JP2005191830A - Authentication system and authentication method of information terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system, capable of preventing unauthorized use by performing authentication at a destination side terminal, and capable of suppressing the processing load on a server by minimizing inquiry for P2P server, and to provide an authentication method of an information terminal. <P>SOLUTION: A two-way communication system 10 configures a system by connecting IP telephone adapters (16, 18) and a server to an IP network 12 and connecting telephones, respectively, to the IP telephone adapters (16, 18), and limits access from a source IP telephone adapter 18 to the server to only once. The IP telephone adapter (16, 18) is equipped with an authenticating section 30 for receiving source authentication information from the server and authentication information from the source IP telephone adapter 18, respectively performing authentication by determining agreement of received authentication information and performing communication, depending on the authentication results. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication system and an authentication method for an information terminal device, and the authentication system of the present invention is, for example, a P2P (Peer-to-Peer) such as an IP telephone performed between an unspecified number of individual terminal devices in an IP (Internet Protocol) network. -Peer) It relates to a communication authentication system. The authentication method for an information terminal device according to the present invention relates to an authentication method for discarding an unauthorized connection request from a source information terminal device in P2P communication and accepting only a normal connection request, for example.

  P2P communication over IP networks is based on SDP such as mutual IP address, TCP / UDP (Transmission Control Protocol / User Datagram Protocol) port number, media specification, codec used for IP packetization of media. (Session Description Protocol) Information is transmitted to each other and negotiated.

  Here, the medium to be used is voice, video, or the like. In addition, codecs include recommendations G.711, G.722, G.729, etc. defined by ITU-T (International Telecommunication Union-Telecommunication standardization sector), for example. As this negotiation method, the conventional P2P communication method includes SIP (Session Initiation Protocol) defined in RFC (Request For Comment) 2543 and RFC3261 of IETF (Internet Engineering Task Force) which is an Internet standardization organization.

  The outline of the method and operation associated with SIP is described below. The source terminal device on the communication start side in P2P communication is required to acquire the IP address and the like of the called destination terminal device by some method. Therefore, in general, a P2P server is prepared in an IP network so as to solve acquisition of an IP address between terminals. At the start of P2P communication, the source terminal device transmits the identifier of the destination terminal device to the P2P server. For example, when the terminal device of the transmission source is an IP phone, the identifier corresponds to a telephone number. The P2P server identifies the other party's IP address from this identifier.

  In SIP, there are a proxy method and a redirect method as methods for solving the acquisition of the IP address. The proxy method is a method in which a P2P server relays negotiations between terminal devices. Here, the P2P server of this method is called a SIP server or a SIP proxy server. On the other hand, in the redirect method, the source terminal device transmits the identifier (telephone number) of the destination terminal device to the P2P server. The P2P server is a method in which an IP address specified from an identifier of a destination terminal device is transmitted to a source terminal device, and negotiation between the terminal devices is directly performed. A P2P server is generally called a SIP proxy server or a SIP redirection server. For this reason, the P2P server does not communicate with the destination terminal device.

  In general, the redirect method has a feature that the processing load of the P2P server is less than the proxy method because there is no relay processing of the P2P server or the like. A case where this redirect method is used will be described. In the redirect method, as described above, the negotiation is performed directly without relaying the P2P server. For this reason, the P2P server manages the IP addresses of all terminal devices, and mainly provides the IP addresses of destination terminal devices according to requests from the transmission source.

  Next, a specific sequence until P2P communication is started will be described. First, in order to communicate with the destination terminal device, the source terminal device sends an identifier such as a telephone number for identifying the terminal device as a communication partner and authentication information of the source terminal device itself to the P2P server. The authentication information is, for example, a user ID (IDentification) or a password.

  Next, when the authentication of the destination terminal device is completed, the P2P server identifies the IP address of the destination terminal device from the identifier that identifies the destination terminal device obtained from the source terminal device, and the destination terminal device Return the IP address to the terminal device that sent the message. Since the source terminal device knows the IP address of the obtained destination terminal device, it creates SDP information and transmits it to the destination terminal device. The destination terminal device also receives the SDP information from the source terminal device, and similarly creates SDP information and sends it back to the source terminal device. By such a procedure, both terminal apparatuses can recognize each other's IP address, port number, media codec, and can communicate with each other.

JP 2003-123001 A Japanese Patent Laid-Open No. 2003-208409

  By the way, the bidirectional communication system and the bidirectional communication method described in Japanese Patent Laid-Open No. 2003-123001 are a method of authenticating with an authentication server corresponding to the above-described P2P server. In this method, authentication is not performed by the terminal device on the receiving side. For this reason, when an unauthorized user operates the source terminal device and accesses the P2P server, the unauthorized user can directly access the receiving terminal device. As described above, the SIP redirection method may be accessed from an unspecified number of other terminal devices in P2P communication, and there is a security problem such as terminal impersonation and unauthorized access.

