JP2005080255A - Communication method and communication system using internet protocol - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication method and a communication system for more safely performing communications via the Internet even in a normally connected environment wherein a dynamic IP address is lent. <P>SOLUTION: An IP address is reported from a remote controller to a server device, and the server device transports IP addresses of the remote controller and the user device to the both in response to a connection request from the user device having an access right. The remote controller sets an IP filter of a router to permit only connection from a designated IP address, so that communications can be safely performed. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

The present invention relates to a communication method and a communication system using an Internet protocol, and more particularly to a highly secure communication method and communication system using a server that mediates and manages a connection between a user and a remote control device.

In recent years, the constant connection environment has become common due to the spread of broadband lines such as ADSL (Asymmetric Digital Subscriber Line) and FTTH (Fiber To The Home). Internet users (hereinafter referred to as “users”) are able to connect to home PCs (Personal Computers)
It is also possible to connect a device such as a camera with the World Wide Web server function (hereinafter referred to as a remote control device) to the Internet via an ADSL modem and to access the remote control device from a remote location via the Internet.

However, a problem in accessing the remote control device via the Internet is the identification of the address on the network determined by the IP address. Although it depends on the type of contract, the IP address given by the Internet service provider (hereinafter referred to as ISP) is usually DHCP (Dynamic Host
It is a dynamic global IP address distributed by Configuration Protocol RFC1531), not a fixed address. Since the IP address is information for identifying the host in the network, it is not convenient to change the IP address when accessing the remote control device via the Internet.

In order to solve this problem, there is a service called Dynamic Domain Name System (hereinafter referred to as DDNS) regardless of whether it is charged or free. The contents of this DDNS service are described in the following Japanese Patent Application Laid-Open No. 2003-169077. If this is used, even if the IP address of the remote control device changes, the IP address is periodically notified to the DDNS server, and the user Since it is registered as a dedicated domain name = notified IP address, the IP address of the remote control device can be specified by specifying the domain name for the user from a remote location, and communication can be performed.
JP 2003-169077 A RFC 1531 Dynamic Host Configuration Protocol RFC 2136 Dynamic Updates in the Domain Name System (DNS UPDATE)

When anyone wants to freely access a remote control device having an IP address that is dynamically changed as described above via the Internet, registration of the IP address, such as DDNS, and notification of the address according to the request A mechanism to do this is necessary. However, when it is desired to access a remote control device that can obtain private information privately from the Internet, the communication system using DDNS has the following disadvantages in terms of security.

-Since DDNS itself is an open service, anyone other than the user can know the IP address of the remote control device.
-Since the IP address of the device itself that the user uses for access from a remote location often changes dynamically, it is not known from which IP address to connect, so basically from any IP address to the remote control device It needs to be accessible.
・ Because it is necessary to keep the connection port open so that the user can access it at any time, there is a risk of being a target of harmful attacks from the Internet.
The present invention has been made based on such a background, and an object thereof is a communication method for performing communication via the Internet more safely even in a constant connection environment where a dynamic IP address is lent. And providing a communication system.

In order to achieve the above object, the remote control device periodically or when the network address used by the remote control device changes to the server device, the remote control device's own network address information, and the server device uses the remote control device. Device-specific information for individual identification is transmitted. The remote control device has a function of permitting only connection from a device having a network address transmitted via a network from the server device, and rejecting connection from a device having another network address. A function is provided for associating and managing the address of the remote control device transmitted from the remote control device, device-specific information, and user identification information having an access right to the remote control device.

The user device communicates to the server device that it wants to connect to the remote control device, and in response, the server device
Confirm that the user device has the access right to the remote control device, communicate the network address of the remote control device to the user device, and communicate the network address of the user device to the remote control device. In response, the remote control device sets itself to allow connection from the network address of the user device. With the above method, the user apparatus and the remote control apparatus can know each other's network address and can communicate.

According to the present invention, even in an always-on environment where a dynamic network address is lent, the remote control device notifies the server device of the network address, and is transmitted from the server device only when there is a request from the user device. Since the remote control device permits only the network address to be connected and the user device is connected to the remote control device using the network address transmitted from the server device, a system for highly secure communication can be provided. .

