JP2006042207A - Communication apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication apparatus for automatically setting common information used for authenticating a new communication apparatus when the new communication apparatus is added to a network. <P>SOLUTION: An information storage section 111 in the communication apparatus 11 stores the common information used for authenticating other communication apparatuses and identification information for identifying the communication apparatuses. A setting section 112 receives new common information when a new communication apparatus is added to the network. A control section 113 transmits the identification information of the communication apparatus having authentication relation to the new communication apparatus. The control section 113 transmits the identification information of the new communication apparatus and the new common information to the communication apparatus having authentication relation. The new communication apparatus and the communication apparatus having authentication relation store the information transmitted from the communication apparatus 11 to respective information storage sections to carry out authentication. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication device having an authentication function and a method for setting authentication information, and more specifically to a communication device newly added to a network and a method for setting authentication information of the communication device.

  In recent years, IP (Internet Protocol) networks centering on the Internet have been rapidly expanding. Even in each home, electric devices such as PCs, AV devices, surveillance cameras, and IP telephones tend to be connected to the IP network by having communication functions. In each home, a home network that provides a communication service between home appliances connected to an IP network is becoming widespread.

  In an IP network, security technology for dealing with unauthorized access such as impersonation and intrusion from the outside is indispensable from the viewpoint of network safety. As in a normal IP network, ensuring security for dealing with the unauthorized access is an important issue in a home network.

  One technique for ensuring security in a home network is device authentication. Device authentication means that the communication device confirms that the communication device of the communication destination is a valid device. The specific method is as follows. First, common information such as a password and a secret key for encryption is set in the communication device in advance. Next, the communication device establishes an authentication relationship by confirming that the common information exists in the communication device of the communication destination. When a new communication device is added to an IP network including a home network, it is necessary to set common information of the new communication device in the existing communication device in order to perform device authentication. At this time, setting common information for a new communication device without being known by a third party is an important issue in device authentication.

  As a first method of setting common information of a new communication device in an existing communication device, there is a method in which a network user directly inputs. In this method, it is necessary for the user to directly input common information of the new communication device for all existing communication devices that may communicate with the new communication device.

  As a second method of setting common information of a new communication device in an existing communication device, there is a method disclosed in Patent Document 1. FIG. 24 is a system configuration diagram of a home network disclosed in Patent Document 1. In FIG. A network 2 illustrated in FIG. 24 includes a home server 201 and a television 202. The home server 201 holds the secret key b1 and the public key b2 of the entire network 2. The home server 201 and the television 202 encrypt communication using the secret key c1.

The home server 201 is inserted with the remote control IC chip 204 storing the unique information of the remote control 203 and the secret key c2. The home server 201 issues a public key b2 to the entire network 2. The remote controller 203 encrypts the private key c2 and the unique information of the remote controller 203 with the public key b2, and broadcasts the encrypted information to the network 2. The home server 201 decrypts the encrypted information with the secret key b1. The home server 201 collates the unique information obtained by decryption with the unique information of the remote control IC chip 204 and permits the remote control 203 to log on. The home server 201 and the remote controller 203 can communicate using the secret key c2 as common information. When the remote controller 203 desires connection with the television 202, the home server 201 transmits the secret key c3 encrypted with the secret key c1 to the television 202. The home server 201 transmits the secret key c3 encrypted with the secret key c2 to the remote controller 203. The television 202 and the remote controller 203 can communicate using the secret key c3 as common information.
JP 2002-77143 A

However, the first and second methods have the following problems.
In the first method, the network user directly inputs the common information of the newly added communication device to the existing communication device, so the work for adding the new communication device becomes complicated. Also, common information for new communication devices needs to be set for all existing communication devices in the network. For this reason, the complexity at the time of introducing a new communication apparatus further increases. In particular, in a home network, there is a problem in that convenience is impaired when a user sets a communication device.

  In the second method, the home server automatically sets the common information of the newly added communication device to the existing communication device, thereby setting the common information for the existing communication device and the new communication device. Therefore, it is necessary to install an authentication home server in the home network. For this reason, there is a problem that it is not suitable for a home network built in a home.

  Therefore, an object of the present invention is to provide a communication device capable of automatically setting common information of a new communication device for an existing communication device on the network when a new communication device is added to the network. Is to provide.

  The present invention is directed to a communication device that establishes an authentication relationship with another network-connected communication device. In order to achieve the above-mentioned purpose, among the plurality of communication devices connected to the network, a specific communication device is configured to share the common information used for authentication processing and the device-specific information with respect to other communication devices having an authentication relationship on the network. Authentication between an information storage unit that stores identification information in association with each other, a setting unit that receives new common information necessary for authentication with a new communication device connected to the network, and a new communication device When establishing the relationship, the new common information input to the setting unit and the identification information of the new communication device are associated with each other and stored in the information storage unit, and at least the new common information is stored in the information storage unit. To all or a part of other communication devices stored in the storage unit, and at least the identification information of all or part of the other communication devices stored in the information storage unit is transmitted to the new communication device. That makes a transmission part.