  In order to prevent such unauthorized use, it is conceivable that the destination terminal device authenticates the source terminal device. In this case, the destination terminal device holds the authentication information of all the terminal devices that may be accessed, and enormous capacity is required for the memory and disk, which is not realistic.

  Also, an authentication system and an authentication method described in Japanese Patent Laid-Open No. 2003-208409 have been proposed. This proposal is a method in which the receiving terminal device makes an inquiry to the P2P server during communication between P2P terminals. In this method, in order for the calling terminal device to know the address of the receiving terminal device, the P2P server makes an inquiry process to the P2P server, and the receiving terminal device makes an inquiry process to the P2P server twice in total. Furthermore, authentication processing is also performed by the P2P server.

  The present invention eliminates such disadvantages of the prior art, authenticates at the terminal device on the receiving side to prevent unauthorized use, and minimizes the query of the P2P server, thereby suppressing the processing load on the server and An object is to provide an authentication method for an information terminal device.

  In order to solve the above-described problems, the present invention has a plurality of information terminal devices and information for identifying each registered information terminal device among the plurality of information terminal devices. In an environment where each of a plurality of information terminal devices is connected to an IP (Internet Protocol) network and an information management device that provides corresponding information to a communication destination and a transmission source based on a request from the source. A conversion device that is arranged between the network and each of the plurality of information terminal devices, and converts the information handled by the IP network and the information handled by each of the plurality of information terminal devices to communicate, the conversion device Communication management with call state management, destination information acquisition, negotiation with communication partner, transfer of acquired authentication information and call start and end control functions Information management means for holding individual information assigned to the information terminal device connected to the conversion device and authentication information assigned to the conversion device itself, and information management via the communication management means Authentication means for receiving the authentication information of the sender supplied from the apparatus and the authentication information supplied from the converter of the sender, determining whether or not the received authentication information matches, and authenticating It is characterized by including.

  In the authentication system of the present invention, a plurality of conversion devices and information management devices are connected to an IP network, and an information terminal device is connected to the plurality of conversion devices to construct a system, from the source conversion device to the information management device. The conversion device is provided with authentication means, and the authentication means supplies the authentication information supplied from the information management device via the communication management means and the conversion device supplied from the transmission source. Authentication information received, and whether or not the received authentication information matches, the destination conversion device and the source conversion device negotiate according to the determination result, and an error occurs due to a mismatch By sending information to the source conversion device, the processing load on the information management device can be reduced, and even if the number of terminal devices increases, it can be handled without any problem.

  Further, in order to solve the above-mentioned problem, the present invention receives individual information assigned to a destination information terminal device from a source information terminal device and responds to the reception via an IP (Internet Protocol) network. The first step of transmitting the IP address of the conversion device to which the source information terminal device is connected and the individual information of the destination to the information management device as the communication request, and the communication request received The second step of searching for the IP address of the source conversion device in the information management device, and the authentication information and IP address assigned to the source conversion device obtained as a search result from this information management device A third step of transmitting to the conversion device to which the information terminal device is connected, and a fourth step of storing the authentication information and IP address of the transmission source supplied by the destination conversion device, A fifth step of searching for individual information in the destination information terminal device from the information management device, and a step of transmitting the IP address of the entry corresponding to the destination obtained as a search result from the information management device to the source conversion device 6. In response to the reception of the IP address assigned to the destination conversion device from the information management device by the source conversion device, the information including the authentication information for the source is transmitted to the destination conversion device. And the destination conversion device receives the information supplied from the source conversion device, and compares the authentication information from the information management device with the authentication information from the source conversion device. If the comparison result of the authentication information matches the eighth step of determination, the comparison result does not match with the ninth step of transmitting a response signal including the information of the destination conversion device itself to the conversion device of the transmission source. In case of Characterized in that it comprises a tenth step of transmitting error information to the original conversion device.

  The method for recognizing the information terminal device according to the present invention is such that the access to the information management device is made only once from the source conversion device as a communication request, and thereafter the information management device searches the IP address of the source conversion device. Verify whether it is registered, send authentication information and IP address for the source conversion device to the destination conversion device as legitimate information, store them, and store them individually from the information management device to the destination information terminal device Information is searched, the destination IP address obtained by this search is sent to the source conversion device, and the source authentication information is based on the IP address of the destination conversion device supplied by the source conversion device. Is sent to the destination conversion device, the destination conversion device compares the authentication information from the information management device with the authentication information from the source conversion device, and if the comparison results match, Destination conversion device It is determined that the request is from a legitimate source, a response signal including information on the destination converter itself is transmitted to the source converter, and if the comparison result does not match, it is determined that the destination converter is impersonating, Authentication is performed by sending error information to the conversion device of the transmission source. In this method, authentication of the calling side at the receiving side is performed based only on the two corresponding recognition information provided without having a huge amount of information such as authentication information corresponding to other conversion devices at the receiving side. It can be carried out. This authentication can reduce the burden on the information management apparatus.

