JP2002281040A - Network system, router, terminal equipment, communication method, its program and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize data link level authentication in a radio network by a simple operation. SOLUTION: An IC card which is preliminarily recorded with an identifier by an ISP(Internet service provider) is received. In the first step S1, the IC card is inserted into a router 12. The identifier, for example, (ID=4) recorded in the IC card is read through the IC card interface of the router 12. Then, the IC card is returned (mounted) to terminal equipment TE4. In communicating, the terminal equipment TE4 informs the router 12 of the (ID=4). The router 12 recognizes that the terminal equipment TE4 is provided with the same ID as the read ID. Thus, the authentication of a data link level between the router 12 and the terminal equipment TE4 can be established.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system, a router, a terminal device, a communication method, a program, and a recording medium applicable to, for example, connecting a home network to the Internet.

[0002]

2. Description of the Related Art Content sent to a home via the Internet is usually sent to a personal computer. The personal computer stores downloaded compressed music data, image data, and the like. The user tries to reproduce these contents that have arrived at the personal computer with an AV (audio and / or visual) device other than the personal computer. However, without a home network, it is difficult to fulfill such demands.

As a network architecture, an Internet protocol system commonly called TCP / IP used in the Internet and an OSI reference model are known. In the OSI reference model, there are seven layers, the first layer is a physical layer, the second layer is a data link layer, the third layer is a network layer, the fourth layer is a transport layer, the fifth layer is a session layer, and the sixth layer. Layer is presentation layer, 7th
The layer is an application layer. The physical layer provides the physical interconnect. Here, the data is treated as a bit string. The data link layer secures a physical communication path with a communication partner and performs contention control and the like. Here, data is handled in units such as more structured frames.

[0004] TCP / IP is composed of four conceptual layers: a network interface layer, an Internet layer, a transport layer, and an application layer.
These are built on top of the physical layer. According to the OSI reference model, data link layer → network interface layer, network layer → internet layer,
Transport layer → transport layer, session layer
Presentation layer / application layer → application layer. The network interface layer is a layer that secures communication within one sub-network. For example, PPP (Point-to-Poin) that performs communication between two points
t Protocol).

[0005] PPP (Point-to-Point Protocol) is a protocol used as standard in dial-up IP connection. Data communication by a plurality of protocol authentications is provided on a line connected one-to-one. The connection procedure includes: 1) a request for link establishment (2) authentication of a connected party; 3)
A link is established through information exchange for each protocol.

As a home network, IEEE (I
nstitute of Electrical and Electronics Engineers)
1394, a wired system such as Ethernet, and some wireless transmission systems have been proposed. The wireless transmission method is IEEE
E802.11, Bluetooth, Wireless
s1394 and the like have been proposed.

In recent years, the number of terminal devices connected to a home network has been increasing, and each terminal device is not limited to simply communicating with a specific target, but is also connected to the Internet and has a LAN (Local Area Network). ) Can be referenced from the network beyond. In order for a terminal device to participate in such a network, at least information can be passed from one LAN to another LAN and information can be exchanged with another terminal device in the network to which the terminal device is connected. A terminal device called a router is used.

[0008]

The general network architecture described above, for example, the TCP / IP protocol is applied to a home network. When the home network is a wireless network, it is desirable to perform authentication encryption at the data link layer level in order to prevent others from seeing. The setting operation of a router having a wireless data link for this purpose is technical and professional, and it is necessary to perform a troublesome setting operation when a user newly connects a terminal device.

Accordingly, an object of the present invention is to provide a network system, a router, a terminal device, a communication method, a program, and a recording which enable data link level authentication without requiring a setting operation of a router having a wireless data link. To provide a medium.

[0010]

In order to solve the above-mentioned problem, according to the first aspect of the present invention, in a network system in which a router and a terminal device are wirelessly connected, a unique identifier is recorded and a removable recording is performed. Medium is provided,
This is a network system in which a recording medium is attached to a terminal device after being attached to a router, and the router reads an identifier, thereby establishing a link between the router and the terminal device specified by the identifier.

According to a fourth aspect of the present invention, there is provided a router for exchanging information between wirelessly connected terminal devices, wherein a unique identifier is recorded, a removable recording medium is provided, and the identifier is determined from the mounted recording medium. Is read, and a link is established with the terminal device specified by the identifier.

According to a seventh aspect of the present invention, there is provided a terminal device for wirelessly exchanging information, in which a unique identifier is recorded, a removable recording medium is made freely attachable, and the identifier is read from the attached recording medium to read the identifier. This is a terminal device in which a link is established by an identifier during communication.