  In addition, a communication device other than a specific communication device includes an information storage unit that stores common information used for authentication processing and device-specific identification information in association with other communication devices that are in an authentication relationship on the network, and a new A receiving unit that receives new common information necessary for authentication with a new communication device and identification information of the new communication device from a specific communication device that performs authentication processing with the new communication device, and new common information And a control unit that stores the identification information of the new communication device in the information storage unit.

  The communication device of the present invention may use attribute information specifying the use of the communication device. The specific communication device uses the attribute information of the new communication device to determine whether to register the new communication device in the network. The specific communication device transmits the attribute information of the new communication device to the other communication device, and transmits the attribute information of the other communication device to the new communication device. Other communication devices determine whether to establish an authentication relationship based on the received attribute information.

As described above, according to the present invention, new common information necessary for authentication with a new communication device connected to the network is input to the specific communication device and the new communication device. The specific communication device stores the identification information of the new communication device and the new common information in the information storage unit. As a result, the specific communication device and the new communication device can be authenticated. Further, the specific communication device transmits the new communication device identification information and the new common information to other communication devices on the network. Further, the specific communication device transmits the identification information of the other communication device and the common information of the other communication device to the new communication device stored in the information storage unit. The other communication devices store the new communication device identification information and the new common information in the information storage unit. As a result, the other communication device and the new communication device can be authenticated. With the communication device of the present invention, the setting of common information for a communication device newly connected to the network can be automated even in a network that does not have a server configuration.
Further, according to the present invention, each communication device can determine whether or not to authenticate with a communication device having different attribute information by providing the communication device with the attribute information.

FIG. 1 is a conceptual diagram showing an example of a network 1 constituted by communication devices of the present invention. The network 1 in FIG. 1 is configured by connecting a plurality of communication devices 10 to each other. The network 1 has a configuration that does not have an authentication server that manages identification information of each communication device and common information of each communication device used when performing authentication between the communication devices. The connection between the communication devices in the network 1 may be either wired or wireless. In addition, although the example of FIG. 1 has shown the case where the number of communication apparatuses which comprise the network 1 is four, the number of communication apparatuses is not restricted to this.
Hereinafter, the communication apparatus of the present invention will be described using two embodiments having different forms of authentication.

(First embodiment)
FIG. 2 is a block diagram showing a functional configuration of the communication device 10 according to the first embodiment of the present invention. The communication device 10 includes an information storage unit 111, a setting unit 112, a control unit 113, a transmission / reception unit 114, an authentication confirmation unit 115, and an authentication request unit 116.

  First, the outline | summary of each structure of the communication apparatus 10 is demonstrated. The information storage unit 111 stores identification information, common information, and the like of other communication devices for which an authentication relationship has been established. The identification information is information that can uniquely identify each communication device on the network 1. As this identification information, for example, a network address such as a MAC address and an IP address, a name and identification number assigned to each communication device, and the like are used. The common information is used as authentication information when requesting authentication, and is used for confirming the authentication information transmitted when authentication is requested.

  FIG. 3 is a diagram illustrating an example of identification information and common information stored in the information storage unit 111 of the communication device 10. As shown in FIG. 3, the information storage unit 111 stores a correspondence relationship between the identification information for each communication device and the common information held by the communication device in the form of an authentication table. The authentication table stores direct information indicating the direct relationship of the communication device. The direct relationship refers to a relationship between a communication device newly added to the network 1 and an existing communication device that can be authenticated first. In FIG. 3, regarding the communication device having the identification information “A”, the common information is “aaa”, and the direct information is “o”. Since the direct information is a “◯” mark, it can be seen that the communication device having the identification information “A” is first connected to the communication device having the authentication table shown in FIG. The direct information is stored using a number “0” or “1” when actually stored in the authentication table.

  The setting unit 112 includes an interface (not shown) for inputting new common information when a communication device is newly added to the network 1. The interface may be a flexible disk drive or an IC card reader, for example.

  When new common information is input from the setting unit 112, the control unit 113 stores the identification information of the communication device newly added to the network 1 and the new common information in the information storage unit 111. Further, when receiving the existing authentication message via the transmission / reception unit 114, the control unit 113 stores the identification information and common information of other communication devices included in the existing authentication message in the information storage unit 111. Further, when the control unit 113 receives a new authentication message via the transmission / reception unit 114, the control unit 113 stores the identification information and common information of the newly added communication device included in the new authentication message in the information storage unit 111. Details of the existing authentication message and the new authentication message will be described later. Further, the control unit 113 controls the authentication confirmation unit 115 and the authentication request unit 116.

  The authentication confirmation unit 115 confirms authentication information of another communication device when authentication is requested from another communication device. The authentication request unit 116 creates authentication information when requesting authentication from another communication device.

  The communication device 10 of the present invention executes different processes depending on the following three cases. (1) The communication device 10 is a communication device that newly participates in the network 1. In this case, the communication device 10 operates as a newly added device. (2) When first connected by a newly added device. In this case, the communication device 10 operates as a registration processing device. (3) When already connected to the network 1. In this case, the communication device 10 operates as an existing authentication device. Hereinafter, the operations of the registration processing device, the newly added device, and the existing authentication device will be described with reference to FIGS. FIG. 4 is a sequence diagram showing authentication processing executed by the three devices.