Hereinafter, an embodiment of the present invention will be described with reference to FIGS. The IP address is expressed in a format such as (aaaa) for convenience. Originally, the part before and after the period is expressed by numbers from 0 to 255, but is expressed as (aaaa) for the sake of simplicity. There is no particular significance in using the same character for all four digits, and it does not represent the same numerical value. In the present embodiment, a procedure and operation contents until a user (user device) starts communication with a remote control device via a server device are shown. FIG. 1 shows connection between devices, and FIG. 2 shows a communication sequence. Represents.

Reference numeral 101 denotes a server device, 102 denotes the Internet, 103 denotes a user device, 104 denotes a telephone station side ADSL modem, 105 denotes a user home side ADSL modem, and 106 denotes a remote control device. The server apparatus 101 is a server machine having a network interface, and is assigned a fixed global IP address (xxxx).

As application software, connection management software, HTTP
The server apparatus 101 is operated using (Hyper Text Transfer Protocol RFC2616) or the like. The user apparatus 103 is a PC equipped with an HTTP browser and is assigned a global IP address (yyyy).
Although the user apparatus 103 is a PC in this embodiment, a portable information terminal or a mobile phone that can communicate with HTTP may be used instead of the PC. The remote control device 106 is a PC that operates connection control software, and assigns a private IP address (qqqq) as a fixed value.

The router-type ADSL modem 105 usually has a DHCP server function, and the ADSL modem 105
An IP address can be assigned to a device connected to the network, but in this embodiment, it is necessary to use a function (port forward function) for transferring packets when connecting from the Internet, which will be described later. Is assigned in advance. In this embodiment, the remote control device 106 is a PC. However, a device other than the PC that can operate the connection control software, such as a portable information terminal or a camera with a network function, may also be used.

The user apparatus 103 and the remote control apparatus 106 store the global IP address (xxxx) of the server apparatus 101 in advance, and communicate with the server apparatus 101 based on this. The remote control device side of the ADSL modem 105 has a fixed private IP address (pppp), and the global IP address (zzzz) on the Internet side is a dynamic IP address assigned by DHCP from an Internet service provider (not shown). is there.

When communicating from the remote control device 106 to the server device 101, the NAT of the ADSL modem 105 is used.
(IP address private IP address (qqqq) is set to global IP by (Network Address Translation) function
Communication is performed when the ADSL modem 105 rewrites the destination IP address (zzzz) of the return packet to the private IP address (qqqq) of the remote control device 106 by rewriting the address (zzzz).

On the other hand, the port forward function of the ADSL modem 105 is used when connecting from the Internet side, for example, when communicating by connecting from the server apparatus 101 to the remote control apparatus. The port forward function is a function for transferring a packet addressed to a specific port number to a specified host in a LAN (Local Area Network). In this embodiment, the IP address (qqqq) of the remote control device 106 is used. Set to forward to. This function enables communication in response to a connection from the Internet side.

However, in this embodiment, the port forward function is turned off (off) so that connections from an unspecified number on the Internet side are not accepted except for communication with the user apparatus 103 for secure communication. In addition, an ADS is specified in advance so that a connection initiated from the Internet side is not accepted by an IP filter function for specifying whether an IP address, a port number, and a protocol (TCP, UDP, etc.) are passed and the packet is allowed to pass.
The L modem 105 is set. Note that the port forward function, IP filter function, and the like provided in the ADSL modem 105 can be set by communicating with the ADSL modem 105 itself using HTTP, TELNET, or the like.

Next, a specific procedure until the user apparatus 103 and the remote control apparatus 106 start communication will be described with reference to FIGS. 1 and 2. FIG. 2 is a diagram in which time advances from top to bottom, and the remote control device 106,
Arrows extending in the horizontal direction from the vertical lines of the server apparatus 101 and the user apparatus 103 mainly indicate the direction of communication packet exchange. However, the exchange of packets for authentication is shown together with the packet at the start of connection. In this embodiment, communication is performed using TCP, but UDP may be used on the assumption that the application side checks whether there is a problem with data and performs retransmission processing or the like.
Hereinafter, step 1 (denoted as S1) to step 13 (denoted as S13) will be described.