The invention according to claim 8 is a communication method in a network system in which a router and a terminal device are wirelessly connected, wherein a unique identifier is recorded, a removable recording medium is prepared, and the recording medium is stored in the router. Attaching the router to read the identifier; attaching the recording medium to the terminal device; reading the identifier by the terminal device; and detecting by the router that the terminal device is specified by the identifier. And a step of establishing a link with the communication method.

According to a ninth aspect of the present invention, in a program for a network system in which a router and a terminal device are wirelessly connected, a unique identifier is recorded, a removable recording medium is prepared, and the recording medium is mounted on the router. A step in which the router reads the identifier, a step of attaching the recording medium to the terminal device, and a step in which the terminal device reads the identifier;
A program for causing a computer to execute a step of establishing a link between the router and the terminal device by the router detecting that the terminal device is specified by the identifier.

According to a tenth aspect of the present invention, in a recording medium recording a program for a network system in which a router and a terminal device are wirelessly connected, a unique identifier is recorded and a removable recording medium is prepared. Attaching to the router, the router reading the identifier, attaching the recording medium to the terminal device, reading the identifier, and the router detects that the terminal device is specified by the identifier, And a step of establishing a link with the terminal device.

According to the present invention, by mounting the recording medium on the router and reading the identifier on the recording medium by the router, authentication for communication between the router and the terminal device specified by the identifier can be performed. Become. Therefore, the user does not need to perform troublesome operations such as setting the router.

[0017]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below. FIG. 1 illustrates an example of a system according to an embodiment. Reference numeral 1 denotes the Internet, and reference numeral 2 denotes I as a server connected to the Internet 1.
SP (Internet Service Provider). ISP2
Has a mail server, a DNS server, a Proxy server, etc., provides a normal Internet connection function, and has an authentication database 3.

Reference numeral 11 indicates a home, and reference numeral 12
Indicates a home gateway, for example, a router. ISDN (Integrated Services D) between the ISP 2 and the router 12
igital Network), leased line, ADSL (Asymmetric Digi
xDSL (x Digital Subscri
ber Line), bidirectional access line 4 such as optical fiber
Connected by When using the ISDN, a DSU (Digital Service Uniform) is provided between the router 12 and the ISDN.
t) is inserted.

It is also possible to use a cable television line as the bidirectional access line 4 and connect a cable television service company. The service company distributes audio and / or visual content via a cable television base station and a digital set-top box provided in the home 11. Such a cable television service company is also a type of ISP2 that provides a connection service to the Internet.

In one embodiment, a wired LAN indicated by reference numeral 13 and a wireless LAN indicated by reference numeral 14 are installed in the home 11. These wired LAN 13 and wireless LAN 14 constitute a home network. As the wireless LAN 14, IEEE802.11, Blu
For example, it is possible to use Bluetooth, Wireless 1394, or the like. Note that the home network may include another network. For example, a mobile phone is connected by wireless LAN,
The mobile phone and another device may be connected by Bluetooth. Although the present invention is characterized by connection control of devices that are wirelessly connected, the present embodiment will describe devices that are mixed with those that are connected by wire.

For the wired LAN 13, the terminal device TE
1, TE2 and TE3 are connected. TE4 indicates a terminal device that is newly trying to connect to the wireless LAN 14. Terminal devices include personal computers (desktop or notebook), audio devices such as CD (Compact Disc) players, television-related devices such as tuners and displays, and DVDs (Digital Versatile D).
Video recorders / players such as isc or Digital Video Disc) devices, portable information devices, etc. can be connected. Further, home appliances such as air conditioners and refrigerators can be connected to the home network.

Each of the terminal devices connected to the wired LAN 13 and the wireless LAN 14
Are supplied via the router 12. For example, content data such as audio data and video data is supplied to the router 12. At the same time, wired LAN1
3 and / or terminal devices connected to the wireless LAN 14 can communicate with each other.

In the case of a home network managed by the ISP 2, the terminal device has a unique identifier. The identifier is recorded in advance by the ISP 2 on a recording medium that can be attached to and detached from the terminal device (that is, a removable recording medium). As a recording medium, an IC for recording information in a flash memory
An information recording medium capable of holding information can be used, such as a card (also called a memory card), a magnetic card for recording information on a magnetic material, a plastic card for recording information as a graphic pattern such as a barcode, or the like. . In the present embodiment, an IC card is used. Note that the IC card has a LAN function other than the function of holding the identifier.
It may have a function such as a card. The router 12 also has its own identifier (ID: 0).