  The outline of the processing will be described with reference to FIG. First, new common information is input to the newly added device and the registration processing device (step S101). Note that the identification information of the newly added device and the registration processing device is input simultaneously with the input of the new common information. The registration processing device stores the input identification information and new common information of the newly added device, and registers the newly added device (step S102). The newly added device stores the registration processing device identification information and the new common information, and registers the registration processing device (step S103). Thereby, an authentication relationship is established between the registration processing device and the newly added device.

  Next, the registration processing device performs the following message processing (step S104). The registration processing device first creates an existing authentication message and a new authentication message. Then, the registration processing device transmits an existing authentication message to the newly added device (step S105), and transmits a new authentication message to the existing authentication device (step S107).

  The newly added device that has received the existing authentication message stores the identification information of the existing authentication device included in the existing authentication message in association with the new common information, and registers the existing authentication device (step S106). The existing authentication device that has received the new authentication message stores the identification information of the newly added device included in the new authentication message and the new common information in association with each other and registers the new additional device (step S108). By ending the existing device addition process and the new addition process, the existing authentication device and the new addition device can be authenticated. As a result, each communication device configuring the network 1 can establish an authentication relationship with each other communication device.

  Further, the operation of the registration processing device will be described in detail with reference to FIG. FIG. 5 is a flowchart showing the operation of the registration processing device.

  Identification information and new common information of the newly added device are input to the registration processing device (step S201). Subsequently, the registration processing device stores the new common information and the identification information of the newly added device in association with each other (step S202). Step S102 shown in FIG. 4 corresponds to step S202.

  The registration processing device determines whether to distribute the new common information and the identification information of the newly added device to the existing authentication device of the network 1 (step S203). The determination condition is, for example, whether or not an existing authentication device exists in the network 1. When the existing authentication device exists in the network 1, the registration processing device determines to distribute the new common information and the identification information of the newly added device. If there is no existing authentication device, the registration processing device ends the process.

  If the registration processing device determines to distribute the identification information to the existing authentication device, the registration processing device generates an existing authentication message (step S204), and sends the generated existing authentication message to the newly added device (step S205). The existing authentication message is data that stores identification information of an existing authentication device constituting the network. FIG. 6 is a diagram illustrating an example of the content of an existing authentication message. As shown in FIG. 6, the existing authentication message includes a transmission destination address, a transmission source address, and identification information of the existing authentication device. When there are two or more existing authentication devices, identification information is added to the existing authentication message by the number of existing authentication devices.

  Also, the registration processing device generates a new authentication message (step S206), and sends the generated new authentication message to the existing authentication device (step S207). The new authentication message is data in which identification information of a newly added device and new common information are stored. FIG. 7 is a diagram illustrating an example of the content of a new authentication message. As shown in FIG. 7, the new authentication message includes a transmission destination address, a transmission source address, identification information of a newly added device, and new common information. Step S104 shown in FIG. 4 corresponds to steps S204 and S206.

  FIG. 8 is a flowchart showing the operation of the newly added device shown in FIG. Hereinafter, the operation of the newly added device will be described in detail with reference to FIG.

  New common information and identification information of the registration processing device are input to the newly added device (step S301). The newly added device stores the new common information and the identification information of the registration processing device in association with each other (step S302). In FIG. 4, step S103 corresponds to step S302. Next, the newly added device determines whether an existing authentication message has been received from the registration processing device (step S303). When the newly added device has received the existing authentication message, the newly added device associates and stores the identification information of the existing authentication device and the new common information included in the existing authentication message (step S304). Step S106 shown in FIG. 4 corresponds to step S303 and step S304.

  FIG. 9 is a flowchart showing the operation of the existing authentication device shown in FIG. Hereinafter, the operation of the existing authentication device will be described in detail with reference to FIG.

  The existing authentication device determines whether a new authentication message has been received (step S401). When the new authentication message has been received, the existing authentication device stores the new common information and the identification information of the newly added device included in the new authentication message in association with each other (step S402). The authentication relationship in the network is updated when each device executes the above processing.

  Next, an authentication process performed between communication devices will be described in detail with reference to FIGS. 10 and 11. FIG. 10 is a diagram for specifically explaining authentication processing performed between communication devices. FIG. 11 is a diagram illustrating a specific example of identification information and common information stored in the information storage unit of the communication device. In the following description, the information storage units of the communication devices 11, 12, and 13 are referred to as information storage units 111, 121, and 131, respectively.

  As shown in FIG. 10A, when the authentication relationship using the common information a12 is established between the communication device 11 and the communication device 12, the authentication process of the communication device 13 is performed by the communication device 11. Consider the case where it is done against In this case, the communication device 11 corresponds to the registration processing device, the communication device 12 corresponds to the existing authentication device, and the communication device 13 corresponds to the newly added device. In addition, information shown in FIG. 11A is stored in the information storage units of the communication devices 11 to 13 at this time. Since the communication device 11 and the communication device 12 are in a direct relationship, the direct information in each authentication table is marked with “◯”.