S1: First, the remote control device 106 connects to the server device 101 every other minute to notify the server device 101 of the Internet-side IP address of the ADSL modem 105. After connecting to the server apparatus 101, the ID and password of the remote control apparatus 106 registered in advance are transmitted for authentication.

S2: Next, the remote control device 106 transmits the port number Port1 for performing port forwarding to the server device 101. The server apparatus 101 performs registration processing (1) 201 by associating the port number Port1 of the remote control apparatus 106 that has been successfully authenticated with the IP address used for connection. At this time, the port forward function of the ADSL modem 105 is disabled.

S3: The server apparatus 101 checks whether there is a connection request when the registration process (1) 201 ends,
If there is not, only OK is transmitted to notify the remote control device 106 that the processing has been normally completed, and the remote control device 106 is disconnected.

S4: The user device 103 connects to the server device 101 to request connection to the remote control device 106.
After connection, authentication is performed by transmitting the ID and password of the user device 103 registered in advance.

S5: The user device 103 issues a connection request to the remote control device 106. Port number used at that time
Also notify Port2. The server apparatus 101 performs a connection request storing process (1) 202 for storing a connection request to the remote control apparatus 106 and the IP address IP2 and port number Port2 used by the requesting user apparatus 103.

S6: The server apparatus 101 transmits OK to notify the user apparatus 103 that the processing has been normally completed, and wait to maintain the connection.

S7: The remote control device 106 connects to the server device 101 again after one minute has elapsed since the previous IP address registration process. Then, the ID and password are transmitted for authentication.

S8: The remote control device 106 transmits the port number Port3 for port forwarding to the server device 101.
The server apparatus 101 and the IP number used for connection with the port number Port3 of the remote control apparatus 106 that has been successfully authenticated.
Registration processing 203 is performed in association with the address IP3. The IP1 and IP3 registered in S2 may be different if the IP address distributed by DHCP is changed, but Port1 and Port3 may be the same value or different values.

S9: The server apparatus 101 checks whether there is a connection request to the remote control apparatus 106 after the IP address registration process 203 is completed. Since there is a connection request from the user device 103 in S5, the server device 101 confirms that the user device 103 has the access right and notifies the remote control device 106 of the connection request from OK and IP2 and Port2. To do.
The remote control device 106 that has received it performs the following processing as router setting change processing (1) 204. ADS
The L modem 105 is accessed by HTTP, the port number for port forwarding is set to Port 3, and the function is enabled. In addition, in the IP filter function, TCP connection permission from the IP2 and Port2 is set.
Further, the remote control device 106 puts Port 3 into a connection waiting state in preparation for the connection from the user device 103.

S10: The remote control device 106 transmits OK of the router setting change completion notification to the server device 101 and disconnects.
S11: The server apparatus 101 notifies the user apparatus 103 that connection to IP3 and Port3 is possible.
S12: The user apparatus 103 transmits OK to the server apparatus 101 and disconnects.

S13: The user apparatus 103 connects to IP3 and Port3 using the connection source port number Port2, and starts communication.
However, if there is no connection from the user device 103 even after waiting for a predetermined time after waiting for connection of Port3 in S9, the remote control device 106 stops the connection waiting state.
Furthermore, the port forward function is turned off (off), and the connection from IP2 and Port2 is also prohibited in the IP filter function.

According to the above, by providing a service only to users registered using the server device, the user (user device) can communicate with the remote control device without being known by an unspecified number of third parties. It becomes possible to specify the IP address. In addition, since the remote control device is notified of the connection source IP address and port number of the user device from the server device, the IP filter function can be set so that only the user device can pass.

In addition, the port forward function is normally disabled, and only when the IP address is registered to the server device, the connection request from the user device is accepted and the port is changed to waiting for connection. The possibility of becoming can be reduced. Therefore, if the communication method and the communication system according to the present invention are used, it is possible to perform communication with higher safety than the conventional method.

Hereinafter, another embodiment of the present invention will be described with reference to FIGS. In this embodiment, user equipment,
Each connection, IP address, etc. of the server device, the ADSL modem, and the remote control device are the same as in the first embodiment.
As shown in
This embodiment is different from the first embodiment in that the remote control device 106 always accepts connection from the Internet. The merit is that the user does not wait for the IP address registration processing timing from the remote control device 106 to the server device 101. The connection request from the device 103 can be notified.