  Next, an embodiment of an authentication system according to the present invention will be described in detail with reference to the accompanying drawings.

  In this embodiment, the authentication system of the present invention is applied to the bidirectional communication system 10. The illustration and description of parts not directly related to the present invention are omitted. In the following description, the signal is indicated by the reference number of the connecting line in which it appears.

  The bidirectional communication system 10 according to the present embodiment will be described with respect to communication using an IP telephone using SIP. As shown in FIG. 2, in the bidirectional communication system 10, a server 14 and IP telephone adapters 16 and 18 are connected to an IP network 12, and telephones 20 and 22 as terminal devices are connected to the IP telephone adapters 16 and 18, respectively. It is connected. The terminal device is not limited to a telephone. In this embodiment, the telephone 20 and the telephone 22 make an IP phone call through the IP phone adapters 16 and 18, respectively. Here, the IP telephone is a telephone service using the IP network 12 instead of using a circuit switching network as in a normal telephone. In general, an IP telephone has a feature that equipment costs can be reduced by using a general-purpose device for the IP network 12 instead of using a dedicated exchange as in a circuit switching network. Here, general-purpose devices include routers and switches.

  The server 14 is a SIP server defined in RFC (Request For Comment) 3261 of the International Engineering Task Force (IETF). The server 14 includes a location server 24 and a redirect server 26, as shown by the logic block in FIG. The logical block is expressed as a logical function and does not directly indicate the configuration of software, hardware, or the like.

  The location server 24 manages the telephone number, IP address and authentication information for each IP telephone as a set of information. The authentication information is a combination of an ID and a password assigned to each IP telephone adapter, and is used in the SIP authentication process. Each IP telephone adapter is assigned unique authentication information.

  The redirect server 26 has a function of searching for a corresponding IP address, searching for authentication information corresponding to the search, and sending information obtained by the search. Explaining these functions, when the redirect server 26 receives the telephone number of the destination IP phone adapter that is the destination that can make a call via the IP interface from the IP phone adapter that is the source of the call. The function retrieves the IP address of the entry corresponding to the telephone number from the location server 24 and transmits it to the originating IP telephone adapter, and for the authentication of the entry corresponding to the IP address corresponding to the originating IP terminal device from the location server 24. It has a function of extracting information and transmitting the IP address and authentication information related to the source IP terminal to the destination IP telephone adapter.

  As shown in FIG. 1, the IP telephone adapters 16 and 18 include a communication management unit 28, an authentication unit 30, and a telephone information holding unit 32 as logical blocks. The communication management unit 28 is a call state management function such as busy / disconnected, inquires the server 14 for the telephone number input from the IP telephone, obtains an IP address for the destination IP telephone adapter, and other IP telephone adapters. A negotiation function, a function of receiving authentication information of the IP telephone adapter of the caller included in the server 14 and transferring it to the authentication unit 30, and a function of controlling the start and end of a call.

  The authentication unit 30 receives the authentication information of the transmission source supplied from the server 14 via the communication management unit 28, and the authentication supplied from the communication partner, that is, the IP telephone adapter corresponding to the transmission source at the time of the negotiation process The function has a function of receiving information for authentication, determining whether or not the information matches using the information for authentication, and authenticating the information. The telephone information holding unit 32 holds the telephone number assigned to the telephone and the authentication information assigned to the IP telephone adapter itself.

  Returning to FIG. 2, the IP telephone adapters 16 and 18 convert the analog signals 34 and 36 from the connected IP telephones 20 and 22 into IP packets, and convert the supplied IP packets into analog signals 34 and 36, respectively. have. The IP telephone adapters 16 and 18 of this embodiment negotiate with each other. The negotiation uses SIP.

  In the bidirectional communication system 10 of the present embodiment, the server 14 handles authentication information in this way, so that the destination IP telephone adapter is authenticated by the destination IP telephone adapter and impersonation is prevented. For authentication of the source IP telephone adapter in the destination IP telephone adapter, authentication information is transmitted from the server 14 to the destination IP telephone adapter before the start of P2P communication. For this reason, the IP telephone adapter does not need to have authentication information of other IP telephone adapters.

  Next, the procedure up to the start of P2P communication in the bidirectional communication system 10 will be described. The sequence shown in FIG. 4 is a procedure for calling the telephone 20 from the telephone 22 of FIG. Here, for the sake of clear and substantial explanation, the operation description of this embodiment is a procedure between the IP telephone adapters 16 and 18 and the telephones 20 and 22, SIP 100 TRYING messages, and SDPs other than those related to the present invention. The description about the information is omitted, and the negotiation performed between the server 14 and the IP telephone adapters 16 and 18 is described.