  First, new common information a <b> 13 used for authentication between the communication device 11 and the communication device 13 is input to the communication device 11 and the communication device 13. The common information a13 is additionally registered in each information storage unit in association with the identification information of the counterpart communication device. FIG. 11B shows the state of the authentication table of each information storage unit at this time. Since the communication device 11 and the communication device 13 have a direct relationship, the direct information in the authentication table is marked with “◯”. By this additional registration, the authentication relationship between the communication device 11 and the communication device 13 is established by the common information a13 (FIG. 10B).

  When the establishment of the authentication relationship between the communication device 11 and the communication device 13 is completed, the communication device 11 notifies the communication device 12 of new common information a13 used for authentication with the communication device 13 as a new authentication message. In addition, the communication device 11 notifies the communication device 13 of identification information of all authentication devices, in this example, the communication device 12, as an existing authentication message. The communication device 12 additionally registers the identification information notified from the communication device 11 in the information storage unit 121 in association with the identification information of the communication device 13. On the other hand, the communication device 13 additionally registers the identification information of the communication device 12 notified from the communication device 11 in the information storage unit 131 in association with the common information a13. FIG. 11C shows the state of the authentication table of each information storage unit at this time. By this additional registration, the authentication relationship between the communication device 12 and the communication device 13 is also established by the common information a13 (FIG. 10C).

Here, a specific operation when the communication device performs authentication in the network constructed as shown in FIG. 11C will be described.
When the communication device 12 requests authentication from the communication device 13, the communication device 12 acquires the identification information and common information a13 of the communication device 13 stored in the information storage unit 121, and all or one of the common information a13 is acquired. Authentication information using the authentication part as an authentication key is generated. When generating authentication information, an indefinite value called NANCE may be used. The communication device 12 transmits an authentication request message including at least the identification information of the communication device 13 and the generated authentication information to the communication device 13.

  The communication device 13 extracts the identification information and authentication information of the communication device 12 from the authentication request message received from the communication device 12 in the authentication confirmation unit. In addition, the communication device 13 extracts common information corresponding to the identification information of the communication device 12 from the information storage unit 131, and creates authentication information for confirmation by the same creation method as the communication device 12. Then, the communication device 13 determines whether or not the authentication information in the authentication request message matches the authentication information for confirmation. If the information matches, the communication device 13 authenticates that the communication device 12 that is the transmission source of the authentication information is a valid device. The communication device 13 is notified that the authentication has been made. As a result, communication between the communication device 12 and the communication device 13 is started.

  When mutual authentication is necessary, the communication device 12 may include information indicating that mutual authentication is necessary in the authentication request message. At this time, after authenticating the communication device 12, the communication device 13 transmits an authentication request message to the communication device 12 through the same method as described above.

  As described above, when a new communication device is added to the network, common information necessary for authentication of the new communication device is set in the new communication device and any communication device on the network, and the arbitrary communication device is connected to the network. By distributing the common information to the existing communication devices, it is possible to distribute the common information for authentication of the added new communication devices even in a network system that does not use a server.

  Further, the communication device 10 configuring the network 1 may include attribute information that classifies the use of the communication device in the authentication table of the information storage unit 111. For example, the attribute information is an audio device or a cooking device. Attribute information that characterizes each communication device is added to the authentication table of the authentication storage unit 111. The attribute information may be input simultaneously with the common information input when a new communication device is added to the network 1 or may be input separately. FIG. 12 is a flowchart illustrating the operation of the registration processing device illustrated in FIG. 4 when the communication device configuring the network 1 sets common information using attribute information. The difference from the flowchart of the registration processing device shown in FIG. 5 is that a step (step S208) for determining whether or not to register a newly added device exists between step S201 and step S202. If the registration processing device has the attribute information of the audio device and the new addition device has the attribute information of the cooking device, the registration processing device assumes that the attribute information of the new addition device is different from its own attribute information. Registration of newly added devices can be rejected.

(Second Embodiment)
FIG. 13 is a block diagram showing a functional configuration of the communication device 10 according to the second embodiment of the present invention. In FIG. 13, the same components as those of the communication device 10 according to the first embodiment are denoted by the same reference numerals. Hereinafter, only points different from the first embodiment will be described. In FIG. 13, the difference from the first embodiment is that the information storage unit 111 includes an authentication request information storage unit 111a and an authentication confirmation information storage unit 111b.

  In the information storage unit 111, the authentication request information storage unit 111a stores identification information of other communication devices and request common information to be used as authentication information when requesting authentication from other communication devices. FIG. 14 is a diagram illustrating an example of identification information and request common information stored in the authentication request information storage unit 111a. As shown in FIG. 14, the authentication request information storage unit 111a has an authentication table indicating the correspondence between identification information of other communication devices and common information used when requesting authentication from the communication device. In addition, a flag indicating a direct relationship is stored in this authentication table.

