JP2005122662A - Authentication method for session transfer, session transfer control method using the same, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem wherein, for a movement of a communication session to another terminal, authentication has been executed only between the target terminal and a session switching apparatus (server or terminal), so that, as long as the target terminal is authentic, when a malicious third party terminal sends a transfer request, the communication session can be transferred according to the third party's transfer request against the user's intention. <P>SOLUTION: Public keys are used. Session information issued by a session control apparatus is encrypted with the public keys, and synchronized between a source terminal, a target terminal and the session control apparatus. The session information can be used in authenticating the target terminal in the session control apparatus to thus block a transfer request from a third party and establish a communication session at the target terminal. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication method in session transfer and a session transfer control method using the same, which enables switching between terminals to be used while continuing a communication service when using a plurality of terminals connected to an IP network. It is.

  In recent years, not only computers but also PDAs and home appliances can be connected to the network due to the widespread use of broadband and flat-rate Internet communications using ADSL and optical fiber, and the diversification of wireless access such as wireless LAN and IMT-2000. became. In addition, not only one communication terminal is used by an individual, but a plurality of communication terminals such as a desktop PC in an office and a notebook PC and a mobile phone are used properly according to the situation at the office.

  In a situation where a plurality of communication terminals can be used in this way, the communication service of the currently used terminal is transferred to another terminal (for example, a portable terminal such as a PDA or a terminal connected to a high-resolution display) ), There is a need to use the service at a higher level. In the IP telephone and TV telephone protocols, there is an IETF standard as Non-Patent Document 1, and a method for transferring a communication session from a currently communicating terminal to another terminal is defined.

IETF RFC 3515: (The Session Initiation Protocol (SIP)) Refer Method (http://www.ietf.org/rfc/rfc3515.txt)

  However, in the prior art, when a communication session is moved to another terminal, only authentication between the destination terminal and a device (server or terminal) that switches the session is performed, and the transfer request is malicious When transmitted from a three-party terminal, if the destination terminal is a valid terminal, there is a possibility that the communication session is transferred in accordance with a third party transfer request against the user's intention.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to solve the above-described problems in the prior art and to switch a terminal using a communication service to another terminal. It is to provide a technology capable of storing communication services and blocking requests for malicious transfer requests from third parties.

  More specifically, an object of the present invention is to provide an authentication method in session transfer that enables switching of a terminal to be used while continuing a communication service when using a plurality of terminals connected to an IP network, and this It is to provide a session transfer control method using.

In order to achieve the above object, the present invention has the following configurations (means).
That is, in the authentication method in session transfer according to the present invention, basically, a plurality of user communication terminals and a session control device are connected to an IP network, and any user communication terminal can be another user communication terminal and the session control device. And the session control apparatus holds the public keys of the plurality of user terminals, and any one of the user communication terminals (movement source terminal 0) and other user communication destinations. Session information shared by the session control device and the source terminal 0 when a terminal transfers a communication session established via the session control device to another user communication terminal (destination terminal 1) The session control device authenticates the destination terminal 1 using information encrypted with the public key of the source terminal 0.

  More specifically, in an authentication method in session transfer according to the present invention, a plurality of user communication terminals, a communication destination terminal, and a session control device are connected to an IP network, and any user communication terminal is connected to another user communication terminal and The session control apparatus holds a public key, and the session control apparatus holds a plurality of user terminal public keys, and any one of the user communication terminals (movement source terminal 0) and the When the communication destination terminal transfers a session established via the communication session to another user communication terminal, the movement destination terminal 0 moves the session information shared by the session control device and the movement source terminal 0. The encrypted with the public key of the destination terminal 1 is transmitted to the destination terminal 1, and the destination terminal 1 decrypts the session information from the received one, The session control apparatus receives a session transfer request from the source terminal 0 or the destination terminal 1, and encrypts the session information encrypted with the public key of the source terminal 0 using the public key of the session control apparatus The received information is received from the destination terminal 1, and the decrypted information received from the destination terminal 1 and the session information held by the session control device are used as the public key of the source terminal 0. And the session information is encrypted with the public key of the source terminal 0, and the session information is encrypted with the public key of the source terminal 0. A unit step to be held in the destination terminal 1 and the session control device as secure session information, and when transferring the established session to another user communication terminal, And repeating if necessary the serial unit step.

  Furthermore, in the authentication method in session transfer according to the present invention, a plurality of user communication terminals, a communication destination terminal, and a session control device are connected to an IP network, and any user communication terminal can be another user communication terminal and the session control device. And the session control device holds the public keys of the plurality of user terminals, and any one of the user communication terminals (source terminal 0) and the communication destination terminal When transferring the session established via the communication session to another user communication terminal, the session control device establishes the communication session between the source terminal 0 and the communication destination terminal. The apparatus generates session information Ss, and this session information Ss is encrypted with the public key Pt0 of the source terminal 0 Pt0 (Ss ) To the source terminal 0, and the source terminal 0 that has received the Pt0 (Ss) decrypts the session information Ss with the secret key of the public key Pt0, and sends the session information Ss to the session Transmitting Ps (Ps (Ss)) encrypted with the public key Ps of the control device to the session control device, holding Ps (Ss) as session information St0, and receiving the Ps (Ps (Ss)) The session control apparatus collates the information obtained by decrypting the Ps (Ps (Ss)) with the decryption key of the public key Ps and the generated session information Ss. If they match, Ps (Ss) is determined. Holding the session information Ss and continuing the session establishment process; and after establishing a communication session between the communication destination terminal and the source terminal 0, the source terminal 0 Transmitting Pt1 (St0) obtained by encrypting the action information St0 with the public key Pt1 of the destination terminal 1 to the destination terminal 1, and the destination terminal 1 using the private key of the public key Pt1 to the Pt1 (St0) And obtaining the information St0, requesting the session control device to move the in-communication session to the destination terminal 1, and establishing a communication session from the session control device. The destination terminal 1 that has received the request sends the session information St0 Ps (Pt0 (St0)) obtained by encrypting the session information St0 with the public key Ps of the session control apparatus and the public key Pt0 of the source terminal 0. And storing Pt0 (St0) as session information St1, and the session control receiving the Ps (Pt0 (St0)). The device decrypts Pt0 (St0) decrypted with the private key of the public key Ps, the session information Ss received and decrypted from the source terminal 0, and Pt0 encrypted with the public key Pt0 of the source terminal 0 If (Ss) matches, the step of holding the Pt0 (Ss) as the session information Ss and continuing the communication session establishment process with the destination terminal 1 and after the establishment of the communication session with the destination terminal 1 The session control device includes a step of disconnecting or releasing a communication session with the source terminal 0.