  The IP telephone adapter 18 receives the destination telephone number of the telephone 20 from the telephone 22. At this time, the IP telephone adapter 18 becomes a transmission source. In order to obtain the IP address of the IP telephone adapter 16, the IP telephone adapter 18 transmits the telephone number of the telephone 20 and the IP address of the IP telephone adapter 18 itself to the server 14 as a P2P communication request at time T10. The P2P communication request is an INVITE message 40 in SIP.

  When the server 14 receives the P2P communication request from the IP telephone adapter 18, the server 14 searches the location server 24 for authentication information of an entry corresponding to the IP address of the IP telephone adapter 18 and extracts it. The server 14 transmits the authentication information and IP address of the IP telephone adapter 18 to the IP telephone adapter 16 as a SIP INFO message 42 at time T12. When the IP telephone adapter 16 receives the authentication information and the IP address of the IP telephone adapter 18 that is the transmission source, the IP telephone adapter 16 stores it in the authentication unit 30 in the IP telephone adapter 16.

  The server 14 further searches the IP address of the entry corresponding to the telephone number of the telephone 20 from the location server 24 and acquires it. The server 14 transmits the SIP 302 MOVED message 44 to the IP telephone adapter 18 at time T14 (REDIRECT). Upon receiving the IP address of the IP telephone adapter 16 from the server 14, the IP telephone adapter 18 transmits its own SDP information and authentication information to the IP telephone adapter 16 as a SIP INVITE message 46 at time T16.

  When the IP telephone adapter 16 receives the SDP information and the authentication information from the IP telephone adapter 18, the authentication unit 30 compares the authentication information received from the server 14 with the authentication information supplied from the IP telephone adapter 18. . More specifically, the authentication identifier included in the authentication information received from the server 14 is compared with the authentication identifier included in the authentication information supplied from the IP telephone adapter 18. If these authentication identifiers match, the IP telephone adapter 16 determines that the request is correct from the IP telephone adapter 18, and at time T18, the IP telephone adapter 16 sends a 200 OK message 48 including the SDP information of the IP telephone adapter 16 itself to the IP telephone. Send to adapter 18. After this series of negotiations before the start of the call is completed, the call is started between the IP telephone adapters 16 and 18.

  At the end of the call, for example, when the IP telephone adapter 16 receives a call end signal from the telephone 20, it notifies the other party's IP telephone adapter 18 of the end of the call by the BYE message 50 at time T20. The IP telephone adapter 18 notified of the end of the call transmits a call end signal to the telephone set 22 and notifies the other party's IP telephone adapter 16 of the end of the call at the time T22.

  If the IP phone adapter 16 does not match the authentication identifier (or authentication information), the IP phone adapter 16 determines that the request is from the IP phone adapter impersonating the IP phone adapter 18, and an error is returned to the IP phone adapter 18. Send to the spoofed IP phone adapter. The IP telephone adapter that has received this error transmits a busy tone signal to the telephone that the other terminal is busy.

  Next, the processing procedure in the server 14 will be described with reference to FIG. Server 14 is already active. It is determined whether or not the server 14 is kept activated (end determination: step S10).

  If the server 14 is shutting down (NO), the server 14 is terminated. If other processing is being performed, the operation is continued (to step S12).

  Next, the redirect server 26 of the server 14 determines whether or not there is a P2P communication request from the IP telephone adapter. If there is no P2P communication request (YES), the process proceeds to standby processing (to step S14). When the P2P communication request is received (NO), the process proceeds to the search process of the location server 24 (to step S16). In the standby process, for example, the process is interrupted and waits for a certain standby time ST, and then the process returns to the end determination again (to step S10).

  Next, authentication information of the IP phone adapter of the transmission source is searched (step S16). Corresponding to the previous operation, the caller is the IP telephone adapter 18. First, the redirect server 26 in the server 14 extracts the source IP address included in the INVITE message 40 of the P2P communication request, and searches the location server 24 using the extracted IP address as key information.

  Next, it is determined whether or not an entry corresponding to the key information exists (step S18). If the corresponding entry exists (YES), it is determined that the server 14 is to be managed, and the process proceeds to the next process (to step S20). If there is no corresponding entry (NO), it is determined that a P2P communication request from an IP telephone adapter not managed by the server 14 has been received, and the process proceeds to error processing (to step S22).

  Next, the IP address of the IP telephone adapter corresponding to the destination telephone is searched based on the telephone number assigned to the destination telephone (step S20). The redirect server 26 in the server 14 uses the destination telephone number included in the INVITE message 40, which is a P2P communication request, as key information, and searches the IP address of the IP telephone adapter 18 in the location server 24.