  The authentication confirmation information storage unit 111b stores common confirmation information for confirming authentication information transmitted by another communication device when authentication is requested from the other communication device. FIG. 15 is a diagram illustrating an example of identification information and confirmation common information stored in the authentication confirmation information storage unit 111b. As illustrated in FIG. 15, the authentication confirmation information storage unit 111b includes an authentication table indicating a correspondence relationship between identification information in another communication device and common information for performing confirmation when the communication device requests authentication. Have.

  Operation | movement of the communication apparatus 10 in 2nd Embodiment is demonstrated. Similar to the first embodiment, the communication device 10 in the second embodiment operates as a registration processing device, a newly added device, and an existing authentication device shown in FIG. FIG. 16 is a flowchart showing the processing of the registration processing device. Hereinafter, the operation of the registration processing device will be described with reference to FIG.

  New common information and identification information of a newly added device are input to the registration processing device (step S501). The registration processing device associates the new common information with the identification information of the newly added device, and stores them in the authentication table of the authentication request information storage unit 111a and the authentication confirmation information storage unit 111b (step S502). Step S102 shown in FIG. 4 corresponds to step S502.

  The registration processing device determines whether to distribute the identification information of the newly added device and the new common information to the existing authentication device (step S503). The determination condition is, for example, whether or not an existing authentication device exists in the network 1. When the existing authentication device exists in the network 1, the registration processing device determines to distribute the identification information of the newly added device and the new common information. If no other communication device exists, the registration processing device ends the process.

  If the registration processing device determines to distribute to the existing authentication device, the registration processing device generates an existing authentication message to be transmitted to the newly added device (step S504), and sends the generated existing authentication message to the newly added device (step S505). . In the second embodiment, the data included in the existing authentication message generated by the registration processing device is different from the existing authentication message of the first embodiment. FIG. 17 is a diagram illustrating an example of the content of an existing authentication message generated by the registration processing device in the second embodiment. As shown in FIG. 17, the existing authentication message includes a transmission destination address, a transmission source address, identification information of the existing authentication device, and common information of the existing authentication device. When there are two or more existing authentication devices, the identification information of the existing authentication device and the common information of the existing authentication device are added alternately by the number of existing authentication devices.

  The registration processing device generates a new authentication addition message to be sent to the existing authentication device (step S506), and sends the generated new authentication message to the existing authentication device (step S507). Step S104 shown in FIG. 4 corresponds to step S504 and step S506.

  FIG. 18 is a flowchart showing the operation of the newly added device. Hereinafter, the operation of the newly added device will be described with reference to FIG.

  New common information and identification information of the registration processing device are input to the newly added device (step S601). The newly added device stores the identification information of the newly added device and the new common information in the authentication tables of the authentication request information storage unit 111a and the authentication confirmation information storage unit 111b in association with each other (step S602). Step S103 shown in FIG. 4 corresponds to step S602.

  The newly added device determines whether it has received an existing authentication message from the registration processing device (step S603). The newly added device associates the identification information of the existing authentication device and the common information of the existing authentication device included in the existing authentication message, and stores them in the authentication request information storage unit 111a (step S604). The newly added device associates the identification information of the existing authentication device and the new common information included in the existing authentication message, and stores them in the authentication confirmation information storage unit 111b (step S605). Step S106 shown in FIG. 4 corresponds to steps S603 to S605.

  FIG. 19 is a flowchart showing the operation of the existing authentication device. Hereinafter, the operation of the existing authentication device will be described with reference to FIG.

  The existing authentication device determines whether a new authentication message has been received (step S701). The existing authentication device associates the identification information of the newly added device included in the new authentication message with the new common information, and saves it in the authentication request information storage unit 111a (step S702). The existing authentication device associates the identification information of the newly added device included in the new authentication message with the common information of the registration processing device stored in the authentication confirmation information storage unit 111b, and stores it in the authentication confirmation information storage unit 111b. (Step S703). Steps S701 to S703 correspond to step S108 shown in FIG. As each device executes the above processing, the authentication relationship in the network is updated.

  Next, with reference to FIGS. 20 and 21, an authentication process performed between communication devices will be described in detail. FIG. 20 is a diagram for specifically explaining authentication processing performed between communication devices. FIG. 21 is a diagram illustrating a specific example of identification information and common information stored in the information storage unit of the communication device. In the following description, the authentication request information storage units of the communication devices 11, 12, and 13 are referred to as authentication request information storage units 111a, 121a, and 131a. The authentication confirmation information storage units of the communication devices 11, 12, and 13 are referred to as authentication confirmation information storage units 111b, 121b, and 131b.

  As shown in FIG. 20A, when the authentication relationship using the common information a12 is established between the communication device 11 and the communication device 12, the authentication process of the communication device 13 is performed by the communication device 11. Consider the case where it is done against In this case, the communication device 11 corresponds to the registration processing device, the communication device 12 corresponds to the existing authentication device, and the communication device 13 corresponds to the newly added device. Further, the information shown in FIG. 21A is stored in the authentication request information storage unit and the authentication confirmation information storage unit of each of the communication devices 11 to 13 at this time. Since the communication device 11 and the communication device 12 are in a direct relationship, the direct information in each authentication table is marked with “◯”.