As a disadvantage, since the connection request from the Internet is always accepted, the possibility of being an attack target from the Internet is increased as compared with the first embodiment. However, in this embodiment, the port number for port forwarding is changed every time the IP address registration process is performed, so that the connection from the user device 103 to the remote control device 106 can be made smoother and can be the target of attacks from the Internet. Can lower the sex. FIG. 3 shows the procedure until the user apparatus 103 connects to the remote control apparatus 106 and starts communication, as in FIG.

S1: First, the remote control device 106 performs port forward setting 301. Here, ADSL modem 1
Access 05 with HTTP, set port number Port1 for port forwarding, and enable this function.
The remote control device 106 also sets the port number Port1 in a connection waiting state. At this time, the IP filter function is set to accept a connection from the IP address of the server device.
Next, connection is made to the server apparatus 101 in order to notify the server apparatus 101 of the IP address on the Internet side of the ADSL modem 105.
After connecting to the server apparatus 101, the ID and password of the remote control apparatus 106 registered in advance are transmitted for authentication. The IP address registration process is performed every minute, and the port number for port forwarding is changed every time the registration process is performed, and the server apparatus 101 is notified.

S2: Next, the remote control device 106 transmits the port number Port1 for performing port forwarding to the server device 101. The server apparatus 101 performs the registration process (2) 302 by associating the port number Port1 of the remote control apparatus 106 that has been successfully authenticated with the IP address used for connection.

S3: In order to notify the remote control device 106 that the processing has been completed normally, the server apparatus 101 transmits only OK and disconnects. Here, the remote control device 106 puts Port1 into a connection waiting state again.

S4: The user apparatus 103 connects to the server apparatus 101 in order to request connection to the remote control apparatus 106 of the user home 107. After connection, authentication is performed by transmitting the ID and password of the user device 103 registered in advance.

S5: The user device 103 issues a connection request to the remote control device 106. Port number used at that time
Also notify Port2. After confirming that the user device 103 has the right to access the remote control device 106, the server device 101 requests the connection to the remote control device 106 and the IP address used by the requesting user device.
Connection request storage processing (2) 303 for storing IP2 and port number Port2 is performed.

S6: The server device 101 is connected to the remote control device 106. In order to connect to the remote control device 106 via the ADSL modem 105, the port number of the connection destination designates Port1. After connection, the server device ID and password registered in advance are transmitted for authentication.

S7: After the authentication is completed, the server apparatus 101 transmits a connection request from the user apparatus 103 that has been successfully authenticated to the remote control apparatus 106. At that time, it is also notified that it is a connection request from IP2 and Port2. The remote control device 106 that has received it accesses the ADSL modem 105 by HTTP as the router setting change process (2) 304, and sets the TCP connection permission from the IP2 and Port2 in the IP filter function.

S8: The remote control device 106 transmits OK of the router setting change completion notification to the server device 101 and disconnects.
S9: The server apparatus 101 notifies the user apparatus 103 that connection to IP1 and Port1 is possible.
S10: The user apparatus 103 transmits OK to the server apparatus 101 and disconnects.

S11: The user apparatus 103 connects to IP1 and Port1 using the connection source port number Port2, and starts communication.
However, if there is no connection from the user device 103 after waiting for a predetermined time after permitting the connection from IP2 and Port2 in S7, the remote control device 106 permits the connection from IP2 and Port2. In order to stop the state to be performed, the IP filter function is set to disallow connection from IP2 and Port2.

According to the above, it is possible to specify an IP address for communicating with a remote control device without being known by an unspecified number of third parties by providing services only to users registered using the server device. It becomes possible.
In addition, since the remote control device is notified of the connection source IP address and port number of the user device from the server device, the IP filter function can be set so that only the user device can pass.

Furthermore, the user device is set only when a port forward function and an IP filter function are set so as to accept only a connection from a server device having a fixed global IP address, and a connection request is received from the user device via the server device. In order to perform processing such as setting the IP filter function again so as to cut off the connection from the user device due to a timeout or the like if the connection permission is additionally changed and if the connection is not made within a predetermined time, the Internet It is possible to reduce the time required for connection from the user device to the remote control device while reducing the possibility of being an attack target. Therefore, if the communication method and the communication system according to the present invention are used, communication can be performed more safely than the conventional method.