  Still further, in the session transfer authentication method according to the present invention, when the communication session is further transferred from the destination terminal 1 to another user communication terminal (destination terminal 2), the source terminal 0 to the destination After the communication session transfer to the terminal 1 is established, Pt2 (St1) obtained by encrypting the session information St1 held by the destination terminal 1 with the public key Pt2 of the destination terminal 2 is given to the destination terminal 2. Transmitting, decrypting the Pt2 (St1) with the private key of the public key Pt2 and acquiring the St1, and the destination terminal 2 of the session in which the destination terminal 1 is in communication Requesting the session control apparatus to move to the session control apparatus, and the session control apparatus receiving the request requests the destination terminal 2 to establish a communication session. The destination terminal 2 having received the communication session establishment request from the session control device encrypts the session information St1 with the public key Ps of the session control device and the public key Pt1 of the destination terminal 1. Transmitting Ps (Pt1 (St1)) to the session control apparatus and holding Pt1 (St1) as session information St2, and the session control apparatus receiving the Ps (Pt1 (St1)) Pt1 (St1) decrypted with the private key of Ps and the session information Ss received and decrypted and held from the destination terminal 1 match Pt1 (Ss) encrypted with the public key Pt1 of the destination terminal Then, holding the Pt1 (Ss) as session information Ss, continuing the communication session establishment process with the destination terminal 2, The session control device includes a step of disconnecting or releasing the communication session with the destination terminal 1 after the communication session with the destination terminal 2 is established.

  In the authentication method in session transfer according to the present invention, a transfer request to the destination terminal 1 for a communication session between the destination terminal and the source terminal 0 is sent from the destination terminal 1 to the St0 and the session. A step of transmitting to the session control apparatus together with the public key Ps of the control apparatus and Ps (Pt0 (St0)) encrypted with the public key Pt0 of the source terminal 0 and holding Pt0 (St0) as session information St1 It is also preferable.

  In the authentication method in session transfer according to the present invention, a transfer request to the destination terminal 2 for a communication session between the destination terminal and the source terminal 1 is sent from the destination terminal 2 to the St1. A step of transmitting to the session control device together with the public key Ps of the session control device and Ps (Pt1 (St1)) encrypted with the public key Pt1 of the destination terminal 1, and holding Pt1 (St1) as session information St2 It is also preferable that

  In the authentication method for session transfer according to the present invention, the public key other than the own terminal / device is not stored in advance, and the public key of the own terminal / device is transmitted simultaneously when accessing the communication terminal or the session control device. You may comprise. Further, the public key Ps of the source terminal 0 may be a user's public key.

On the other hand, the present invention can also be embodied as a session transfer control method using each authentication method as described above.
It is also possible to commercialize a control program for causing a computer to execute the session transfer control method described above, or a recording medium readable by a computer on which the program is recorded.

  In addition to the above, the present invention also provides a session transfer control system characterized in that the destination terminal 1 or the destination terminal 2 used in the authentication method in the session transfer is the session control device, or The session control device used in the authentication method in session transfer of the present invention can be embodied as a session transfer control system characterized in that the communication destination terminal.

  According to the present invention, a communication session can be switched to another terminal without interruption, and even if a transfer request is transmitted from a malicious third party terminal, the source terminal and the session control device When the destination terminal does not hold the shared temporary information, a practically effective effect that it is possible to stop the session transfer request is obtained.

  Hereinafter, the present invention will be described in detail based on preferred embodiments shown in the accompanying drawings.

[Description of configuration]
FIG. 1 is a diagram showing a system configuration of the present invention. As shown in the figure, this system controls communication between the communication destination terminal 3 and terminals 0, 1 and 2 communicating with the terminal 3, and communication between these communication destination terminals and the terminal 0, terminal 1 and terminal 2. The session control device 4 is configured. Terminal 0, terminal 1, terminal 2, plan end 3 and session control device 4 are connected to the IP network.

  The terminal 0 holds the public keys Pt 1 and Pt 2 of the terminal 1 and the terminal 2 and the public key Ps of the session control device 4. The terminal 1 holds the public keys Pt0 and Pt2 of the terminal 0 and the terminal 2, and the public key Ps of the session control device 4. The terminal 2 holds the public keys Pt0 and Pt1 of the terminal 0 and the terminal 1, and the public key Ps of the session control device 4. The session control device 4 holds the public keys Pt0, Pt1, and Pt2 of the terminal 0, the terminal 1, and the terminal 2, respectively. Note that the terminal 0, the terminal 1, the terminal 2, and the session control device 4 each hold a secret key corresponding to its own public key.

[Description of operation]
First, the operation relating to the specific invention shown in claim 3 will be described.
As shown in FIG. 2, the communication terminal 0 requests the session control device 4 to connect to the communication destination terminal 3 (S101).
After receiving the connection request, the session control device 4 generates session information Ss and transmits Pt0 (Ss) encrypted with the public key Pt0 of the terminal 0 to the terminal 0 (S102).