  First, new common information a <b> 13 used for authentication between the communication device 11 and the communication device 13 is input to the communication device 11 and the communication device 13. The common information a13 is additionally registered in the authentication request information storage unit and the authentication confirmation information storage unit in association with the identification information of the counterpart communication device. FIG. 21B shows the state of the authentication table in each authentication request information storage unit and each authentication confirmation information storage unit at this time. Since the communication device 11 and the communication device 13 are in a direct relationship, the direct information in each authentication table is marked with “◯”. By this additional registration, the authentication relationship between the communication device 11 and the communication device 13 is established by the common information a13 (FIG. 20B).

  When the establishment of the authentication relationship between the communication device 11 and the communication device 13 is completed, the communication device 11 notifies the communication device 12 of new common information a13 used for authentication with the communication device 13 as a new authentication message. In addition, the communication device 11 notifies the communication device 13 of identification information and common information a12 of all existing authentication devices, in this example, the communication device 12, as an existing authentication message. The communication device 12 additionally registers the common information a13 notified from the communication device 11 in association with the identification information of the communication device 13 in the authentication request information storage unit 121a. Further, the communication device 12 associates the identification information of the communication device 13 with the common information of the communication device 11 of the authentication confirmation information storage unit 121b, and additionally registers it in the authentication confirmation information storage unit 121b. On the other hand, the communication device 13 associates the identification information of the communication device 12 notified from the communication device 11 and the common information of the communication device 12, and additionally registers them in the authentication request information storage unit 131a. Further, the communication device 13 additionally registers the identification information of the communication device 12 in the authentication confirmation information storage unit 131b in association with the common information a13. FIG. 21C shows the state of the authentication table of each information storage unit at this time. By this additional registration, the authentication relationship between the communication device 12 and the communication device 13 is established by the common information a12 and the common information a13 (FIG. 20C).

Here, a specific operation when the communication device performs authentication in the network constructed as shown in FIG. 21C will be described.
When the communication device 12 requests authentication from the communication device 13, the communication device 12 acquires the identification information and common information a13 of the third communication device stored in the authentication request information storage unit 121a, and the common information a13. Authentication information using all or part of the authentication key as an authentication key is generated. Note that when generating authentication information, an indefinite value called NONE may be used. The communication device 12 transmits an authentication request message including at least the identification information of the communication device 13 and the generated authentication information to the communication device 13.

  The communication device 13 extracts the identification information and authentication information of the communication device 12 from the authentication request message received from the communication device 12 in the authentication confirmation unit. Also, the communication device 13 extracts common information corresponding to the identification information of the communication device 12 from the authentication confirmation information storage unit 131b, and creates authentication information for confirmation by the same creation method as the communication device 12. Then, the communication device 13 determines whether or not the authentication information of the authentication request message matches the authentication information for confirmation. If the information matches, the communication device 13 authenticates that the communication device 12 that is the transmission source of the authentication information is a valid device. The communication device 13 is notified that the authentication has been made. As a result, communication between the communication device 12 and the communication device 13 is started.

  In this way, by providing two storage units, that is, an authentication request information storage unit and an authentication confirmation information storage unit, in the communication device, when the two communication devices request mutual authentication, the communication devices share different common information. Use to create authentication information. For this reason, even when the common information of one communication device is known to a third party, it is possible to request authentication from the other. It is possible to execute authentication with higher safety than authentication performed by two communication devices using the same common information.

  In addition, the communication apparatus which comprises the network 1 may preserve | save attribute information in the authentication request information storage part 111a and the authentication confirmation information storage part 111b. Attribute information characterizing each communication device is added to the authentication tables of the authentication request information storage unit 111a and the authentication confirmation information storage unit 111b. The attribute information may be input simultaneously with the common information that is input when a new communication device is added to the network 1. FIG. 22 is a flowchart showing an operation when the registration processing device shown in FIG. 4 uses attribute information. The difference from the flowchart showing the operation of the registration processing device shown in FIG. 16 is that a step (step S508) for determining whether or not to register a newly added device exists between step S501 and step S502. . If the registration processing device and the newly added device have different attribute information, the registration processing device can refuse registration of the new additional device.

  In the first and second embodiments, as described in step S101 in FIG. 4, the identification information of the registration processing device and the newly added device has been described as being input simultaneously with the new common information. The identification information of the registration processing device and the newly added device may be input at another timing. For example, when step S102 shown in FIG. 4 is performed, identification information of the registration processing device and the newly added device may be manually input.

  In the first and second embodiments, the existing authentication device may include a relay function in the control unit. The relay function is a function in which an existing authentication device that has received a new authentication message further transmits a new authentication message to another existing authentication device whose direct information is marked with “O”. FIG. 23 is a diagram for explaining the relay function of the communication device according to the first embodiment. In FIG. 23, communication devices connected by dotted arrows indicate a direct relationship. As shown in FIG. 23, it is assumed that a new communication device 15 is added in the network 1 and common information a15 is input to the communication device 13 and the communication device 15. In this case, the communication device 13 transmits a new authentication message to the communication device 11 and the communication device 14 that have a direct relationship. The communication device 11 that has received the new authentication message includes a communication device 12 having a direct relationship in addition to the communication device 13. The communication device 11 transmits a new authentication message to the communication device 12. The communication device 14 that has received the new authentication message does not transmit a new authentication message because there is no other direct communication device. Also in the second embodiment, the existing authentication device performs the same operation. By providing a relay function in the control unit, the amount of traffic temporarily increased by sending a new authentication message when a new communication device is added is reduced compared to when the control unit does not have a relay function. It becomes possible to do.