The IC card on which the identifier (ID) is recorded can be mounted on the router 12 and each terminal device. (ID: 1) is recorded on the IC card MS1 mounted on the terminal device TE1, and (ID: 2) is recorded on the IC card MS2 mounted on the terminal device TE2.
The IC card MS3 attached to the terminal device TE3 includes:
(ID: 3) is recorded. Further, the terminal device TE
(ID: 4) is recorded in the IC card MS4 attached to the IC card MS4. The number given to the ID has a meaning for specifying each ID, and does not mean a value of the data. The data structure of the ID is a predetermined format such as a bit length, and is preferably encrypted.

When the user attempts to connect the terminal device TE4 to the wireless LAN 14, the ISP 2 is issued a new identifier (ID: 4). That is, the IC card MS4 in which the identifier is recorded is distributed.
FIG. 1 shows a stage where the user has obtained the IC card MS4. Then, the IC card MS4 is mounted on the router 12, as shown in FIG. The router 12 reads the identifier (ID: 4) from the IC card MS4 and reads it into the router 12. In other words, (ID: 4) is registered in the router 12 in advance.

When the reading of the identifier of the router 12 is completed, the IC card MS4 is removed from the router 12, and is mounted on the terminal device TE4 again. By transmitting an identifier (ID: 4) when the terminal device TE4 communicates with the router 12, authentication at the data link level between the router 12 and the terminal device TE4 is performed. If necessary, an encryption key may be generated using the identifier (ID: 4) to encrypt the contents of the communication.

As described above, the IC card MS4 is connected to the router 1
2 and then insert the IC card MS4 into the terminal device TE4
, Authentication at the data link level can be performed. Thus, it is possible to prevent an unauthorized person from seeing the contents of the communication of the wireless LAN 14. That is, it is possible to prevent a third party from connecting to the wireless LAN 1 from outside the house where the router 12 is installed. Further, in one embodiment, the correspondence between the ID of the router and the ID of the terminal device is registered in the database 3 provided in the ISP 2 for the purpose of performing terminal authentication. The ID of the router 12 is described as HGWID.

In the database 3 provided in the ISP 2, information on a combination of the HGW ID of the router 12 and the ID of the terminal device is registered in advance. As an example, the registration processing for the database 3 is performed when the ISP 2
And made by dealers. For example, when the user purchases the terminal device TE4, the user brings a card recording the HGWID of the router 12 at home to the store, and the store stores (HG) based on the information of the router and the information of the IC card MS4.
The data indicating the correspondence of WID: 0, ID: 4) is registered in the database 3. Along with the terminal device TE4, the user acquires an IC card MS4 in which (ID: 4) is recorded in advance.

Of course, the method of registration in the database 3 is not limited to this. For example, when a sales contract is concluded through the Internet 1 and the ISP 2, the ISP 2 or the receiving side of the order transmits the HGW ID of the router and the IGW of the terminal based on the information of the router to which the terminal equipped with the communication software is connected.
Data indicating the correspondence of D can be registered in the database 3.

FIG. 3 schematically shows the configuration of the router 12. The router 12 includes a wireless media access control unit indicated by reference numeral 21, a route control unit indicated by reference numeral 22,
A wireless control unit indicated by reference numeral 23, an inquiry unit indicated by reference numeral 24, an IC card interface 25 indicated by reference numeral 25, an access line media access control unit indicated by reference numeral 26, and a wired medium indicated by reference numeral 27 And an access control unit. The wireless media access control unit 21 controls data transmission to the wireless LAN 14. The wired media access control unit 27 controls transmission of data to the wired LAN 13.

A plurality of terminal devices are wirelessly connected to each other by the wireless control unit 23. The route control unit 22 is connected to the bidirectional access line 4. The inquiry unit 24 includes a wireless media access control unit 21, a route control unit 22, and an access line media access control unit 2.
6, and inquires of the ISP 2 whether a new terminal device can be connected. The IC card interface 25 is an interface of an IC card, and can read an identifier recorded in a predetermined format. Further, key data and the like can be recorded on the IC card as needed.

The authentication processing at the data link level will be described with reference to the flowchart of FIG. This processing flow is a program that is installed in the router 12 or another computer and controls the wireless LAN 14. This program is recorded on a computer-readable recording medium as needed. However, step S0 is a process of registering the ID in the database 3 in advance as described above, and is performed separately from the subsequent processes.