  Next, the search result is determined (step S24). The determination is whether or not a corresponding entry exists. If the corresponding entry exists (YES), it is determined that the server 14 is the target, and the process proceeds to the next process (to step S26). When the corresponding entry does not exist (NO), it is determined that the telephone number of the received P2P information is incorrect, and the process proceeds to error processing (to step S22).

  Next, the server 14 transmits the authentication information of the source IP telephone adapter 18 to the destination IP telephone adapter 16 obtained by the search (step S26: transmission of the INFO message 42). The destination IP phone adapter 16 stores the authentication information received here as regular information, and later authenticates the source IP phone adapter 18 that requests communication based on the stored information.

  Next, the server 14 transmits the IP address of the IP telephone adapter 16 corresponding to the destination obtained by the search from the redirect server 26 to the source IP telephone adapter 18 (step S28: transmission of the 302 MOVED message 44; REDIRECT). As a result, the two IP telephone adapters 16 and 18 in the bidirectional communication system 10 can negotiate with each other because they have acquired information necessary for communication.

  On the other hand, the error processing (step S20) described above is performed in response to the search result for the authentication information of the source IP telephone adapter or the result of the search for the IP address of the destination IP telephone adapter not being found. It is processing. In this error processing, error information indicating that the request is an error is returned to the IP telephone adapter that has transmitted the P2P communication request.

  Next, each processing of the IP telephone adapters 16 and 18 in the bidirectional communication system 10 will be described with reference to FIGS. The IP telephone adapter can be used as both a transmission source and a destination. In this embodiment, a case will be described in which the IP telephone adapter 18 is assumed as the transmission source and the IP telephone adapter 16 is assumed as the destination. Assume that the IP telephone adapters 16 and 18 are in an activated state. It is determined whether or not to end the processing as the IP telephone adapter without distinguishing between the transmission source and the destination (step S30). When the IP telephone adapter is performing the shutdown process (YES), the process proceeds to the end, and in other processes (NO), it is determined that the operation is continued, and the process proceeds to the information determination process (to step S32).

  The information determination process determines whether or not the user has dialed, that is, whether or not the information supplied to the IP telephone adapter is a telephone number (step S32). When it is determined that the supplied information is not a telephone number (YES), the process proceeds to a determination process as to whether or not a call has been made (to step S34). In addition, when the supplied information is determined to be a telephone number (NO), it is a case where a telephone number is received from a telephone directly connected to the IP telephone adapter, and the IP telephone adapter is the source IP telephone adapter 18 Function. Further, the IP telephone adapter as the transmission source proceeds to the process in FIG. 7 via the connector A (to step S36).

  Next, it is determined whether or not the supplied information is an INFO message (step S34). This determination determines whether the IP telephone adapter is on the destination side. If the received information is not an INFO message (YES), since the information is neither a phone number nor a caller's information, it is determined that the IP phone adapter has neither made nor placed a call, and proceeds to a standby state ( Step S38). If the received information is an INFO message (NO), it is determined that a call has been made and the destination side has been reached, and the process proceeds to a process of storing the supplied information (to step S40).

  If the process has proceeded to the standby state, the process stops for a predetermined time WT in step S38 and waits, and then returns to the end determination process (to step S30). Thus, by determining whether the telephone number and the INFO message are received, the IP telephone adapter performs processing by classifying the source and the destination, respectively.

  Among the classified processes, a process as a transmission source will be described. FIG. 7 shows a processing procedure as the IP telephone adapter 18 for making a call. The IP telephone adapter transmits a P2P communication request to the server 14 (step S36: transmission of the INVITE message 40). This is because the IP telephone address inquires the server 14 about the IP address for the destination IP telephone adapter 16. The IP telephone adapter transmits an INVITE message 40 in which the IP address of the IP telephone adapter 18 and the telephone number assigned to the destination telephone are input to the server 14.

  Next, the IP telephone adapter determines the response from the server 14 in two stages. The IP telephone adapter determines whether or not the IP address assigned to the destination IP telephone adapter 16 is returned from the server 14 as a transmission source (step S42). If the IP address assigned to the destination IP telephone adapter 16 is returned (YES), it is determined that the destination IP address has been recognized, and the process proceeds to the INVITE message 46 transmission process (to step S44). After the transmission process of the INVITE message 46, the destination IP telephone adapter 16 is negotiated. If the IP address has not been returned (NO), it is determined that the destination IP address has not been recognized, and the process proceeds to error information reception determination processing (step S46).

  The error information reception determination process (step S46) determines whether or not error information is returned from the server 14. If error information has been received (YES), the process proceeds to call termination processing (to step S48). If error information has not been received (NO), the process proceeds to standby processing (step S50). In the standby process, the process is stopped for a predetermined time WT in the same manner as in step S38, and the standby process is performed. After this standby, the process returns to the IP address reception determination process (step S42).