  In the first and second embodiments, when the registration processing device shown in FIG. 4 transmits the new authentication message and the existing authentication message, all or part of the common information of the newly added device and the existing authentication device. An encryption key may be generated based on the new authentication message and all or a part of the existing authentication message may be encrypted. Thereby, since the confidentiality of a new authentication message and an existing authentication message increases, the security of a network can be improved.

  In the first and second embodiments, when the communication device includes attribute information, the registration processing device may register a newly added device having different attribute information. The registration processing device may add the attribute information to the new authentication message and the existing authentication message. The existing authentication device that has received the new authentication message to which the attribute information has been added registers only the newly added device that matches its own attribute information. The newly added device that has received the existing authentication message to which the attribute information is added registers only the existing authentication device whose own attribute information matches. As a result, since the authentication relationship is established only with communication devices having the same attribute information, the load on the network 1 is reduced.

  Furthermore, in the first and second embodiments, an existing authentication message including only an existing authentication device having the same attribute information as the newly added device may be generated. In addition, the registration processing device may generate a new authentication message including only an existing authentication device having the same attribute information as the newly added device. Since the existing authentication device establishes the authentication relationship only with the communication device having the same attribute information, the load on the network 1 is reduced.

  The communication device of the present invention is effective when distributing common information used for authentication, and is particularly useful in a network or the like in which no server device is provided in the network.

The conceptual diagram which shows an example of the network 1 comprised by the communication apparatus of this invention The block diagram which shows the functional structure of the communication apparatus 10 The figure which shows an example of the identification information and common information which the information storage part 111 preserve | saves Sequence diagram for explaining the operation of the first communication device Flowchart diagram showing the operation of the registration processing device Configuration diagram of existing authentication message Configuration diagram of new authentication message Flowchart diagram showing the operation of the newly added device Flowchart diagram showing the operation of the existing authentication device Diagram for specifically explaining authentication processing performed between communication devices The figure which shows the specific example of the identification information preserve | saved at an information storage part, and common information The flowchart figure which shows operation | movement of the registration processing apparatus in the case of providing attribute information The block diagram which shows the functional structure of the 1st communication apparatus 11 which concerns on 2nd implementation mobile phone. The figure which shows an example of the identification information preserve | saved in an authentication request information storage part, and common information The figure which shows an example of the identification information preserve | saved in an authentication confirmation information storage part, and common information Flowchart diagram showing the operation of the registration processing device Configuration diagram of existing authentication message Flowchart diagram showing the operation of the newly added device Flowchart diagram showing the operation of the existing authentication device Diagram for specifically explaining authentication processing performed between communication devices The figure which shows the specific example of the identification information preserve | saved at an information storage part, and common information The flowchart figure which shows operation | movement of the registration processing apparatus in the case of providing attribute information Diagram for explaining the relay function of a communication device Diagram showing conventional technology of home network

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network 11, 12, 13, 14, 15 Communication apparatus 111 Information storage part 111a, 121a, 131a Authentication request information storage part 111b, 121b, 131b Authentication confirmation information storage part 112 Setting part 113 Control part 114 Transmission / reception part 115 Authentication confirmation part 116 Authentication request part

Claims (19)

