Then, the source peer 2-1 requests the authentication peer 2-13 to connect to the destination peer 2-2 via the network N, provided that the reliability is less than a predetermined threshold value.

The authentication peer 2-13 uses the connection information of the destination peer 2-2 in response to the request from the source peer 2-1 to connect to the destination peer 2-2 via the network N. , The alternative route (sub route) R13 is established by connecting to the destination peer 2-2 via the network N.

Thereby, the three-point authentication system 1 according to the present modification can also have the same effect as the three-point authentication system 1 according to the above embodiment. Further, in the three-point authentication system 1 according to this modification, the communication terminal 2-m connected via the direct route R0 and the alternative route (secondary route) R (10 + n) using the token is the transmission destination peer 2. Based on the authentication of -2, the connection route between the source peer 2-1 and the destination peer 2-2 can be multiplexed. Further, in the three-point authentication system 1 according to this modification, the communication terminal 2-m connected via the direct route R0 and the alternative route (secondary route) R (10 + n) is the transmission destination peer 2-2. The reliability can be evaluated quantitatively.

As a result, the three-point authentication system 1 according to this modification can realize efficient communication.

In the above embodiment, the control unit 23-11 of the authentication peer 2-11 states that the user ID of the destination peer 2-2 is registered in the graph database and the destination peer 2-2 can be authenticated. If it is determined, it is described as issuing an authentication serial ID. However, the present invention is not limited to this, and the control unit 23-11 of the authentication peer 2-11 can authenticate the destination peer 2-2 even when the destination peer 2-2 can be authenticated. May be outsourced to a communication terminal (peer) 2-m belonging to its own connection group.

Specifically, the control unit 23-11 of the authentication peer 2-11 sends the first connection inquiry from the communication unit 21-11 to its own connection group such as relay peers 2-4 to 2-6 via the network N. By transmitting to the communication terminal (peer) 2-m to which it belongs, the authentication of the destination peer 2-2 is entrusted to the communication terminal (peer) 2-m belonging to its own connection group.

The communication terminal (peer) 2-m entrusted with the authentication of the destination peer 2-2 receives the first connection inquiry transmitted from the authentication peer 2-11 via the network N by the communication unit 21-m. In response to this, the connection information corresponding to the user ID of the destination peer 2-2 included in the first connection inquiry is acquired from the graph database from the communication unit 21-m via the network N. Then, the communication terminal (peer) 2-m entrusted with the authentication of the destination peer 2-2 may perform the same processing as the authentication peer 2-11.

As a result, the authentication peer 2-11 can realize the outsourcing of the authentication of the destination peer 2-2, so that the load of the authentication work of the destination peer 2-2 can be distributed.

In the above embodiment, the program executed by the CPU of the control unit 23-m is stored in ROM or the like in advance. However, the present invention is not limited to this, and by applying a program for executing the above-mentioned processing to an existing general-purpose computer, the present invention can function as a communication terminal (peer) 2-m according to the above-described embodiment. You may.

The method of providing such a program is arbitrary, and may be stored and distributed on a computer-readable recording medium (flexible disc, CD (Compact Disc) -ROM, DVD (Digital Versatile Disc) -ROM, etc.), for example. Alternatively, the program may be stored in a storage on a network such as the Internet and provided by downloading the program.

Further, when the above processing is executed by the division between the OS and the application program or the cooperation between the OS and the application program, only the application program may be stored in the recording medium or the storage. It is also possible to superimpose a program on a carrier wave and distribute it via a network. For example, the above program may be posted on a bulletin board system (BBS: Bulletin Board System) on the network, and the program may be distributed via the network. Then, by starting this program and executing it in the same manner as other application programs under the control of the OS, the above processing may be executed.

It should be noted that the present invention enables various embodiments and modifications without departing from the broad spirit and scope of the present invention. Further, the above-described embodiment is for explaining an embodiment of the present invention, and does not limit the scope of the present invention.

This application is based on the Japanese patent application 2020-116017 filed on July 3, 2020. The specification, claims, and drawings of Japanese patent application 202-116017 are incorporated herein by reference.

1 Three-point authentication system (communication system)
2-m communication terminal (peer)
2-1 Source peer (source terminal)
2-2 Destination peer (destination terminal)
2-3 Seed issuing peer 2-4-2-6 Relay peer (relay terminal)
2- (10 + n) authentication peer 2-11 authentication peer (support terminal)
2-12, 2-13 Authentication peer (relay terminal)
4 Seed table 5 Token table (connection request table)
6 Connection information table 21-m Communication unit 22-m Storage unit 22-1 Storage unit (second storage unit)
22-2 Memory unit (3rd storage unit)
22-11 Storage unit (first storage unit)
22-12, 22-13 Storage unit (4th storage unit)
23-m control unit