  The terminal 0 that has received Pt0 (Ss) acquires the information Ss with the private key of the public key Pt0, and uses the session control device 4 to store Ps (Ps (Ss)) encrypted with the public key Ps of the session control device 4. And stores Ps (Ss) as session information St0 (S103).

The session control device 4 that has received Ps (Ps (Ss)) decrypts Ps (Ps (Ss)) with the private key of the public key Ps, compares it with the stored Ss, and if they match, Ps (Ss) is stored as information Ss, and the connection process to the communication terminal 3 is continued (S104).
After the communication session between the communication terminal 3 and the communication terminal 0 is established, the communication terminal 0 transmits Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the terminal 1 to the terminal 1 that moves the communication session ( S105). Here, step S105 may be transmitted from the terminal 1 to the terminal as a response to the 0 session information request.
The communication terminal 1 decrypts the received Pt1 (St0) with the private key of the public key Pt1, and acquires information St0 (S106).

After transmitting Pt1 (St0) to the communication terminal 1, the communication terminal 0 transmits a transfer request for the communication session to the terminal 1 to the session control device 4 (S107).
The session control device 4 transmits a communication session establishment request to the terminal 1 in accordance with the transfer request received from the terminal 0 (S108).
The terminal 1 that has received the establishment request from the session control terminal 4 transmits the information St0 acquired in step S106 with the public key Ps and Ps0 (Pt0 (St0)) to the session control apparatus 4, and Pt0 (St0 ) As session information St1 (S109).

The session control device 4 receives the Ps0 (St0) obtained by decrypting the received Ps (Pt0 (St0)) with the private key of the public key Ps, and stores the session information Ss stored in the terminal 0 that is the transmission request transmission source. Pt0 (Ss) encrypted with the public key Pt0 is collated, and if they match, Pt0 (Ss) is stored as session information Ss, and the session transfer process to the terminal 1 is continued (S110).
After the session with the terminal 1 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 0 (S111).

  In the example shown in FIG. 2, a case where a connection request from the communication terminal 0 to the communication terminal 3 is given as an example, but this is a connection request from the communication terminal 3 to the communication terminal 0. It is the same.

Next, the operation of the invention of claim 4 will be described.
As shown in FIG. 3, after Step S111 of FIG. 2, Pt2 (St1 encrypted with the public key Prt2 of the terminal 2 is stored in the information St1 stored from the communication terminal 1 that has established a communication session with the communication terminal 3. ) Is transmitted to the communication terminal 2 that is the destination of the communication session (S112). Here, step S112 may be transmitted as a response to the transfer request from the terminal 2.
The terminal 2 decrypts the received Pt2 (St1) with the private key of the public key Pt2, and acquires information St1 (S113).

After transmitting Pt2 (St1) to the communication terminal 2, the communication terminal 1 transmits a request to transfer the communication session to the terminal 1 to the session control device 4 (S114).
The session control device 4 transmits a communication session establishment request to the terminal 2 in accordance with the transfer request received from the terminal 1 (S115).
The terminal 2 that has received the establishment request from the session control terminal 4 transmits the public key PS and PS (Pt1 (St1)) encrypted with the information St1 acquired in step S113 to the session control apparatus 4, and Pt1 (St1 ) As session information St2 (S116).

The session control device 4 transmits the received Ps (Pt1 (St1)) with the private key of the public key Ps and the stored session information Ss of the terminal 1 that is the source of the communication session. Pt1 (Ss) encrypted with the public key Pt1 is collated, and if they match, Pt1 (Ss) is stored as session information Ss, and session transfer processing to the terminal 2 is stored (S117).
After the session with the terminal 2 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 1 (S118).

Next, the operation of the invention of claim 5 will be described.
As shown in FIG. 4, the communication terminal 0 requests the session control device 4 to connect to the communication destination terminal 3 (S201).
After receiving the connection request, the session control device 4 generates session information Ss and transmits Pt0 (Ss) encrypted with the public key Pt0 of the terminal 0 to the terminal 0 (S202).
The terminal 0 that has received Pt0 (Ss) acquires the information Ss with the private key of the public key Pt0, and the session control device 4 uses Ps (Ps (Ss)) encrypted with the public key Ps of the session control device 4. And PS (Ss) is stored as session information St0 (S203).

The session control device 4 that has received Ps (Ps (Ss)) decrypts Ps (Ps (Ss)) with the private key of the public key Ps, compares it with the stored Ss, and if they match, Ps (Ss) is stored as information Ss, and the connection process to the communication terminal 3 is continued (S204).
After the communication session between the communication terminal 3 and the communication terminal 0 is established, the communication terminal 0 transmits Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the terminal 1 to the terminal 1 that moves the communication session. (S205). Here, step S205 may be transmitted as a response to the session information request from terminal 1 to terminal 0.

The communication terminal 1 decrypts the received Pt1 (St0) with the private key of the public key Pt1, and acquires information St0 (S206).
The terminal 1 transmits a transfer request for the communication session of the terminal 0 to the session control device 4 together with the public key Ps and Ps encrypted with the Pt0 (Pt0 (St0)) in the information St0 acquired in step S206, and Pt0 (St0) ) As session information St1 (S207).
The session control device 4 decrypts the received Ps (Pt0 (St0)) with the private key of the public key Ps, and the public key Pt0 of the terminal 0 that is the source of the stored session information Ss. Is compared with Pt0 (Ss) encrypted in the above, and if they match, Pt0 (Ss) is stored as session information Ss, and the session transfer process to the terminal 1 is continued (S208).

After the session with the terminal 1 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 0 (S209).
The example illustrated in FIG. 4 is a connection request from the communication terminal 0 to the communication terminal 3, but may be a connection request from the communication terminal 3 to the communication terminal 0.

