JP2013197920A - Communication system, sip server, and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable a subscriber to select an installation position of a terminal while using a one-time password without increasing a processing load.SOLUTION: A SIP server 30 comprises: setting means for setting different reception ports for a register signal and a SIP signal except the register signal; authentication means for authenticating a one-time password of the register signal when receiving a register signal from a subscriber terminal A through a register signal reception port 11; and control means for opening a SIP signal reception port 36 except registers to a SIP signal having an origination address and origination telephone number of a subscriber terminal A, and transmitting an instruction to open a SIP signal reception port 12 except registers of a subscriber accommodation device 10 to a SIP signal having the origination address of the subscriber terminal to the subscriber accommodation device. The subscriber accommodation device 10 opens the SIP signal reception port 12 except registers to the SIP signal having the origination address in an accommodation position 01 which accommodates the subscriber A having the instructed origination address.

Description

  The present invention relates to a communication system, a SIP server, and an authentication method for authenticating a subscriber terminal in communication using the SIP protocol.

  In communication using the SIP protocol, digest authentication or the like is used for subscriber terminal authentication of the SIP server. Digest authentication uses MD5, SHA-1, etc. for password encryption. At the time of the advent of such an encryption method, the strength of the encryption was guaranteed, but in the future the SIP signal sent by the subscriber terminal will be sent in the future due to the discovery of advanced decryption algorithms and the speeding up of the calculation speed. The digest authentication may be decrypted by a malicious third party, and communication may be interrupted.

  For this reason, methods using a one-time password (Non-Patent Documents 1 and 2) and line authentication methods (Non-Patent Documents 3 and 4) have been proposed.

RFC2289, [online], Internet <http://tools.ietf.org/html/rfc2289> ITpro [online], Internet <http://itpro.nikkeibp.co.jp/article/COLUMN/20060414/235357/> ITpro, [online], Internet <http://itpro.nikkeibp.co.jp/article/COLUMN/20070125/259673/> ITpro, [online], Internet <http://itpro.nikkeibp.co.jp/article/COLUMN/20071121/287778/>

  However, in the case of the one-time password method, it is necessary to increase the password update frequency in order to enhance security. For example, it is desirable to authenticate with a one-time password updated for each SIP transaction, but on the other hand, the processing load on the subscriber terminal and the SIP server increases.

  The line authentication method is a method in which the accommodation line of the subscriber terminal is fixed and the SIP signal of the subscriber terminal is not accepted from other than the corresponding line. In this way, the line authentication method fixes the accommodated line of the subscriber terminal, so that it is difficult to be attacked by a third party, but is not suitable for a service in which the subscriber can freely select the installation location of the terminal.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to use a one-time password without increasing the processing load and allow a subscriber to select a terminal installation location, To provide a SIP server and an authentication method.

  To achieve the above object, the present invention provides a communication system comprising a SIP server and a subscriber accommodation device, wherein the SIP server sets a receiving port separately for a register signal and a SIP signal other than a register. And an authentication means for authenticating the one-time password included in the register signal when receiving the register signal from the subscriber terminal via the register signal receiving port, and if the authentication is successful, the originating address of the subscriber terminal And a SIP signal receiving port other than the register for the SIP signal of the calling telephone number, and a SIP signal receiving port other than the register of the subscriber accommodation device for the SIP signal of the calling address of the subscriber terminal. Control means for transmitting an instruction to open the subscriber accommodation apparatus to the subscriber accommodation apparatus, wherein the subscriber accommodation apparatus is configured to issue a calling instruction instructed by the SIP server. In the subscriber terminal stowed stowed position in less, opening the receiving port for SIP signal other than the register to the SIP signal of the source address.

  The present invention provides a setting means for setting a receiving port separately for a register signal and a SIP signal other than a register, and when a register signal is received from a subscriber terminal via a register signal receiving port, the one-time included in the register signal Authentication means for authenticating a password, and when the authentication is successful, the SIP signal receiving port other than the register is opened for the SIP signal of the calling address and calling telephone number of the subscriber terminal, and the subscriber terminal Control means for transmitting an instruction to open a SIP signal receiving port other than the register of the subscriber accommodation device to the subscriber accommodation device in response to the SIP signal of the calling address.