In the first step S 1, the router 12
The C card is inserted. An identifier recorded on the IC card, for example, (ID: 4) is read via the IC card interface 25 of the router 12. Next, the IC card is returned to (attached to) the terminal device TE4. Then, at the time of communication, the terminal device TE4 notifies the router 12 of (ID: 4). The router 12 recognizes that the terminal device TE4 has the same ID as the ID read by the terminal device TE4.
In this way, authentication at the data link level between the router 12 and the terminal device TE4 is established.

Next, terminal authentication is performed. Terminal authentication is
This process is required regardless of whether it is wired or wireless, and is necessary for establishing a secure network even without installing a firewall. Hereinafter, the terminal authentication will be described.

FIG. 5 shows that the terminal devices TE1, TE2 and TE3 connected to the wired LAN 13
1, MS2, and MS3 are attached, and the identifiers recorded on these IC cards are registered in the database 3 of the ISP 2. As a method of registering the identifier of the terminal device connected to the wired LAN 13 in the database 3, the same method as described above is possible.

The flow of the terminal authentication process will be described with reference to FIG. This processing flow is a program that is installed in the router 12 or another computer and controls the wired LAN 13 and the wireless LAN 14. This program is recorded on a computer-readable recording medium as needed. Note that an ID registration process for the database is performed in advance.

As an example, the terminal device TE4 (ID: 4)
Performs communication with the terminal device TE3 (ID: 3). In step S11, the terminal device TE4 requests the terminal device TE3 to establish a link. In step S12, the terminal device TE3 that has received this request sends the terminal device TE3 to the ISP 12 via the router 12.
Inquire whether 4 belongs to the same group or not. The inquiry unit 24 of the router 12 cooperates with the ISP
It also transmits the identifier (ID: 0) of the router 12 to the router 12. Preferably, the communication for authentication is encrypted.

In step S13, the ISP 2 refers to the database 3. Then, in step S14,
It is checked whether (ID: 3) and (ID: 4) are in the same group. The database 3 contains (HGW ID:
For (0), (1, 2, 3, 4) is registered as an ID. Therefore, (ID: 3) and (ID: 4) are determined to be the same group.

The result is transmitted from the ISP 2 to the bidirectional access line 4 and the access line media access control unit 26.
The route is transmitted to the router 12 via the route controller 22 and the router 12, and further transmitted from the router 12 to the terminal device TE3. In the case of the same group, terminal authentication is established (step S15). Then, in step S16, security between the terminal devices TE3 and TE4 is established. If it is determined in step S14 that the groups are not the same group, the terminal authentication is not established (step S17). In that case, no security is established. To ensure the security of your home network, after the link is established,
When the IC card is removed from the terminal device, the establishment of security is invalidated.

FIG. 7 shows a situation where a terminal device registered in another person's home network has brought it to his / her own home network. Other terminal device is TE1
0, the IC card is described as MS10, and its identifier is described as (ID: 10). In this case, the IC card MS10 is attached to the router 12, and the (ID:
Read 10). Thereby, the data link level authentication is established. However, in the database 3 of the ISP 2, (ID: 10) indicates that the router 12 (HG
W ID: 0) is not registered as the same group. Therefore, terminal authentication is not established.

This means that the terminal device TE10 can be connected to the Internet 1 and the person's home network via the router 12, but cannot communicate with the terminal device connected to the wired LAN 13 and the wireless LAN 14. It means something. That is, a terminal device having a data link level authentication mechanism using an IC card is:
There is an advantage that communication with the outside is possible via another home network having a similar mechanism.

FIG. 8 shows an example in which a terminal device, for example, TE4 is taken out of the home and communication is performed via the public access point 31. The terminal device TE4 has (ID:
4) is mounted.
However, in this case, it is impossible to attach the IC card MS4 to the remote router 12, so that the data link level authentication is omitted. However, it is possible for the public access point 31 to have a configuration capable of accepting advance registration of an identifier by an IC card.

The terminal device TE4 can access the Internet 1 through the public access point 31.
Further, communication with a terminal device of a home network of the home is enabled. In this case, the terminal authentication as described above is performed, and security is established only when the terminal authentication is established. Thus, even a terminal device used in a home network can be taken out of the home and used.

The present invention is not limited to the above-described embodiment of the present invention, and various modifications and applications can be made without departing from the gist of the present invention. For example,
In the above-described embodiment, an example of a home network has been described. However, the present invention is applicable not only to a home but also to a company network.