Claims

A source terminal (2-1) that is a source of data among a plurality of communication terminals (2-m) that are connected via a network (N) and communicate in a peer-to-peer manner.
The communication terminal to which the data is transmitted is supported by the support terminal (2-11), which is the communication terminal (2-m) that supports the establishment of a connection path between the communication terminals (2-m). Establish a first connection route (R0), which is the connection route that directly connects to the destination terminal (2-2), which is (2-m).
After the establishment of the first connection path (R0), the relay terminal (2-4 to 2-6, 2-12, 2) different from the support terminal (2-11) among the communication terminals (2-m) -13) Establishes a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the destination terminal (2-2) via the destination terminal (2-2).
Source terminal (2-1) characterized by this.
After the establishment of the first connection route (R0), the support terminal (2-11) is requested to support the establishment of the second connection route (R4 to R6) via the network (N). Establish a second connection route (R4 to R6),
The source terminal (2-1) according to claim 1.
After establishing the first connection path (R0), the relay terminal (2-12, 2-13) is connected to the relay terminal (2-12, 2-13) via the network (N), and the connection with the transmission destination terminal (2-2) is made. The second connection path (R4 to R6) is established by requesting via the network (N).
The source terminal (2-1) according to claim 1.
After the establishment of the first connection path (R0), the reliability that the communication terminal (2-m) connected via the first connection path (R0) is the destination terminal (2-2). Is calculated,
The relay terminal (2-12, 2-13) is requested to connect to the transmission destination terminal (2-2) via the network (N) on condition that the reliability is less than a predetermined threshold value. do,
The source terminal (2-1) according to claim 3.
A connection request requesting a connection with the destination terminal (2-2), the connection request including the first connection request identification information for specifying the connection request is made via the network (N). Send to the support terminal (2-11) and
The first connection request identification information transmitted from the destination terminal (2-2) via the network (N) and the connection information necessary for connection with the destination terminal (2-2) are provided. The condition is that the first connection request identification information received from the destination terminal (2-2) matches the first connection request identification information transmitted to the support terminal (2-11) in response to the reception. The first connection path (R0) is established by connecting to the destination terminal (2-2) via the network (N) using the connection information of the destination terminal (2-2). Establish,
The source terminal (2-1) according to claim 1.
After the establishment of the first connection path (R0), a second connection request different from the first connection request identification information is connected to the relay terminal (2-12, 2-13) via the network (N). The second connection path (R4 to R6) is established by transmitting the connection request including the identification information via the network (N).
The source terminal (2-1) according to claim 5.
The first connection request identification information is generated from the right to connect to the destination terminal (2-2) and the support terminal issuance information issued by the support terminal (2-11).
The second connection request identification information is generated from the right and the relay terminal issuance information issued by the relay terminal (2-12, 2-13).
The source terminal (2-1) according to claim 6.
The user of the source terminal (2-1) is registered as the disposal right holder of the connection request table (5) for registering the first connection request identification information.
After the establishment of the first connection path (R0), the disposal right of the connection request table (5) is changed by changing the disposal right holder of the connection request table (5) to the user of the support terminal (2-11). To the user of the support terminal (2-11),
The source terminal (2-1) according to claim 5.
A communication system (1) having a plurality of communication terminals (2-m) connected via a network (N) and communicating in a peer-to-peer manner.
The source terminal (2-1) that is the source of data among the plurality of communication terminals (2-m) is
The communication terminal to which the data is transmitted is supported by the support terminal (2-11), which is the communication terminal (2-m) that supports the establishment of a connection path between the communication terminals (2-m). Establish a first connection route (R0), which is the connection route that directly connects to the destination terminal (2-2), which is (2-m).
After the establishment of the first connection path (R0), the relay terminal (2-4 to 2-6, 2-12, 2) different from the support terminal (2-11) among the communication terminals (2-m) -13) Establishes a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the destination terminal (2-2) via the destination terminal (2-2).
A communication system (1) characterized by the above.
The source terminal (2-1) is
Upon receiving the connection information necessary for connecting to the destination terminal (2-2) transmitted from the destination terminal (2-2) via the network (N),
After establishing the first connection path (R0), a connection information table (6) for registering the connection information of the destination terminal (2-2) is generated.
The support terminal (2-11) is requested to support the establishment of the second connection path (R4 to R6) via the network (N).
After the destination terminal (2-2) and the relay terminal (2-4 to 2-6) are connected via the network (N), the support terminal (2-11) connects to the network (N). ), The relay terminal (2-4-2-6) and the network (N) are connected by using the connection information necessary for the connection with the relay terminal (2-4 to 2-6) transmitted via). By connecting via the above, the second connection path (R4 to R6) is established, and the second connection path (R4 to R6) is established.
The support terminal (2-11) is
The first storage unit (22-11) for storing the connection information of the relay terminals (2-4 to 2-6) is included.
In response to a request from the source terminal (2-1) to support the establishment of the second connection path (R4 to R6) via the network (N), the destination terminal (2-2). ) Is requested from the relay terminal (2-4 to 2-6) via the network (N).