  The present invention is an authentication method performed by a communication system including a SIP server and a subscriber accommodation device, wherein the SIP server sets a receiving port separately for a register signal and a SIP signal other than a register, An authentication step of authenticating the one-time password included in the register signal when receiving the register signal from the subscriber terminal via the register signal receiving port; and if the authentication is successful, the calling address and calling of the subscriber terminal The SIP signal receiving port other than the register is opened for the SIP signal of the number, and the SIP signal receiving port other than the register of the subscriber accommodation device is opened for the SIP signal of the originating address of the subscriber terminal. A control step of transmitting an instruction to the subscriber accommodation device, wherein the subscriber accommodation device is instructed by the SIP server. In the subscriber terminal stowed stowed position dress, a reception port for SIP signals other than the register performs opening step of opening the SIP signal of the source address.

  ADVANTAGE OF THE INVENTION According to this invention, while using a one-time password, without increasing a processing load, the communication system, SIP server, and authentication method which a subscriber can select the installation place of a terminal can be provided.

1 is a diagram illustrating an overall configuration of a communication system according to an embodiment of the present invention. It is a block diagram which shows the structure of a SIP server. It is explanatory drawing explaining the receiving port of a subscriber accommodation switch and a SIP server. It is a figure which shows the operation | movement which a subscriber terminal transmits a Register signal to a SIP server. It is a figure which shows the operation | movement which a SIP server opens a receiving port. It is a figure which shows the operation | movement which transmits SIP signals other than Register from a subscriber terminal. It is a figure which shows operation | movement when a malicious subscriber terminal camouflages a legitimate subscriber terminal. It is a sequence diagram which shows the detailed operation | movement of this embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a configuration diagram showing the overall configuration of the communication system of the present embodiment. In the communication system of the present embodiment, in communication using the SIP protocol, the SIP server 30 authenticates each of the subscriber terminals A and B in cooperation with the subscriber accommodation switch 10.

  The communication system shown in FIG. 1 includes at least one subscriber terminal A, B, a subscriber accommodation switch 10 (subscriber accommodation device), a subscriber accommodation router 20, and a SIP server 30. Subscriber terminals A and B are terminals that communicate with the SIP server 30 via a network (such as the Internet).

  The subscriber accommodation switch 10 is installed in the IP network, aggregates the lines accommodating the subscriber terminals A and B, and interconnects IP packets between the subscriber terminals A and B and the subscriber accommodation router 20. It is a device to perform. In addition, the subscriber accommodation switch 10 of the present embodiment is configured such that the SIP signal receiving port other than the Register is connected to the SIP signal of the originating address at the accommodating position where the subscriber terminal having the originating address specified by the SIP server 30 is accommodated. To open against.

  The subscriber accommodation router 20 is a device that is installed in the IP network and interconnects IP packets between the subscriber terminals A and B and the SIP server 30.

  When the SIP server 30 is installed in the IP network and receives the call connection request signal from the subscriber terminals A and B, the SIP server 30 sends the call connection request signal to the address information corresponding to the incoming number included in the call connection request signal. Send and establish communication.

  FIG. 2 is a functional block diagram showing functions of the SIP server 30 of the present embodiment. The illustrated SIP server 30 includes a setting unit 31, an authentication unit 32, a control unit 33, and a call processing unit 34. The setting unit 31 sets the reception port separately based on the Register signal and the SIP signal other than the register. When receiving the Register signal from the subscriber terminals A and B via the Register signal receiving port, the authenticating unit 32 authenticates the one-time password included in the Register signal. When the authentication is successful, the control unit 33 opens the SIP signal receiving port other than the register with respect to the SIP signals of the calling addresses and calling numbers of the subscriber terminals A and B, and the subscriber terminals A and B An instruction to open the SIP signal receiving port other than the Register of the subscriber accommodation switch 10 is transmitted to the subscriber accommodation switch 10 in response to the SIP signal of the originating address. The call processing unit 34 performs predetermined call processing in accordance with SIP signals from the subscriber terminals A and B.

  The SIP server 30 can use, for example, a general-purpose computer system including a CPU, a memory, an input device, and an output device. In this computer system, each function of the SIP server 30 is realized by the CPU executing a program for the SIP server 30 loaded on the memory. Further, the program for the SIP server 30 can be stored in a computer-readable recording medium such as a hard disk, flexible disk, CD-ROM, MO, DVD-ROM, or can be distributed via a network.

  Next, the operation of this embodiment will be described.