Next, the operation of the invention of claim 6 will be described.
As shown in FIG. 5, after step S209 of FIG. 4, Pt2 (St1 encrypted with the public key Pt2 of the terminal 2 is stored in the information St1 stored from the communication terminal 1 that has established a communication session with the communication terminal 3. ) Is transmitted to the communication terminal 2 that is the destination of the communication session (S210). Here, step S210 may be transmitted as a response to the transfer request from the terminal 2.
The terminal 2 decrypts the received Pt2 (St1) with the private key of the public key Pt2, and acquires information St1 (S211).

The terminal 2 transmits the communication session transfer request of the terminal 1 to the session control device 4 together with the public key Ps and Ps encrypted with the Pt1 (Pt1 (St1)) in the information St1 acquired in step S211, and Pt1 (St1) Stored as session information St2 (S212).
The session control device 4 receives the Ps1 (St1) obtained by decrypting the received Ps (Pt1 (St1)) with the private key of the public key Ps and stores the session information Ss of the terminal 1 that is the source of the communication session. Pt1 (Ss) encrypted with the public key Pt1 is checked, and if it matches, Pt1 (Ss) is stored as session information Ss, and the session transfer process to the terminal 2 is continued (S213).
After the session with the terminal 2 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 1 (S214).

  Regarding the above description, the invention of claim 6 may be applied after the invention of claim 3. Further, the invention of claim 5 may be applied after the invention of claim 4. As described above, the present invention can basically cope with various implementation methods by a method of dividing the unit steps and appropriately combining the operations.

  According to a seventh aspect of the present invention, in the third to sixth aspects of the invention, the public key and the private key are stored in advance without storing the public key other than the self in the terminal or the device, and the encryption of the step is performed. By transmitting the public key to the partner terminal / device before processing, encryption with the public key in each step at the partner terminal is enabled.

FIG. 6 shows an example in which the invention of claim 7 is applied to the inventions of claims 4 and 6.
As shown in FIG. 6, the communication terminal 0 transmits a connection request to the communication destination terminal 3 to the session control apparatus 4 together with the public key Pt0 of the own terminal (S301).
After receiving the connection request, the session control device 4 generates session information Ss and transmits Pt0 (Ss) encrypted with the public key Pt0 of the terminal 0 to the terminal 0 (S302).

The terminal 0 that has received Pt0 (Ss) acquires the information Ss with the private key of the public key Pt0, and uses the session control device 4 to convert the PS (PS (Ss)) encrypted with the public key PS of the session control device 4. And stores Ps (Ss) as session information St0 (S303).
The session control device 4 that has received Ps (Ps (Ss)) decrypts Ps (Ps (Ss)) with the private key of the public key Ps, compares it with the stored Ss, and if they match, PS (Ss) is stored as information Ss, and the connection process to the communication terminal 3 is continued (S304).

After the communication session between the communication terminal 3 and the communication terminal 0 is established, the communication terminal 1 as a destination terminal transmits a transfer request to the communication terminal 0 together with the public key Pt1 of its own terminal (S305).
The communication terminal 0 transmits the public key Pt0 of its own terminal together with Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the terminal 1 to the terminal 1 that moves the communication session (S306).
The communication terminal 1 decrypts the received Pt1 (St0) with the private key of the public key Pt1, and acquires information St0 (S307).

The terminal 1 transmits a transfer request to the terminal 1 for the communication session of the terminal 0 together with the public key Pt1 of the terminal itself to the session control device 4 (S308).
The session control device 4 that has received the transfer request transmits an authentication request to the terminal 1 together with its own public key Ps (S309).
The terminal 1 that has received the authentication request sends a transfer request for the communication session of the terminal 0 to the session control device 4 together with the public key PS and PS (Pt0 (St0)) obtained by encrypting the information St0 acquired in step S307 with the public key PS. , Pt0 (St0) is stored as session information St1 (S310).

The session control device 4 decrypts the received Ps (Pt0 (St0)) with the private key of the public key Ps, and stores the session information Ss stored in the public key Ps of the terminal 0 that is the source of movement. Is compared with Pt0 (Ss) encrypted in step S3, and if they match, Pt0 (Ss) is stored as session information Ss, and the session transfer process to the terminal 1 is continued (S311).
After the session with the terminal 1 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 0 (S312).

Further, when the communication session of the communication terminal 1 is transferred to the terminal 2, as shown in FIG. 7, the communication terminal 2 as a destination terminal transmits a transfer request to the communication terminal 1 together with the public key Pt2 of the own terminal (S313). ).
The communication terminal 1 transmits the public key Pt1 of its own terminal together with Pt2 (St0) obtained by encrypting the session information St1 with the public key Pt2 of the terminal 2 to the terminal 2 that moves the communication session (S314).
The terminal 2 decrypts the received Pt2 (St1) with the private key of the public key Pt2, and acquires information St1 (S315).

The terminal 2 transmits to the session control device 4 a transfer request to the terminal 2 for the communication session of the terminal 1 together with the public key Pt2 of the terminal itself (S316).
The session control device 4 that has received the transfer request transmits an authentication request to the terminal 2 together with its own public key Ps (S317).
The terminal 2 that has received the authentication request transmits a communication session transfer request for the terminal 1 to the session control device 4 together with the public key Ps and Ps encrypted with Pt1 (Pt1 (St1)) in the information St1 acquired in step S315. Pt1 (St1) is stored as session information St2 (S318).

The session control device 4 discloses the received PS (Pt1 (St1)) with the secret key of the public key Ps and the stored session information Ss of the terminal 1 that is the source of the communication session. Pt1 (Ss) encrypted with the key Pt1 is collated, and if they match, Pt1 (Ss) is stored as session information Ss, and the session transfer process to the terminal 2 is continued (S319).
After the session with the terminal 2 is established, the session control device 4 performs a process for disconnecting or releasing the session with the terminal 1 (S320).

