JP2005122651A - Authentication method at service switching, and user terminal switching method using the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication method at service switching and a user terminal switching method using the same that execute seamless switching of user terminals and also user authentication while continuing a session when a user wants to use a plurality of communication terminals according to use environments on an IP network, and can cope with occurrence of terminal switching even a plurality of times in the process of the session. <P>SOLUTION: When a single user maintains a communication session across a plurality of communication terminals, a transfer request from a source terminal triggers immediate switching from the source terminal to a target terminal. A processed (authentication) result of the source terminal is passed to the target terminal, and a reprocessed result and a processed result of the source terminal held in a server can be checked to confirm that the source terminal and the target terminal are the same user. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication method for switching services between a plurality of user terminals in a ubiquitous environment in which a user owns a plurality of communication terminals on an IP network and uses the communication terminals according to the communication environment, and a user terminal switching method using the same. .

  If you want to change the user terminal of the caller or the callee while continuing the communication with the movement of the caller or the callee at the stage where the caller of the Internet telephone and the callee are communicating, A method has been proposed in which the addresses of a plurality of user terminals are managed by a gateway or server, and a session is switched to the address of a switching destination terminal (see, for example, Patent Document 1).

  In such a situation where a plurality of communication terminals can be used, the communication service of the currently used terminal is transferred to another terminal (or a portable terminal such as a PDA or a terminal connected to a high-resolution display). By switching to, there is an increasing need to use the service to a higher degree. In the IP phone and TV phone protocols, there are IETF standards as shown in Non-Patent Document 1, but there is a demand for a method of switching a communication session from a currently communicating terminal to another terminal.

JP 2003-70043 A "Communication System, Communication Connectivity Protection Method, and Communication Continuity Protection Method" IETF RFC 3515: (The Session Initiation Protocol (SIP) Refer Method)) (http://www.itef.org/rfc/rfc3515.txt)

  Since the conventional switching server that switches to the transfer destination transfers only to the transfer destination designated from the transfer source terminal and switches the communication session, whether or not the transfer destination is the same user's terminal is determined beforehand by the switching server. The transfer destination list is managed, and the transfer destination address designated by the transfer source terminal must be determined as to whether it is a management target address.

  Also, when performing user authentication, there are many cases where the login ID or password associated with each terminal is used, and linking the terminals used by the same user in the authentication procedure. I could not.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to solve the above-described problems in the prior art, and a user can connect a plurality of communication terminals on an IP network according to usage environments. If you want to use it, you can seamlessly switch user terminals while continuing the session, and then perform user authentication. Also, service switching that can handle multiple terminal switching while the session continues It is to provide an authentication method and a user terminal switching method using the same.

  In order to achieve the above object, in the present invention, basically, a plurality of user terminals, a communication destination terminal, and a service switching server are connected by an IP network, and one user owns the plurality of user terminals. While a user session (movement source terminal) and the communication destination terminal establish a communication session via the service switching server, different user terminals (movement destination terminals) continue with the service as the user moves. ), When the session is switched, a calculation result generated at the time of session establishment using a common key shared by the service switching server and the user terminal (movement source terminal) is used as the different user terminal (movement destination terminal). ), And the service switching server and the different user terminal (destination terminal) authenticate using the result recalculated with the common key. It is characterized by that.

More specifically, in the service switching authentication method according to the present invention, a plurality of user terminals, a communication destination terminal, and a service switching server are connected via an IP network, and one user owns the plurality of user terminals. While a user session (movement source terminal) and the communication destination terminal establish a communication session via the service switching server, a different user terminal (movement destination terminal) continues with the service as the user moves. ), When the session is switched, the calculation result generated when the session is established using the common key shared by the service switching server and the user terminal (source terminal) is used as the different user terminal (target terminal). ) And using the result recalculated with the common key, the service switching server and the different user terminal (destination terminal) Has unit steps to authenticate,
When the session is switched to a different user terminal (destination terminal) while continuing the service, the unit step is repeated as necessary.