After the transmission destination terminal (2-2) and the relay terminal (2-4 to 2-6) are connected via the network (N), the relay terminal (2-4 to 2-6) The connection information is transmitted to the source terminal (2-1) via the network (N), and the connection information is transmitted to the source terminal (2-1).
The relay terminals (2-4 to 2-6) are
Connection of the destination terminal (2-2) in response to a request from the support terminal (2-11) to connect to the destination terminal (2-2) via the network (N). Information is acquired from the connection information table (6), and information is obtained from the connection information table (6).
Using the connection information of the destination terminal (2-2), the destination terminal (2-2) is connected to the destination terminal (2-2) via the network (N).
The communication system (1) according to claim 9.
The source terminal (2-1) is
A second storage unit (22-) that stores the source identification information for identifying the source terminal (2-1) and the destination identification information for identifying the destination terminal (2-2). Including 1)
After the establishment of the first connection route (R0), the connection information table for registering the source identification information, the destination identification information, and the connection information of the destination terminal (2-2) in association with each other. Generate (6) and
By transmitting the source identification information and the destination identification information to the support terminal (2-11) via the network (N), the second connection to the support terminal (2-11) is made. Requesting assistance in establishing routes (R4 to R6),
The support terminal (2-11) is
In response to receiving the source identification information and the destination identification information transmitted from the source terminal (2-1) via the network (N), the source identification information is used. By transmitting the destination identification information to the relay terminal (2-4 to 2-6) via the network (N), the connection with the destination terminal (2-2) is relayed. Request to the terminal (2-4 to 2-6) and
The relay terminals (2-4 to 2-6) are
In response to receiving the source identification information and the destination identification information transmitted from the support terminal (2-11) via the network (N), the received source identification information The destination terminal, provided that the information and the destination identification information match the source identification information and the destination identification information registered in the connection information table (6), respectively. Using the connection information of (2-2), the destination terminal (2-2) is connected to the network (N) via the network (N).
The communication system (1) according to claim 10.
The source terminal (2-1) is
A second storage unit (22-1) for storing connection information necessary for connection with the relay terminal (2-12, 2-13) is included.
Using the connection information of the relay terminal (2-12, 2-13), the relay terminal (2-12, 2-13) is connected to the relay terminal (2-12, 2-13) via the network (N).
A connection with the destination terminal (2-2) is requested from the relay terminal (2-12, 2-13) via the network (N).
The relay terminals (2-12, 2-13)
Includes a fourth storage unit (2-12, 2-13) that stores connection information required for connection to the destination terminal (2-2).
In response to a request from the source terminal (2-1) to connect to the destination terminal (2-2) via the network (N), the destination terminal (2-2) The second connection path (R12, R13) is established by connecting to the destination terminal (2-2) via the network (N) using the connection information.
The communication system (1) according to claim 9.
The source terminal (2-1) is
After the establishment of the first connection path (R0), the reliability that the communication terminal (2-m) connected via the first connection path (R0) is the destination terminal (2-2). Is calculated,
The relay terminal (2-12, 2-13) is requested to connect to the transmission destination terminal (2-2) via the network (N) on condition that the reliability is less than a predetermined threshold value. do,
The communication system (1) according to claim 12.
The relay terminals (2-12, 2-13)
The first relay terminal (2-12) and
With the second relay terminal (2-13),
Including
The source terminal (2-1) is
After establishing the second connection route (R12) to connect to the transmission destination terminal (2-2) via the first relay terminal (2-12), the first connection route (R0) and the second connection. The reliability that the communication terminal (2-m) connected via the route (R12) is the transmission destination terminal (2-2) is calculated.
The second relay terminal (2-13) is requested to connect to the destination terminal (2-2) via the network (N) on condition that the reliability is less than the predetermined threshold value. ,
The communication system (1) according to claim 13.
A communication method using a source terminal (2-1) that is a source of data among a plurality of communication terminals (2-m) that are connected via a network (N) and communicate in a peer-to-peer manner. There,
The communication terminal to which the data is transmitted is supported by the support terminal (2-11), which is the communication terminal (2-m) that supports the establishment of a connection path between the communication terminals (2-m). Establish a first connection route (R0), which is the connection route that directly connects to the destination terminal (2-2), which is (2-m).
After the establishment of the first connection path (R0), the relay terminal (2-4 to 2-6, 2-12, 2) different from the support terminal (2-11) among the communication terminals (2-m) -13) Establishes a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the destination terminal (2-2) via the destination terminal (2-2).
A communication method characterized by that.
To the computer of the source terminal (2-1) that is the source of data among a plurality of communication terminals (2-m) that are connected via the network (N) and communicate in a peer-to-peer manner.
The communication terminal to which the data is transmitted is supported by the support terminal (2-11), which is the communication terminal (2-m) that supports the establishment of a connection path between the communication terminals (2-m). The procedure for establishing the first connection route (R0), which is the connection route directly connected to the destination terminal (2-2), which is (2-m), and
After the establishment of the first connection path (R0), the relay terminal (2-4 to 2-6, 2-12, 2) different from the support terminal (2-11) among the communication terminals (2-m) A procedure for establishing a second connection route (R4 to R6, R12, R13), which is the connection route for connecting to the destination terminal (2-2) via -13), and
A program to execute.