When terminal 0, terminal 1, and terminal 2 store public key 2 of session control device 4, transmission of public key PS from the session control device may not be performed.
In the inventions of claims 3 to 7, the terminal 1 or the terminal 2 may be a network device, and the session control device may be a communication terminal.
Hereinafter, a specific operation example according to the present invention will be described.

[Example 1]
In this embodiment, the communication session continues even if the terminal that uses the communication session from the communication terminal 0 that is establishing a VoIP communication session with the communication terminal 3 is switched to the communication terminal 1 and the terminal 2. It is a specific example.
FIG. 8 shows the system configuration of the first embodiment.

  As shown in the figure, this system includes terminal 0, terminal 1, and terminal 2 that communicate with the communication destination terminal 3, and a session control device 4 that controls communication between the communication destination terminal and terminal 0, terminal 1, and terminal 2. Consists of. Here, the terminal 0, the terminal 1, the terminal 2, the terminal 3, and the session control device 4 are connected to the IP network. Terminal 0 and terminal 2 are connected to the IP network by a wired LAN, and terminal 1 is connected to the IP network by a wireless line such as a wireless LAN or PHS.

  The terminal 0 holds the public keys Pt 1 and Pt 2 of the terminal 1 and the terminal 2 and the public key Ps of the session control device 4. The terminal 1 holds the public keys Pt0 and Pt2 of the terminals 0 and 2 and the public key Ps of the session control device 4. The terminal 2 holds the public keys Pt0 and Pt1 of the terminal 0 and the terminal 1, and the public key Ps of the session control device 4. The session control device 4 holds the public keys Pt0, Pt1, and Pt2 of the terminal 0, the terminal 1, and the terminal 2, respectively. In addition, terminal 0, terminal 1, terminal 2, and session control device 4 each hold a secret key corresponding to its own public key.

  In FIG. 8, an RF-ID tag (wireless IC tag) is attached to terminal 0 and terminal 2, and the address of the terminal (for example, IP address or SIP-URI) is stored in this tag. It is assumed that the address can be received by the RF-ID reader installed in the terminal 1.

Hereinafter, this will be described in detail with reference to FIG.
As shown in FIG. 9, an INVITE signal for requesting connection to the communication destination terminal 3 is transmitted from the communication terminal 0 to the session control apparatus 4 (S401).
After receiving INVITE, the session control device 4 generates session information Ss, and transmits a 401 signal for requesting authentication together with Pt0 (Ss) encrypted with the public key Pt0 of the terminal 0 to the terminal 0 (S402).

  The terminal 0 that has received the 401 signal obtains the information Ss with the private key of the public key Pt 0, and sends the INVITE signal together with Ps (Ps (Ss)) encrypted with the public key Ps of the session control device 4 to the session control device 4. And PS (Ss) is stored as session information St0 (S403). The session control device 4 that has received this INVITE signal decrypts PS (PS (Ss)) with the private key of the public key PS, compares it with the stored Ss, and if it matches, PS is set as session information Ss. (Ss) is stored, connection processing to the communication terminal 3 is continued, and a communication session to the communication terminal 3 is established (S404).

After the communication session is established, when it becomes necessary to leave the terminal 0, the communication terminal 1 which is a mobile portable terminal is brought close to the terminal 0, and the address of the terminal 0 from the RF-ID tag attached to the terminal 0 Is acquired by the terminal 1, and the terminal 1 requests the acquired address to move the communication session to the terminal 1 (S405).
The terminal 0 that has received this request transmits Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the terminal 1 to the terminal 1 that moves the communication session (S406).

The communication terminal 1 decrypts the received Pt1 (St0) with the private key of the public key Pt1, and obtains information St0 (S407).
The terminal 1 transmits an INVITE signal including a transfer request for the communication session of the terminal 0 to the session control device 4 together with the public key Ps and Ps (Pt0 (St0)) encrypted with the public key Ps and Pt0 in the information St0, and Pt0 (St0) Is stored as session information St1 (S408).

The session control device 4 decrypts the received Ps (Pt0 (St0)) with the private key of the public key Ps, and stores the session information Ss stored in the public key Pt0 of the terminal 0 that is the source of movement. Is compared with Pt0 (Ss) encrypted in step S4, and if they match, Pt0 (Ss) is stored as session information Ss, the session transfer process to terminal 1 is continued, and a session with communication terminal 1 is established (S409). ).
After the session with the terminal 1 is established, the session control device 4 performs a session disconnection process with the terminal 0 as shown in FIG. 10 (S410).

  Furthermore, when the user moves and arrives at the destination conference room, for example, when communication with the communication terminal 2 provided in the conference room is easier to handle than the portable communication terminal, the communication terminal 1 is brought closer to the communication terminal 2. Then, the address of the communication terminal 2 is acquired from the RF-ID tag attached to the terminal 2, and the terminal 1 encrypts with the public key Pt2 of the terminal 2 indicated by the received address in the stored information St1 (St1) At the same time, a communication session acceptance request is transmitted to the communication terminal 2 (S411).

The terminal 2 decrypts the received Pt2 (St1) with the private key of the public key Pt2, obtains information St1, and transmits a response to the terminal 1 (S412).
Receiving this response, the communication terminal 1 transmits a REFER signal, which is a request for transferring the communication session to the terminal 1, to the session control device 4 (S413).
In accordance with the transfer request received from the terminal 1, the session control device 4 transmits an INVITE signal, which is a communication session establishment request, to the terminal 2 (S414).