  Furthermore, the authentication method in the service switching according to the present invention includes a plurality of user terminals, a communication destination terminal, and a service switching server connected by an IP network, and one user owns the plurality of user terminals, and an arbitrary user While the communication session is established between the terminal (source terminal) and the communication destination terminal via the service switching server, the session is transferred to a different user terminal (movement destination terminal) while continuing the service as the user moves. When performing switching, the source terminal first calculates a calculation result α obtained by calculating temporary authentication information with a common key when establishing a session with the communication destination terminal via the service switching server. Returning to the switching server, and the service switching server detects the calculation result α using the common key. If it is valid, the operation result α is stored, and after the session is established, the user terminal or the destination terminal automatically negotiates the source terminal with the destination terminal from the destination terminal. The step of confirming whether or not the service can be switched, and if the switching is possible, the source terminal notifies the destination terminal of information obtained by arbitrarily encrypting the calculation result α held by the terminal The destination terminal decrypts the information to restore the calculation result α, and further generates a calculation result α ′ obtained by recalculating the calculation result α with the common key; and the source terminal Generates α ′ recalculated with the common key in the calculation result α and switches the session including the recalculation result α ′ in order to switch the session to the destination terminal. Request to the service switching server, the service switching server recognizes session switching (handover), makes an incoming call request to the destination terminal, and the destination terminal stores Notifying the service switching server of a response including the recalculation result α ′, and notifying the service switching server of the response including the stored recalculation result α ′, The service switching server collates the recalculation result α ′ notified from the movement source terminal with the recalculation result α ′ notified from the movement destination terminal. It is determined that the user terminal is the same user, the session is switched, and the session with the source terminal is disconnected.

Furthermore, the authentication method in the service switching according to the present invention is the above-described user terminal switching method, when the user terminal is switched again after the user terminal switching,
After user terminal switching (establishing a session with the destination terminal), a service is provided from the destination terminal to the next destination terminal at the user's will or automatically through negotiation between the destination terminal and the next destination terminal. If the switching is possible, the destination terminal notifies the next destination terminal of information obtained by performing arbitrary encryption on the operation result α ′ held by the terminal. And the next destination terminal decrypts the information to restore the calculation result α ′, and further generates a calculation result α ″ by recalculating the calculation result α ′ with the common key; In order to switch the session to the destination terminal, the source terminal generates α ″ recalculated with the common key in the calculation result α ′, and sends a session switching request including the recalculation result α ″ to the service Switching server The service switching server recognizes session switching (handover) and makes an incoming request to the next destination terminal, and the next destination terminal stores the recalculation A step of notifying the service switching server of a response including the result α ″, the service switching server including the recalculation result α ″ notified from the source terminal and the recalculation result α notified from the destination terminal ", If the value is the same, the destination terminal determines that it is the user terminal of the same user, performs session switching, and disconnects the session with the source terminal.

  On the other hand, the present invention can also be embodied as a service switching control method using the confirmation method as described above.

  It is also possible to commercialize a control program for causing a computer to execute the service switching control method described above, or a recording medium readable by a computer on which the program is recorded. .

  According to the present invention, when a user wants to use a plurality of communication terminals according to the usage environment on an IP network, the user terminal is switched seamlessly while continuing the session. It is possible to perform secure user authentication using temporary authentication information between user terminals. In addition, even when terminal switching occurs a plurality of times during the continuation of the session, secure user authentication can be performed while confirming the continuation of the session by reusing the latest calculation result.

  Hereinafter, the present invention will be described in detail based on preferred embodiments shown in the accompanying drawings. For the sake of specific explanation, a case of SIP communication service switching (switching at the SIP server) using VoIP will be described as an example of a service provided on the IP network.

  FIG. 1 is a system configuration diagram of the present invention. 1 is a user who handles a plurality of terminals, 2 is a source terminal (user terminal A) that user 1 uses first, 3 is a destination terminal (user terminal B) for user 1 to continue using the service, Reference numeral 4 denotes a communication destination terminal that provides a service on the IP network or the user 1 wants to communicate with, and 5 denotes a service switching server that switches the service of the user terminal.