[0045]

According to the present invention, when the home network is a wireless network, authentication at the data link level can be performed in order to prevent another person from seeing and seeing, and security can be improved by terminal authentication. Further, there is no need for a router setting operation or the like for that, and there is an advantage that the work of attaching and detaching the recording medium can be performed.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a network system configuration according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a network system configuration according to an embodiment of the present invention.

FIG. 3 is a block diagram illustrating a configuration example of a router according to an embodiment of the present invention.

FIG. 4 is a flowchart illustrating a data link level authentication process according to an embodiment of the present invention.

FIG. 5 is a block diagram showing a network system configuration according to an embodiment of the present invention.

FIG. 6 is a flowchart illustrating a terminal authentication process according to an embodiment of the present invention.

FIG. 7 is a block diagram showing a network system configuration according to an embodiment of the present invention.

FIG. 8 is a block diagram showing a network system configuration according to an embodiment of the present invention.

[Explanation of symbols]

1 ・ ・ ・ Internet, 2 ・ ・ ・ ISP, 3 ・ ・ ・ Database, 12 ・ ・ ・ Router, 13 ・ ・ ・ Wired LA
N, 14: wireless LAN, TE1 to TE4, TE10
... Terminal devices, MS1 to MS4, MS10 ... IC
card

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Motoki Nakade 6-7-35 Kita-Shinagawa, Shinagawa-ku, Tokyo Inside Sony Corporation (72) Yoshiyuki Kunigami 6-7 Kita-Shinagawa, Shinagawa-ku, Tokyo No. 35 Inside Sony Corporation (72) Inventor Akihiro Hogimoto 6-7-35 Kita-Shinagawa, Shinagawa-ku, Tokyo Tokyo Inside (72) Inventor Makoto Oka 6-35, Kita-Shinagawa, Shinagawa-ku, Tokyo No. 72 Inside Sony Corporation (72) Inventor Shinko Matsuyama 6-7-35 Kita-Shinagawa, Shinagawa-ku, Tokyo Inside Sony Corporation (72) Atsushi Shionozaki 6-35, Kita-Shinagawa, Shinagawa-ku, Tokyo Sony Corporation F term (reference) 5K033 AA08 BA01 BA15 CB01 DA19 DB19 EA07 EC01 EC03

Claims (10)

[Claims] In a network system in which a router and a terminal device are wirelessly connected, a unique identifier is recorded, a removable recording medium is provided, and the recording medium is attached to the terminal device after being attached to the router. A network system in which the router reads the identifier to establish a link between the router and a terminal device specified by the identifier. 2. The network system according to claim 1, wherein an identifier is written in advance on the recording medium on the connection device side. 3. The network system according to claim 1, wherein the condition for establishing a link is that the recording medium is attached to a terminal device. 4. A router for exchanging information between terminal devices connected wirelessly, wherein a unique identifier is recorded, a removable recording medium is freely attachable, and the identifier is obtained from the attached recording medium. A router that reads and establishes a link with the terminal device specified by the identifier. 5. The router according to claim 4, wherein an identifier is previously written on the recording medium on the connection device side. 6. The router according to claim 4, wherein the condition for establishing a link is that the recording medium is attached to a terminal device. 7. A terminal device for wirelessly exchanging information, wherein a unique identifier is recorded, a removable recording medium is made attachable, and the identifier is read from the attached recording medium, and the identifier is read at the time of wireless communication. A terminal device whose link is established by an identifier. 8. A communication method in a network system in which a router and a terminal device are wirelessly connected, wherein a unique identifier is recorded, a removable recording medium is prepared, and the recording medium is mounted on the router. A router reading the identifier, mounting the recording medium on a terminal device, the terminal device reading the identifier, and the router detects that the terminal device is specified by the identifier, Establishing a link between the router and the terminal device. 9. A program for a network system in which a router and a terminal device are wirelessly connected, wherein a unique identifier is recorded, a removable recording medium is prepared, the recording medium is mounted on the router, and the router Reading an identifier, mounting the recording medium on a terminal device, reading the identifier by the terminal device, and detecting that the terminal device is specified by the identifier, the router detects the terminal device, Establishing a link with the terminal device. 10. A recording medium recording a program for a network system in which a router and a terminal device are wirelessly connected, wherein a unique identifier is recorded, a removable recording medium is prepared, and the recording medium is mounted on the router. Reading the identifier by the router, attaching the recording medium to a terminal device, reading the identifier by the terminal device, and detecting that the terminal device is specified by the identifier. A computer-readable recording medium recording a program for causing a computer to execute a step of establishing a link between the router and the terminal device.