The terminal 2 that has received the establishment request from the session control terminal 4 transmits the public key Ps and Ps (Pt1 (St1)) encrypted with the information St1 to the session control apparatus 4 together with the 200 OK signal, and Pt1 (St1) Is stored as session information St2 (S415).
The session control device 4 receives the Ps1 (St1) obtained by decrypting the received Ps (Pt1 (St1)) with the private key of the public key Ps and stores the session information Ss of the terminal 1 that is the source of the communication session. Pt1 (Ss) encrypted with public key Pt1 is collated, and if they match, Pt1 (Ss) is stored as session information Ss, the session transfer process to terminal 2 is continued, and a session with communication terminal 2 is established (S416).
After the session with the terminal 2 is established, the session control device 4 performs a session disconnection process with the terminal 1 (S417).

  According to the present embodiment, when a voice or video communication session is established, the communication session is continued at the switching destination terminal even when the terminal is switched, and in the destination terminal authentication, the communication session is ongoing. Since it is associated with information, a transfer request from a malicious third party can be blocked. In addition, since the transmission / reception of the session information between the terminals / devices is encrypted with the public key, even if the session information is wiretapped on the transmission path, the destination terminal is not spoofed.

In this embodiment, the RF-ID tag is used for the search for the destination terminal. However, this may be an ad hoc network such as Bluetooth or wireless LAN, or a server for managing the terminal is provided separately. May be.
Further, the terminal 3 and the session control device 4 may be the same. Furthermore, the terminal 1 and the terminal 2 may be mounted in the network device.
Furthermore, the public key may be distributed in the steps before encryption in the above steps.

[Example 2]
The present embodiment is a specific example of an operation in which a session on the WEB of the communication terminal 3 and the HTTP WEB is continued even if the terminal used from the communication terminal 0 to the communication terminal 1 and the communication terminal 2 is switched. is there.

FIG. 11 shows a system configuration of the second embodiment.
In this system, as shown in the figure, the communication destination terminal 3 is a WEB server, and the session control function is implemented in this system. Further, it is composed of a terminal 0, a terminal 1, and a terminal 2 that communicate with the terminal 3. Terminal 0, terminal 1, terminal 2, and terminal 3 are connected to the IP network.
The terminal 0 and the terminal 1 are connected to the IP network through a wired LAN, and the terminal 1 is connected to the IP network through a wireless line such as a wireless LAN or PHS.

  The terminal 0 holds the public keys Pt 1 and Pt 2 of the terminal 1 and the terminal 2 and the public key Ps of the terminal 3. The terminal 1 holds the public keys Pt0 and Pt2 of the terminals 0 and 2 and the public key Ps of the terminal 3. The terminal 2 holds the public keys Pt0 and Pt1 of the terminal 0 and the terminal 1, and the public key Ps of the terminal 3. The terminal 3 holds the public keys Pt0, Pt1, and Pt2 of the terminal 0, the terminal 1, and the terminal 2, respectively. Further, terminal 0, terminal 1, terminal 2 and terminal 3 each hold a secret key corresponding to their own public key.

  In FIG. 11, an RF-ID tag (wireless IC tag) is attached to terminal 0 and terminal 2, and the address of the terminal (for example, IP address or SIP-URI) is stored in this tag. It is assumed that the address can be received by the RF-ID reader installed in the terminal 1.

This will be described in more detail with reference to FIG.
As shown in FIG. 12, a GET signal requesting connection from the communication terminal 0 to the communication destination terminal 3 is transmitted (S501).
After receiving the GET, the session control device 4 generates session information Ss, and transmits a 401 signal requesting authentication together with Pt0 (Ss) encrypted with the public key Pt0 of the terminal 0 to the terminal 0 (S502).

The terminal 0 that has received the 401 signal obtains the information Ss with the private key of the public key Pt 0, and sends a GET signal to the terminal 3 together with Ps (Ps (Ss)) encrypted with the public key Ps of the session control device 4. Re-send and store Ps (Ss) as session information St0 (S503).
The terminal 3 that has received the GET signal decrypts Ps (Ps (Ss)) with the private key of the public key Ps, compares it with the stored Ss, and stores Ps (Ss) as session information Ss if they match. Then, a session with the communication destination terminal 0 is established (S504).

  When the user has to leave the terminal 0 after the communication session is established, the communication terminal 1 which is a mobile portable terminal is brought close to the terminal 0, and the terminal is started from the RF-ID tag attached to the terminal 0. The terminal 1 acquires the address 0, and the terminal 1 requests the acquired address to move the session to the terminal 1 (S505).

The terminal 0 receiving this request transmits Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the terminal 1 to the terminal 1 that moves the session (S506).
The communication terminal 1 decrypts the received Pt1 (St0) with the private key of the public key Pt1, and acquires information St0 (S507).

The terminal 1 transmits a GET signal, which is a request for transferring a session with the terminal 0, to the session control device 4 together with the public key Ps and Ps (Pt0 (St0)) encrypted with the information St0 and transmits Pt0 (St0). Stored as session information St1 (S508).
The terminal 3 encrypts Pt0 (St0) obtained by decrypting the received Ps (Pt0 (St0)) with the private key of the public key Ps, and the stored session information Ss with the public key Pt0 of the source terminal 0 Pt0 (Ss) is compared, and if they match, Pt0 (Ss) is stored as session information Ss, the session transfer process to terminal 1 is continued, and terminal 3 establishes a session with terminal 1, Session disconnection with the terminal 0 is performed (S509).

  Further, when the user moves and arrives at a destination conference room, for example, when communication with the communication terminal 2 provided in the conference room easier to handle than the portable communication terminal is desired, as shown in FIG. 1 is brought close to the communication terminal 2, the address of the communication terminal 2 is acquired from the RF-ID tag attached to the terminal 2, and the terminal 1 uses the public key Pt2 of the terminal 2 indicated by the received address in the stored information St1. A request for accepting a communication session is transmitted to the communication terminal 2 together with the encrypted Pt2 (St1) (S510).