  SIP-URI: x1 and IP address: L1 are assigned to the source terminal 2, and SIP-URI: x2 and IP address: L2 are assigned to the destination terminal 3. The IP address may be a condition that an arbitrary IP address is assigned every time the IP address is connected to the IP network. Location registration (REGISTER) from each terminal may be performed in accordance with the SIP procedure for each SIP-URI.

  For example, the use location of the source terminal 2 is a PC that uses a wired LAN connection in a company. The destination terminal 3 is a PDA used in a company wireless LAN area. The type of user terminal and the type of IP network to be connected may be arbitrary. Note that this description does not cover access network authentication for logging in to the IP network.

As shown in FIG. 1, in the basic switching procedure of the user terminal switching method according to the first and second aspects of the present invention,
(1) While the movement source terminal 2 and the communication destination terminal 4 are establishing a communication session via the service switching server 5,
(2) Accompanying the movement of the user (3) Check whether the service can be switched from the source terminal 2 to the destination terminal 3, and if the switch is possible,
(4) Notifying the terminal switching request from the source terminal 2 to the destination terminal 3;
(5) The destination terminal 2 makes a user terminal switching request to the service switching server 5,

(6) The service switching server 5 makes an incoming call request to the destination terminal 3,
(7) The destination terminal 3 notifies the response,
(8) The service switching server 5 switches the session from the source terminal 2 to the destination terminal 3,
(9) Next, the session 3 between the service switching server 5 and the source terminal 2 is disconnected.

[Example 1]
FIG. 2 is a basic operation procedure of an embodiment of the user terminal switching method and user authentication according to the first aspect of the present invention, and FIGS. 3 and 4 are sequence diagrams thereof. In this embodiment, a plurality of user terminals perform challenge / response type user authentication using an arbitrary common key with the service switching server 5 at the time of session establishment.

  The user 1 first sets the incoming address (SIP-URI: y) of the destination terminal 4 from the source terminal 2 and establishes a session with the destination terminal 4 via the service switching server 5. , Shift during communication. At this time, in order to perform user authentication, the service switching server 5 generates an arbitrary random number k and notifies the source terminal 2 of the random number, and the source terminal 2 calculates the random number k using the held common key. A result f (k) is generated and returned to the service switching server 5, and the service switching server 5 performs authentication using f (k) and stores the result (step 100).

  Similarly, the calculation result f (k) is stored in the source terminal 2 (step 110). In addition, in this sequence diagram, it was the transmission from the movement origin terminal 2 to the communication destination terminal 4, However, The transmission from the communication destination terminal 4 to the movement origin terminal 2 may be sufficient. Up to this point, the procedure is the same as the session establishment procedure in the communication service using normal SIP.

  As the user 1 moves, it is necessary to search for whether the service can be switched from the source terminal 2 to another user terminal while continuing the service. The search of the user terminal of the terminal at that time may be any communication means capable of encrypting the communication message, and for example, near field radio such as infrared communication or Bluetooth may be considered. In the present embodiment, it is assumed that the destination terminal 3 of the user 1 is found as a destination terminal capable of switching services as a result of the search. The source terminal 2 encrypts the managed calculation result f (k) and notifies the destination switching request to the destination terminal 3 (step 120).

  The destination terminal 3 that has received the incoming call decrypts the encrypted information and restores and stores the calculation result f (k). The source terminal 2 that has been confirmed that the service can be switched sets the SIP-URI: x2 of the destination terminal 3 as the handover destination to the service switching server 5 and stores the calculation result f (k ), A handover request (REFER) including F (f (k)) recalculated with the common key is made (step 130).

  The service switching server 5 makes an incoming call to the destination terminal 3, and the destination terminal 3 determines that it is a handover request from the service switching server 5, and recalculates the stored computation result f (k) with the common key. (F (k)) is generated, added to the response signal, and transmitted.

  As shown in FIG. 4, the service switching server 5 receives the recalculation result F (f (k)) received at the time of the handover request from the source terminal 2 and the recalculation result F (f (k)) received in response to the destination terminal 3. f (k)) are compared, and if they are the same value, it is recognized that the handover is performed between different terminals from the same user, and the call session with the communication destination terminal 4 is switched to the movement destination terminal 3 (step 140). .