A communication device that establishes an authentication relationship with another communication device connected to the network,
An information storage unit that stores common information used for authentication processing and device-specific identification information in association with each other for other communication devices that are in an authentication relationship on the network;
A setting unit for inputting new common information necessary for authentication with a new communication device connected to the network;
When establishing an authentication relationship with the new communication device, the new common information input to the setting unit and the identification information of the new communication device are stored in the information storage unit in association with each other. A control unit;
At least the new common information is transmitted to all or part of other communication devices stored in the information storage unit, and at least all or one of the other communication devices stored in the information storage unit. A communication unit comprising: a transmission unit that transmits the identification information of the unit to the new communication device. Along with the common information, attribute information assigned in advance according to the function of the communication device is input to the setting unit,
The communication device according to claim 1, wherein the control unit determines whether to establish an authentication relationship with the new communication device based on the attribute information. Along with the common information, attribute information assigned in advance according to the function of the communication device is input to the setting unit,
The communication device according to claim 1, wherein the transmission unit transmits the new common information and the attribute information to all other communication devices stored in the information storage unit. Along with the common information, attribute information assigned in advance according to the function of the communication device is input to the setting unit,
The said transmission part transmits the said new common information to the communication apparatus with which the said attribute information corresponds among the other communication apparatuses memorize | stored in the said information storage part. Communication equipment. The information storage unit stores attribute information assigned in advance according to the function of the communication device,
The communication according to claim 1, wherein the transmission unit transmits identification information and the attribute information of all other communication devices stored in the information storage unit to the new communication device. machine. The information storage unit stores attribute information assigned in advance according to the function of the communication device,
The said transmission part transmits the identification information of the communication apparatus with which the said attribute information corresponds among the other communication apparatuses memorize | stored in the said information memory | storage part to the said new communication apparatus, It is characterized by the above-mentioned. The communication device described in 1.   The communication according to claim 1, wherein the information storage unit further stores direct information indicating that the communication device has an authentication relationship established by inputting common information to the setting unit. machine.   The said transmission part transmits the said new common information to the communication apparatus by which the said direct information is shown among the other communication apparatuses memorize | stored in the said information storage part, The said common information is characterized by the above-mentioned. Communication equipment.   The common information stored in the information storage unit includes request common information used when requesting authentication from the other communication device, and confirmation common information used when confirming authentication required by the other communication device. The communication device according to claim 1, comprising: A communication device that establishes an authentication relationship with another communication device connected to the network,
A setting unit for inputting new common information necessary for new authentication with a specific communication device on the network;
An information storage unit that stores the new common information input from the setting unit in association with identification information unique to the specific communication device;
A receiving unit that receives identification information of other communication devices that are in an authentication relationship with the specific communication device from the specific communication device;
A communication device comprising: a control unit that stores the received identification information of the other communication device in the information storage unit. In addition to the identification information of the other communication device, the reception unit receives attribute information assigned in advance according to the function of the other communication device,
The communication device according to claim 10, wherein the control unit determines whether to establish an authentication relationship with the other communication device based on the attribute information.   The common information stored in the information storage unit includes request common information used when requesting authentication from the other communication device, and confirmation common information used when confirming authentication required by the other communication device. The communication device according to claim 10 or 11, characterized by comprising: A communication device that establishes an authentication relationship with another communication device connected to the network,
An information storage unit that stores common information used for authentication processing and device-specific identification information in association with each other for other communication devices that are in an authentication relationship on the network;
Reception that receives new common information necessary for authentication with the new communication device and identification information of the new communication device from a new communication device connected to the network and a specific communication device that performs authentication processing And
A communication device comprising: a control unit that stores the new common information and the identification information of the new communication device in the information storage unit. The receiving unit receives attribute information assigned in advance according to the function of the new communication device, together with the identification information of the new communication device and the new common information.
The communication device according to claim 13, wherein the control unit determines whether to establish an authentication relationship with the new communication device based on the attribute information.   The information storage unit further stores direct information indicating that the communication device has an authentication relationship established by directly input common information without going through the receiving unit. The communication device described.   16. The transmission device according to claim 15, further comprising a transmission unit that transmits the new common information to a communication device in which the direct information is indicated among other communication devices stored in the information storage unit. Communication equipment.   The common information stored in the information storage unit includes request common information used when requesting authentication from the other communication device, and confirmation common information used when confirming authentication required by the other communication device. The communication device according to claim 13, wherein the communication device is configured as follows. An authentication system in which a plurality of communication devices that perform authentication are connected to a network,
Any one particular communication device
A first information storage unit that stores common information used for authentication processing and device-specific identification information in association with each other for other communication devices that are in an authentication relationship on the network;
A setting unit for inputting new common information necessary for authentication with a new communication device connected to the network;
When establishing an authentication relationship with the new communication device, the first common information input to the setting unit and the identification information of the new communication device are associated with each other to store the first information A first control unit stored in the unit;
At least the new common information is transmitted to all or a part of other communication devices stored in the first information storage unit, and at least other information stored in the first information storage unit A transmission unit for transmitting all or part of the identification information of the communication device to the new communication device;
Communication devices other than the specific communication device are
A second information storage unit that stores common information used for authentication processing and identification information unique to the device in association with each other for other communication devices having an authentication relationship on the network;
A receiving unit that receives the new common information and the identification information of the new communication device from the specific communication device that performs authentication processing with the new communication device;
An authentication system comprising: a second control unit that stores the new common information and the identification information of the new communication device in the second information storage unit. An authentication processing method for a plurality of communication devices connected to a network and performing authentication,
Specific communication equipment
For other communication devices that are in an authentication relationship on the network, the step of storing the common information used for authentication processing and the device-specific identification information in association with each other in the first information storage unit;
Inputting new common information necessary for authentication with a new communication device connected to the network; and
When establishing an authentication relationship with the new communication device, the new common information input to the setting unit and the identification information of the new communication device are associated with each other and stored in the information storage unit And steps to
At least the new common information is transmitted to all or part of other communication devices stored in the information storage unit, and at least all or one of the other communication devices stored in the information storage unit. Transmitting the identification information of the unit to the new communication device,
Communication devices other than the specific communication device are
For other communication devices that are in an authentication relationship on the network, the step of storing the common information used for authentication processing and the device-specific identification information in association with each other in the second information storage unit;
Receiving the new common information and the identification information of the new communication device from the communication device for registration that performs authentication processing with the new communication device;
An authentication processing method comprising: storing the new common information and the identification information of the new communication device in the information storage unit.

Images