The terminal 2 decrypts the received Pt2 (St1) with the private key of the public key Pt2, acquires information St1, and transmits a response to the terminal 1 (S511).
The terminal 2 transmits the public key Ps and Ps (Pt1 (St1)) encrypted with the public key Ps1 in the information St1 to the terminal 3 together with the GET signal, and stores Pt1 (St1) as the session information St2 (S512).

  The terminal 3 decrypts the received PS (Pt1 (St1)) with the private key of the public key Ps, and stores the session information Ss stored in the public key of the terminal 1 that is the source of the communication session. Pt1 (Ss) encrypted with Pt1 is checked, and if they match, Pt1 (Ss) is stored as session information Ss, and the session establishment process for terminal 2 is continued, and terminal 3 establishes a session with terminal 2 After that, a session disconnection / release process with the terminal 1 is performed (S513).

  According to the present embodiment, when a session of a service on the WEB is established, the session is continued even at the switching destination terminal even if the terminal is switched. Since it is associated with information, a transfer request from a malicious third party can be blocked. In addition, since the transmission / reception of the session information between the terminals / devices is encrypted with the public key, even if the session information is wiretapped on the transmission path, the destination terminal is not spoofed.

In this embodiment, the RF-ID tag is used for the search for the destination terminal. However, this may be an ad hoc network such as Bluetooth or wireless LAN, or a server for managing the terminal is provided separately. May be.
Further, the terminal 3 and the session control device 4 may be installed separately. Furthermore, the terminal 1 and the terminal 2 may be mounted in the network device. Furthermore, regarding the distribution of the public key, it may be distributed in the steps before encryption in the above steps.

In each of the above-described embodiments, an example in which the public key of the terminal is used has been described, but the public key of the user who uses the terminal 0 may be used instead of the public key of the terminal 0.
In each of the above-described embodiments, the processing performed by the terminals 0, 1, 2, 3 and the session control device 4 is converted into a program code so that the user can use a recording medium such as a CD-ROM or DVD-ROM or a network such as the Internet. It is possible to distribute it.

  The present invention has been described in detail with reference to examples, but the present invention is not limited to the above-described embodiments, and various improvements and modifications can be made without departing from the spirit of the present invention. It goes without saying that it is good.

1 is a system configuration for realizing a session transfer method and an authentication method according to the present invention. FIG. 11 is a sequence diagram (part 1) when a connection request is made from the communication terminal 0 to the communication terminal 3, a transfer request is made from a terminal having a communication session, and the communication session is moved from the terminal 0 to the communication terminal 1 and then to the communication terminal 2. . FIG. 11 is a sequence diagram (part 2) when a connection request is made from the communication terminal 0 to the communication terminal 3, a transfer request is made from a terminal having a communication session, and the communication session is moved from the terminal 0 to the communication terminal 1 and then to the communication terminal 2. . A sequence diagram (part 1) in which a connection request is made from the communication terminal 0 to the communication terminal 3, a transfer request is made from a terminal having no communication session, and the communication session is moved from the terminal 0 to the communication terminal 1 and then to the communication terminal 2. is there. In the sequence diagram (part 2) when a connection request is made from the communication terminal 0 to the communication terminal 3, a transfer request is made from a terminal that does not have a communication session, and the communication session is moved from the terminal 0 to the communication terminal 1 and then to the communication terminal 2. is there. It is the sequence diagram (the 1) of the session transfer system and authentication system with public key distribution of each terminal and apparatus. It is the sequence diagram (the 2) of the session transfer system and authentication system with public key distribution of each terminal and apparatus. 1 is a system configuration diagram of Embodiment 1. FIG. It is the sequence diagram (the 1) of the session transfer system and authentication system in a VoIP service. It is the sequence diagram (the 2) of the session transfer system and authentication system in a VoIP service. FIG. 6 is a system configuration diagram of a second embodiment. It is the sequence diagram (the 1) of the session transfer system and the authentication system in the service on WEB. It is the sequence diagram (the 2) of the session transfer system and authentication system in the service on WEB.

Explanation of symbols

0, 1, 2 Communication terminal 3 Communication destination terminal 4 Session control device Ps Public key of session control device 4 or communication destination terminal 3 Pt0 Public key of communication terminal 0 Pt1 Public key of communication terminal 1 Pt2 Public key of communication terminal 2 Ss Session information generated or stored by session control device 4 or communication destination terminal 3 St0 Session information stored by communication terminal 0 St1 Session information stored by communication terminal 1 St2 Session stored by communication terminal 2 information

Claims (13)