  Next, a series of processes as the source IP telephone adapter 18 for negotiating with the destination IP telephone adapter 16 will be described. The IP telephone adapter 18 transmits an INVITE message 46 to the IP telephone adapter 16 as shown in FIG. 7 (step S44). The INVITE message 46 includes SDP information and authentication information for the partner terminal.

  Next, IP telephone adapter 18 determines whether or not SDP information has been received from destination IP telephone adapter 16 as a response to the transmission of INVITE message 46 (step S52). When the SDP information is received (YES), the IP telephone adapter 18 can recognize the information of the destination IP telephone adapter 16, that is, the port number, media, codec, and the like from the received SDP information. Thereby, the telephones 20 and 22 start a call via the IP telephone adapters 16 and 18 (step S54).

  If SDP information has not been received (NO), the process proceeds to error information reception determination processing (to step S56). The error information reception determination process determines whether or not there is error information supplied from the destination IP telephone adapter 16 (step S56). If the error information is returned to the caller (YES), the process proceeds to call termination processing (to step S48). If no error information is returned to the caller (NO), the process proceeds to a standby process (to step S58). The standby process (step S58) stops the process for a predetermined time WT as in step S38, waits, and then returns to the SDP information reception determination process (returns to step S52).

  Next, when the caller IP telephone adapter 18 is in a call with the destination IP telephone adapter 16, it is determined whether or not a call end signal has been received from the caller telephone 22 (step S60). This determination can be understood from whether the telephone set 22 is on-hook. If it is on-hook during a call (YES), a termination request is output so that the destination IP telephone adapter 16 performs termination processing (to step S62). If the telephone set 22 is not on-hook (NO), the process proceeds to a determination process for determining whether or not the destination side has been terminated (go to step S64).

  Next, an end signal is transmitted to the destination IP telephone adapter 16 in response to the end of the caller telephone set 22 (end request: step S62). The destination IP telephone adapter 16 starts an end process in response to the supplied end signal, and outputs a response signal (200 OK) to the end request to the source IP telephone adapter 18.

  Next, the originating IP telephone adapter 18 determines whether or not a response signal has been received (step S66). If not received (NO), the process proceeds to a standby process (to step S68). If it has been received (YES), the process proceeds to call termination processing (to step S48). In the standby process (step S68), the process is stopped for a predetermined time WT in the same manner as in step S38, and the process is put on standby. After waiting, the process returns to the response reception determination process (to step S66).

  Next, determination of whether or not the destination side has been completed will be described. This determination process is different from the above-described determination of the transmission source in that the determination target is the destination side. That is, in the determination process, the determination is made based on whether or not the source IP telephone adapter 18 has received a termination request from the destination, for example, the IP telephone adapter 16 (step S64). If an end signal is received from the destination IP telephone adapter 16 (YES), the process proceeds to an end response process (to step S70). If the end signal is not received from the destination IP telephone adapter 16 (NO), the process returns to the caller end determination process (step S60) and repeats the call end determination.

  Next, in an end response process (step S70), a response signal (200 OK) to the end signal supplied from the source IP telephone adapter 18 is output to the destination IP telephone adapter 16. Thereafter, the process proceeds to call termination processing (to step S48). In the call termination process, the telephone set 20 enters an off-hook state through the caller telephone set 22 and the destination IP telephone adapter 16, and the call is cut off. If the handsets of the telephones 20 and 22 are raised, a busy tone is transmitted. Thereafter, the IP telephone adapter returns to the end process of FIG. 6 via the connector B of FIG. 7 without distinguishing between the transmission source and the destination (to step S30).

  Next, a case where the IP telephone adapter functions as the destination IP telephone adapter 16 will be described. Returning to FIG. 6, the authentication information and the IP address supplied from the server 14 as the destination IP telephone adapter 16 are stored in the authentication unit 30 in step S40. After this storage, the process proceeds to a process for determining whether or not the INVITE message 46 has been received from the originating IP telephone adapter 18 (to step S72).

  Next, when the INVITE message 46 is not received in the reception determination process (step S72) of the INVITE message 46 (NO), the process proceeds to a standby process (to step S74). In the standby process (step S74), the process is stopped for a predetermined time WT in the same manner as in step S38 described above, and the process is put on standby. After waiting, the process returns to the reception determination process for the INVITE message 46 (to step S72). If the INVITE message 46 has been received (YES), the process proceeds to authentication processing (to step S76).

  Next, an authentication process is performed (step S76). The authentication process determines whether the authentication information included in the INFO message 42 supplied from the server 14 to the authentication unit 30 and the authentication information included in the received INVITE message 46 do not match. If they do not match (YES), it is determined that the request is from an unauthorized IP telephone adapter such as impersonation, and the process proceeds to error processing according to this determination (to step S78). In the case of coincidence (NO), it is determined that the IP telephone adapter 18 of the transmission source has been reliably authenticated. The destination IP phone adapter 16 proceeds to a process of transmitting SDP information to the source IP phone adapter 18 (step S80).