Connection diagram of the device of the present invention Communication sequence diagram according to an embodiment of the present invention (Example 1) Communication sequence diagram according to an embodiment of the present invention (Example 2)

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Server apparatus 102 Internet 103 User apparatus 104 Telephone station side ADSL modem 105 ADSL modem (router)
106 Remote control device 107 User house 201 IP1, Port1 registration process (1)
202 Connection request storage process (1)
203 IP3, Port3 registration processing 204 Router setting change processing (1)
301 Port forward setting process 302 IP1, Port1 registration process (2)
303 Connection request storage process (2)
304 Router setting change process (2)

Claims (5)

A user device located on the network, a remote control device remotely controlled by a direct or indirect request from the user device via the network, and logic between the user device and the remote control device In a network system in which addresses on the network of either one of the user device and the remote control device or both of them are dynamically changed.
The remote control device individually identifies the network address information of the remote control device itself and the remote control device individually to the server device when the network address changes periodically or when the remote control device changes. Only the connection from the device having the network address transmitted from the server device via the network is permitted, and the connection from the device having the other network address is rejected. The server device associates and manages the address of the remote control device transmitted from the remote control device, the device-specific information, and the user identification information having an access right to the remote control device. Has the function to
The user device communicates to the server device that it wishes to connect to the remote control device, and in response, the server device confirms that the user device has access rights to the remote control device. The network address of the remote control device is transmitted to the user device, and the network address of the user device is transmitted to the remote control device. In response, the remote control device transmits the network address of the user device. A communication method and a communication system, characterized in that they set themselves so as to permit connection from a network address, thereby connecting from the user device to the remote control device and starting communication. The communication system according to claim 1, wherein
A communication method and a communication system, characterized in that the remote control device does not permit connection from the network address of the user device if there is no connection from the network address of the user device for a predetermined time. The communication system according to claim 1, wherein communication is performed using an Internet protocol.
The remote control device periodically or when the IP address of the remote control device changes changes its own IP address information, port number information, and the remote control device to the server device. A function of transmitting device-specific information for individually identifying a device, a connection from an IP address and a port number transmitted from the server device via the network, and an IP address other than this A function of rejecting connection from a port number;
The server device manages the IP address, port number, device-specific information, and user identification information having the access right to the remote control device associated with each other and transmitted from the remote control device Comprising
The user device communicates to the server device that it wishes to connect to the remote control device, and in response, the server device confirms that the user device has access rights to the remote control device. Then, the IP address and port number of the remote control device are transmitted to the user device, and the IP address and port number of the user device are transmitted to the remote control device, and the remote control is performed accordingly. The apparatus sets itself so as to permit connection from the IP address and port number of the user apparatus, whereby the connection from the user apparatus to the remote control apparatus is performed. . The communication system according to claim 3, wherein communication is performed using an Internet protocol.
The remote control device may use IP address information and port number information that can be used in the remote control device itself or in the environment in which the remote control device itself is used, in response to the server action, periodically or when its control state changes. The server device transmits only device-specific information for individually identifying the remote control device, and only permits connection from the server device via the IP address and port number transmitted via the network. And a function of rejecting connections from other IP addresses and port numbers,
The server device has a remote control device transmitted from the remote control device or an IP address, a port number, device-specific information, and an access right to the remote control device that can be used in the environment in which the server device is placed. A function for managing user identification information in association with it,
The user device communicates to the server device that it wishes to connect to the remote control device, and in response, the server device confirms that the user device has access rights to the remote control device. And the IP address and port number that can be used in the remote control device itself or in the environment in which it is placed, to the user device,
Communicates the IP address and port number of the user device to the remote control device, and in response, the remote control device itself or to allow the connection from the IP address and port number of the user device A communication method and a communication system, characterized in that a set environment is set and thereby the connection from the user device to the remote control device is made. The communication system according to claim 4, wherein communication is performed using an Internet protocol.
The remote control device sets the remote control device itself or the environment in which the remote control device is placed so as to always accept only the connection from the server device.

Images