  After switching the call session with the communication destination terminal 4 to the movement destination terminal 3, the session between the service switching server 5 and the movement source terminal 2 is disconnected (step 150).

  As described above, when the user terminal switching request is made, the temporary calculation result held in the source terminal 2 is taken over to the destination terminal 3, the step 120, the step 130 of making a handover request from the source terminal 2, and the destination The terminal that confirms that the user terminal is switched from the same user by performing step 140 of performing recalculation on the temporary calculation result at the source terminal 3 at the incoming call to the terminal 3, and uses the terminal while continuing the service Can be switched. Further, by performing authentication with the service switching server 5, secure communication can be performed.

[Example 2]
FIG. 5 is a sequence diagram in the case of switching the terminal to another user terminal after switching the terminal to the destination terminal in the user terminal switching method according to the first aspect of the present invention. In FIG. 5, the terminal is switched again from the destination terminal 3 to the destination terminal 2.

The destination terminal 3 and the communication destination terminal 4 are communicating via the service switching server 5.
As a result of the first gist of the present invention, the latest calculation result F (f (k)) is stored in the destination terminal 3 and the service switching server 5.
The destination terminal 3 and the destination terminal 2 negotiate in the same manner as in step 120. The destination terminal 3 encrypts F (f (k)), which is the latest calculation result, and sends a terminal switching request to the source terminal. 2 is notified (step 121).

The source terminal 2 that has received the incoming call decrypts the encrypted information, restores the operation result F (f (k)), and stores it.
The destination terminal 3 confirmed to be able to switch the service sets the SIP-URI: x1 of the source terminal 2 as the handover destination for the service switching server 5 in the same manner as in step 130 and saves it. The handover request (REFER) including the recalculated F (F (f (k))) with the common key in the calculated calculation result F (f (k)) is performed (step 131).

  The service switching server 5 makes an incoming call to the source terminal 2, and the source terminal 2 determines that it is a handover request from the service switching server 5, and re-uses the stored calculation result F (f (k)) with the common key. Calculated F (F (f (k))) is generated, added to the response signal, and transmitted.

  The service switching server 5 receives the recalculation result F (F (f (k))) received at the time of the handover request from the movement destination terminal 3 and the recalculation result F (F (f (f (f) (f (f (k)))) received in response to the movement source terminal 2. k))) is collated, and if it is the same value, it is recognized that the handover is between different terminals from the same user, and the call session with the communication destination terminal 4 is switched to the source terminal 2 (step 141).

  After switching the call session with the communication destination terminal 4 to the movement source terminal 2, the session between the service switching server 5 and the movement destination terminal 3 is disconnected (step 151).

  As described above, when switching to another user terminal, or when switching back to the original user terminal, the temporary calculation result held in the source terminal 2 at the time of user terminal switching request is Step 121 to take over to the user terminal, Step 131 to make a handover request to the next user terminal, and Step 141 to recalculate the temporary calculation result in the communicating user terminal upon arrival at the next user terminal Thus, it is possible to confirm that the user terminal is switched from the same user, and to switch to the next user terminal while continuing the service. After that, when it is necessary to switch a plurality of user terminals in the same call, the user terminals can be switched / switched back in the same procedure as described above.

  Each of the above-described embodiments is merely an example of the present invention, and the present invention should not be limited to these, and appropriate modifications and improvements can be made without departing from the spirit of the present invention. It goes without saying that you can go.

FIG. 5 is a system configuration diagram and basic operation of user terminal switching in the first and second embodiments of the present invention. 1 is a system configuration diagram, user terminal switching, and basic operation of user authentication in the first and most embodiments of the present invention. It is the sequence diagram in the 1st Embodiment of this invention (the 1). It is the sequence diagram in the 1st Embodiment of this invention (the 2). It is a sequence example in the 2nd Embodiment of this invention.