  Next, in the error process, error information is returned to the IP telephone adapter 18 of the transmission source (step S78). In the SDP information transmission process (step S80), the SDP information of the destination IP telephone adapter 16 is sent to the source IP telephone adapter 18 as a response signal. The response signal corresponds to 200 OK (48) in FIG. As a result, the destination IP telephone adapter 16 has the same conditions for communicating with the originating IP telephone adapter 18, and the negotiation is completed. After this completion, the connection C in FIG. 6 proceeds to FIG. 8 to start a call (to step S82).

  Note that after the authentication is confirmed, the authentication unit 30 discards the stored information so that it is not used for other than this call.

  Step S82 indicates that a call is being made with the IP telephone adapter 18 of the caller. The subsequent processing is the same series of processing as the communication end processing when operated as the source IP telephone adapter 18, but differs in that the destination is the destination IP telephone adapter 16. Here, it is first determined whether or not a call end signal has been received from the telephone 20 (step S84). That is, it is determined whether the telephone 20 is on-hooked. If it is on-hook (YES), the process proceeds to a termination request process so as to terminate the source IP telephone adapter 18 (to step S86). If it is not on-hook (NO), it is determined that the destination side is in a call state, and the process proceeds to determination of the call state on the source side (to step S88).

  In the termination request process, a termination signal is transmitted from the destination IP telephone adapter 16 to the source IP telephone adapter 18 (step S86). After this transmission, the destination IP telephone adapter 16 determines whether a response signal to the reception of the end signal has been received from the source IP telephone adapter 18 (step S90). If a response signal is received (YES), the process proceeds to call termination processing (to step S92). If no response signal has been received (NO), the process proceeds to a standby process (to step S94). The standby process (step S94) interrupts the process for a predetermined time WT, and then returns to the response signal reception determination process (return to step S90).

  In response to the fact that the destination telephone 20 is not in an end state, it is determined whether or not the source side has ended (step S88). If the caller side is not terminated, it is determined that the call is continued, and the process returns to the call process (to step S82). If the destination IP telephone adapter 16 receives an end signal indicating end from the caller side (YES: end request received), the process proceeds to end response processing (to step S96). The termination response process outputs a response signal for the termination signal received from the destination IP telephone adapter 16 to the source IP telephone adapter 18. Thereafter, the process proceeds to call termination processing (to step S92). In the call termination process (step S92), the telephone set 22 is placed off-hook via the destination telephone set 20 and the caller IP telephone adapter 18 in a call disconnecting state. If the handsets of the telephones 20 and 22 are raised, a busy tone is transmitted. Thereafter, the IP telephone adapter returns to the end process of FIG. 6 via the connector B of FIG. 8 without distinguishing between the transmission source and the destination (to step S30).

  By operating in this way, when the authentication information is transmitted from the server 14 to the terminal device on the receiving side in an environment where a large number of unspecified terminals exist, Even if P2P communication is performed, it is possible to authenticate whether the terminal communicating with the IP phone adapter is correct, thereby preventing unauthorized access and impersonation. In addition, the two-way communication system 10 can be introduced without worrying about the difference in usability of existing analog telephones and IP telephones during a call.

  By configuring as described above, a plurality of IP telephone adapters (16, 18) and a server 14 are connected to the IP network 12, and telephones 20, 22 are connected to the IP telephone adapter (16, 18), respectively. The communication system 10 is constructed, and access to the server 14 from the source IP telephone adapter 18 in this embodiment can be performed only once. The IP telephone adapter (16, 18) includes an authentication unit 30 and an authentication unit. At 30, the authentication information supplied from the server 14 and the authentication information supplied from the IP telephone adapter 18 are received via the communication management unit 28, and the received authentication information matches. By determining whether or not to negotiate with the destination IP phone adapter 16 and the source IP phone adapter 18 according to the determination result, and sending error information to the source IP phone adapter 18 with a mismatch, Reduce the processing load on the server 14 Therefore, even if the number of terminal devices increases, it can be handled without any problem.

  By including the location server 24 and the redirect server 26, the server 14 determines whether or not a plurality of IP telephone adapters 16 and 18 are properly registered and managed, and performs management according to the determination that they are correct. Information can be provided to the IP phone adapter. By performing such information management, the IP telephone adapter does not have to have enormous information such as authentication information about the communication partner.