A plurality of user communication terminals and session control devices are connected to the IP network,
Any of the user communication terminals holds public keys of other user communication terminals and the session control device, and the session control device holds public keys of a plurality of the user terminals,
A communication session established by any one of the user communication terminals (movement source terminal 0) and another user communication destination terminal via the session control device is transferred to another user communication terminal (movement destination terminal 1). When
The session control device authenticates the destination terminal 1 using information obtained by encrypting session information shared by the session control device and the source terminal 0 with the public key of the source terminal 0. An authentication method in session transfer as a feature. A plurality of user communication terminals, communication destination terminals, and a session control device are connected to the IP network,
Any of the user communication terminals holds public keys of other user communication terminals and the session control device, and the session control device holds public keys of a plurality of the user terminals,
When transferring a session established by any one of the user communication terminals (source terminal 0) and the communication destination terminal via the communication session to another user communication terminal,
The session information shared by the session control apparatus and the source terminal 0 is transmitted to the destination terminal 1 by the destination terminal 0 being encrypted with the public key of the destination terminal 1;
The destination terminal 1 decrypts the session information from the received terminal,
The session control device receives a session transfer request from the source terminal 0 or the destination terminal 1, and encrypts the session information encrypted with the public key of the source terminal 0 using the public key of the session control device Information is received from the destination terminal 1,
The decrypted information received from the destination terminal 1 is collated with the session information held by the session control device encrypted with the public key of the source terminal 0,
If they match, a session is established between the session control apparatus and the destination terminal 1, and the session information encrypted with the public key of the source terminal 0 is used as new session information. Having a unit step to be held by the control device;
When transferring the established session to another user communication terminal, the unit step is repeated as necessary. A plurality of user communication terminals, communication destination terminals, and a session control device are connected to the IP network,
Any of the user communication terminals holds public keys of other user communication terminals and the session control device, and the session control device holds public keys of a plurality of the user terminals,
When transferring a session established by any one of the user communication terminals (source terminal 0) and the communication destination terminal via the communication session to another user communication terminal,
When the session control apparatus establishes the communication session between the source terminal 0 and the communication destination terminal, the session control apparatus generates session information Ss, and the session information Ss is disclosed to the source terminal 0. Transmitting Pt0 (Ss) encrypted with the key Pt0 to the source terminal 0;
The source terminal 0 that has received the Pt0 (Ss) decrypts the session information Ss with the private key of the public key Pt0, and encrypts the session information Ss with the public key Ps of the session control device Ps (Ps Transmitting (Ss)) to the session control device and holding Ps (Ss) as session information St0;
The session control device that has received the Ps (Ps (Ss)) collates the information obtained by decrypting the Ps (Ps (Ss)) with the decryption key of the public key Ps and the generated session information Ss, and If so, holding Ps (Ss) as session information Ss and continuing the session establishment process;
After the communication session between the communication destination terminal and the movement source terminal 0 is established, the movement source terminal 0 sets Pt1 (St0) obtained by encrypting the session information St0 with the public key Pt1 of the movement destination terminal 1 as the movement destination. Transmitting to terminal 1;
The destination terminal 1 decrypts the Pt1 (St0) with the private key of the public key Pt1 to obtain the information St0;
The mobile terminal 0 requesting the session control device to move the session in communication to the destination terminal 1;
The session control device that has received the request requests the movement destination terminal 1 to establish a communication session;
The destination terminal 1 that has received the communication session establishment request from the session control device encrypts the session information St0 with the public key Ps of the session control device and the public key Pt0 of the source terminal 0, Ps (Pt0 Transmitting (St0)) to the session control device and holding Pt0 (St0) as session information St1;
The session control device that has received the Ps (Pt0 (St0)) decrypts the Pt0 (St0) with the private key of the public key Ps and the session information Ss received and decrypted from the source terminal 0 And Pt0 (Ss) encrypted with the public key Pt0 of the source terminal 0 match, the Pt0 (Ss) is held as the session information Ss, and the communication session establishment process with the destination terminal 1 is continued. Steps,
An authentication method in session transfer, comprising: a step of disconnecting or releasing a communication session with the source terminal 0 after the communication session with the destination terminal 1 is established. When further transferring a communication session from the destination terminal 1 to another user communication terminal (destination terminal 2),
After communication session transfer from the source terminal 0 to the destination terminal 1 is established, the session information St1 held by the destination terminal 1 is encrypted with the public key Pt2 of the destination terminal 2 Pt2 Transmitting (St1) to the destination terminal 2;
The destination terminal 2 decrypts the Pt2 (St1) with the private key of the public key Pt2, and obtains the St1;
The destination terminal 1 requesting the session control device to move the session in communication to the destination terminal 2;
The session control device receiving the request requests the destination terminal 2 to establish a communication session;
The destination terminal 2 that has received the communication session establishment request from the session control apparatus encrypts the session information St1 with the public key Ps of the session control apparatus and the public key Pt1 of the destination terminal 1 Ps (Pt1 Transmitting (St1)) to the session control device and holding Pt1 (St1) as session information St2.
The session control device that has received the Ps (Pt1 (St1)) decrypts the Pt1 (St1) with the private key of the public key Ps and the session information Ss received from the destination terminal 1 and decrypted and held. And Pt1 (Ss) encrypted with the public key Pt1 of the destination terminal, the Pt1 (Ss) is held as session information Ss, and the communication session establishment process with the destination terminal 2 is continued. And, after establishing a communication session with the destination terminal 2, the session control device includes a step of disconnecting or releasing the communication session with the destination terminal 1. A request for transferring a communication session between the communication destination terminal and the movement source terminal 0 to the movement destination terminal 1 is sent from the movement destination terminal 1 to the St0, the public key Ps of the session control device, and the movement source terminal 0. Together with Ps encrypted with the public key Pt0 (Pt0 (St0)) to the session control device,
The authentication method for session transfer according to claim 3, wherein Pt0 (St0) is held as session information St1. A request for transferring a communication session between the communication destination terminal and the movement source terminal 1 to the movement destination terminal 2 is sent from the movement destination terminal 2 to the public key Ps of the session control device and the movement destination terminal 1. Together with Ps (pt1 (St1)) encrypted with the public key Pt1
5. The authentication method for session transfer according to claim 4, wherein Pt1 (St1) is stored as session information St2. 7. The public key of the own terminal / device is not stored in advance, and the public key of the own terminal / device is transmitted simultaneously when accessing the communication terminal or the session control device. Authentication method in session transfer described in 1.   The authentication method in session transfer, wherein the public key Ps of the source terminal 0 used in the authentication method in session transfer according to any one of claims 1 to 7 is a user's public key. A session transfer control method using the authentication method in session transfer according to claim 1.   A control program for causing a computer to execute the session transfer control method according to claim 9.   A computer-readable recording medium on which the program according to claim 10 is recorded. The session transfer control system, wherein the destination terminal 1 or the destination terminal 2 used in the authentication method in session transfer according to claim 1 is the session control device. 9. The session transfer control system, wherein the session control device used for the authentication method in session transfer according to claim 1 is the communication destination terminal.

Images