Explanation of symbols

1 user 2 source terminal (user terminal A)
3 Destination terminal (User terminal B)
4 Call destination terminal 5 Service switching server

Claims (7)

A plurality of user terminals, communication destination terminals, and a service switching server are connected by an IP network,
One user owns a plurality of the user terminals, and any user terminal (source terminal) and the destination terminal can move the user while establishing a communication session via the service switching server. Accordingly, when switching sessions to different user terminals (destination terminals) while continuing the service,
The calculation result generated at the time of session establishment using a common key shared by the service switching server and the user terminal (source terminal) is taken over to the different user terminal (destination terminal) and recalculated with the common key. An authentication method in service switching, wherein the service switching server and the different user terminal (movement destination terminal) authenticate using the result obtained. A plurality of user terminals, communication destination terminals, and a service switching server are connected by an IP network,
One user owns a plurality of the user terminals, and any user terminal (source terminal) and the destination terminal can move the user while establishing a communication session via the service switching server. Accordingly, when switching sessions to different user terminals (destination terminals) while continuing the service,
The calculation result generated at the time of session establishment using a common key shared by the service switching server and the user terminal (source terminal) is taken over to the different user terminal (destination terminal) and recalculated with the common key. A unit step in which the service switching server and the different user terminal (destination terminal) authenticate using the result obtained,
An authentication method for service switching, characterized in that the unit step is repeated as necessary when a session is switched to a different user terminal (destination terminal) while continuing the service. A plurality of user terminals, communication destination terminals, and a service switching server are connected by an IP network,
One user owns a plurality of the user terminals, and any user terminal (source terminal) and the destination terminal can move the user while establishing a communication session via the service switching server. As a result, when switching sessions to different user terminals (destination terminals) while continuing the service,
When the movement source terminal first establishes a session with the communication destination terminal via the service switching server, the movement source terminal returns an operation result α obtained by calculating temporary authentication information with a common key to the service switching server. Steps,
The service switching server verifies the calculation result α using the common key, and stores the calculation result α if valid;
After session establishment, confirming whether the service can be switched from the source terminal to the destination terminal by negotiation between the source terminal and the destination terminal automatically or at the user's will;
When switching is possible, the source terminal notifies the destination terminal of information obtained by performing arbitrary encryption on the calculation result α held by the terminal;
The destination terminal decrypts the information to restore the calculation result α, and further generates a calculation result α ′ by recalculating the calculation result α with the common key;
In order to switch the session to the destination terminal, the source terminal generates α ′ recalculated with the common key in the calculation result α, and sends a session switching request including the recalculation result α ′ to the service. Notifying the switching server;
The service switching server recognizes session switching (handover) and makes an incoming request to the destination terminal;
The destination terminal notifies the service switching server of a response including the stored recalculation result α ′;
The service switching server compares the recalculation result α ′ notified from the source terminal with the recalculation result α ′ notified from the destination terminal. An authentication method in service switching, characterized in that it is determined as a user terminal of the same user, session switching is performed, and the session with the source terminal is disconnected. In the user terminal switching method according to claim 3, after switching the user terminal, when switching the user terminal again,
After user terminal switching (establishing a session with the destination terminal), a service is provided from the destination terminal to the next destination terminal at the user's will or automatically through negotiation between the destination terminal and the next destination terminal. Step to check if you can switch,
When switching is possible, the destination terminal notifies the next destination terminal of information obtained by performing arbitrary encryption on the calculation result α ′ held by the terminal;
The next destination terminal decrypts the information to restore the calculation result α ′, and further generates a calculation result α ″ obtained by recalculating the calculation result α ′ with the common key;
In order to switch the session to the destination terminal, the source terminal generates α ″ recalculated with the common key in the calculation result α ′, and sends a session switching request including the recalculation result α ″ to the service Notifying the switching server;
The service switching server recognizes session switching (handover) and makes an incoming request to the next destination terminal;
The next destination terminal notifies the service switching server of a response including the stored recalculation result α ″;
The service switching server collates the recalculation result α ″ notified from the movement source terminal with the recalculation result α ″ notified from the movement destination terminal. An authentication method in service switching, characterized in that it is determined as a user terminal of the same user, session switching is performed, and the session with the source terminal is disconnected.   5. A service switching control method using the authentication method in service switching according to any one of claims 1 to 4.   A control program for causing a computer to execute the service switching control method according to claim 5.   A computer-readable recording medium on which the program according to claim 6 is recorded.

Images