  Further, according to the method for recognizing the information terminal device of the present invention, the access to the server 14 is performed only once from the source IP telephone adapter 18 as a communication request, and thereafter, the server 14 transmits the IP telephone adapter 18 of the source. The IP address is searched to verify whether it has been registered, and the authentication information and IP address for the source IP phone adapter 18 are sent to the destination IP phone adapter 16 as regular information, which is stored in the server. The telephone number of the destination telephone 20 is searched from 14, the destination IP address obtained by this search is transmitted to the source IP telephone adapter 18, and the destination IP telephone supplied by the source IP telephone adapter 18 is transmitted. Based on the IP address of the adapter, information including the authentication information of the sender is sent to the destination IP phone adapter 16, and the destination IP phone adapter 16 sends the authentication information from the server 14 and the source IP phone adapter 18. Authentication information If the comparison results in a match, the destination IP phone adapter 16 determines that the request is from a legitimate source, and sends a response signal containing information about the destination IP phone adapter 16 itself to the source IP phone adapter. If the comparison result does not match, it is determined that the destination IP phone adapter 16 is impersonating. It is possible to perform authentication on the calling side on the called side based on only two corresponding pieces of recognition information provided without having an enormous amount of information such as authentication information corresponding to the IP telephone adapter. This authentication can reduce the burden on the server 14.

  It goes without saying that the present invention can be applied not only to IP telephones but also to all P2P communications such as videophones and file exchanges on an IP network.

It is a logic block diagram which shows the schematic structure of an IP telephone adapter among the bidirectional | two-way communication systems to which the authentication system of this invention is applied. It is a figure which shows the structure of the whole bidirectional | two-way communication system to which the authentication system of this invention is applied. FIG. 3 is a logical block diagram showing a schematic configuration in the server of FIG. 2. It is a sequential chart explaining the operation | movement procedure with the IP telephone adapter of a transmission origin and a destination, and a server. It is a flowchart explaining the procedure of the negotiation in the server shown in FIG. 6 is a flowchart for explaining a negotiation procedure in the P telephone adapter shown in FIG. It is a flowchart explaining the procedure of the negotiation following FIG. It is a flowchart explaining the procedure of the negotiation following FIG.

Explanation of symbols

10 Two-way communication system
12 IP network
14 servers
16, 18 IP phone adapter
20, 22 telephone
28 Communication Management Department
30 Authentication Department
32 Telephone information holding unit

Claims (5)

A plurality of information terminal devices;
Among the plurality of information terminal devices, information that identifies each registered information terminal device is held, and the corresponding information is sent to the communication destination and the transmission based on a request from one of the information terminal devices as a transmission source. An information management device originally provided,
In the environment where each of the plurality of information terminal devices is connected to an IP (Internet Protocol) network, the information handled by the IP network and the plurality of information are arranged between the IP network and each of the plurality of information terminal devices. A conversion device that converts the information to the information handled by each of the information terminal devices and causes the information to communicate,
The conversion device includes communication management means having a call state management, destination information acquisition, negotiation with a communication partner, transfer of acquired authentication information, and call start and end control functions;
Information holding means for holding individual information assigned to the information terminal device connected to the converter and authentication information assigned to the converter itself;
Whether source authentication information supplied from the information management device via the communication management unit and authentication information supplied from the source conversion device are received, and whether the received authentication information matches An authentication system comprising: authentication means for determining whether or not to authenticate. The system according to claim 1, wherein the information management device includes a first management device that manages individual information, an IP address, and authentication information of each of the information terminal devices as a set of information;
An authentication system comprising: a second management device having a function of searching for a corresponding IP address, searching for authentication information corresponding to the search, and transmitting the obtained information.   3. The authentication system according to claim 1 or 2, wherein the authentication information is a combination of identification information and a password assigned to the conversion device. Among the conversion devices that receive individual information assigned to a destination information terminal device from a source information terminal device and perform communication via an IP (Internet Protocol) network in response to the reception, the source information terminal A first step of transmitting the IP address of the conversion device to which the device is connected and the individual information of the destination to the information management device as a communication request;
A second step of searching for an IP address of the source conversion device in the information management device that has received the communication request;
A third step of transmitting the authentication information assigned to the source conversion device obtained as a search result from the information management device and the IP address to the conversion device to which the destination information terminal device is connected; ,
A fourth step of storing the sender authentication information and the IP address supplied by the destination conversion device;
A fifth step of retrieving the individual information in the destination information terminal device from the information management device;
A sixth step of transmitting the IP address of the entry corresponding to the destination obtained as a search result from the information management device to the source conversion device;
In response to reception of an IP address assigned to the destination conversion device from the information management device by the source conversion device, information including authentication information of the source is transmitted to the destination conversion device. 7 steps,
The destination conversion device receives information supplied from the source conversion device, and compares and determines the authentication information from the information management device and the authentication information from the source conversion device. An eighth step;
When the comparison result of the authentication information matches, a ninth step of transmitting a response signal including the information of the destination conversion device itself to the source conversion device;
And a tenth step of transmitting error information to the source conversion device when the comparison result does not match.   5. The method according to claim 4, wherein the authentication information is a combination of identification information and a password assigned to the conversion device.

Images