  FIG. 3 is an explanatory diagram illustrating the reception ports of the subscriber accommodation switch 10 and the SIP server 30 according to the present embodiment.

  In the present embodiment, the SIP server 30 (setting unit 31) sets a reception port number (UDP port number) for each SIP signal type. Specifically, the reception port (UDP port) is set differently for the “Register signal” and the “SIP signal other than the Register”. Hereinafter, the reception port for the Register signal is expressed as “RegPort”, and the reception port for the SIP signal other than the Register is expressed as “SipPort”. The Register signal is a signal for registering the location information of the subscriber terminal in the SIP server 30.

  As shown in FIG. 3, both the RegPort 11 of the subscriber accommodation switch 10 and the RegPort 35 of the SIP server 30 are always open. On the other hand, the SipPort 12 of the subscriber accommodation switch 10 and the SipPort 36 of the SIP server 30 are closed, and an opening process is performed at the timing shown in FIG.

  FIG. 4 is a diagram illustrating an operation in which the subscriber terminal A transmits a Register signal to the SIP server 30 using the RegPorts 11 and 35 in the open state.

  The subscriber terminal A (IP address: A, telephone number: α) sends a Register signal to the SIP server 30 via the RegPort 11 of the subscriber accommodation switch 10 that is always open, the subscriber accommodation router 20 and the RegPort 35 of the SIP server 30. Is transmitted (S11). The Register signal transmitted from the subscriber terminal A includes a one-time password for performing digest authentication. When receiving the Register signal, the SIP server 30 (authentication unit 32) performs digest authentication using the one-time password and authenticates the subscriber terminal A (S12).

  The update timing of the one-time password is set every time the register signal is transmitted, and the impersonation of the register signal by a third party is suppressed.

  FIG. 5 is a diagram illustrating an operation in which the SIP server 30 opens the SipPorts 12 and 36 after determining that the digest authentication of the Register signal in FIG.

  After the digest authentication of the Register signal is completed, the SIP server 30 (control unit 33) opens the SipPort 36 of the SIP server 30 to the subscriber terminal A that has succeeded in the authentication. Specifically, the SipPort 36 is opened only for the SIP signal (excluding the Register signal) of the calling terminal IP: A and the calling telephone number: α of the subscriber terminal A (S21). As a result, the SIP signal transmitted from the subscriber terminal A passes through the SipPort 36 and is received by the SIP server 30.

  Then, the SIP server 30 (the control unit 33) transmits an instruction to open the SipPort 12 to the subscriber terminal A to the subscriber accommodation switch 10 (S22). When the subscriber accommodation switch 10 receives the instruction from the SIP server 30, the subscriber accommodation switch 10 opens the SipPort 12 to the subscriber terminal A at the accommodation position (physical port 01) in which the subscriber terminal A is accommodated (S23). Specifically, the SipPort 12 is opened only for the SIP signal of the source IP address: A. Thereby, the SIP signal transmitted from the subscriber terminal A passes through the SipPort 12 at the accommodation position of the line to which the subscriber terminal A is connected, and is received by the subscriber accommodation switch 10.

  By the above operation, the SipPorts 12 and 36 up to the SIP server 30 are opened only for the subscriber terminal A.

  In FIG. 6, after the subscriber terminal A is registered (registered) in the SIP server 30 and the SipPorts 12 and 36 are opened by the operation of FIGS. 4 and 5, the SIP signal other than the register such as Invite is transmitted from the subscriber terminal A. It is a figure which shows the operation | movement which transmits. The subscriber terminal A is open to the SipPort 12, the subscriber accommodation router 20, and the SIP server 30 that are open to the terminal at the terminal accommodation position (physical port 01) of the subscriber accommodation switch 10. The SIP signal such as Invite is sent to the SIP server via the SipPort 36.

  FIG. 7 is a diagram illustrating an operation in a case where a malicious subscriber terminal B (attacker) impersonates a valid subscriber terminal A.

  In the illustrated example, a legitimate subscriber terminal A (IP address: A, telephone number: α) is connected to the accommodation position of the physical port 01 of the subscriber accommodation switch 10. 4 and 5, the SipPort 12 of the physical port 01 of the subscriber accommodation switch 10 is opened to the subscriber terminal A (that is, only the SIP signal of the originating IP address: A is opened). ing).

  Further, the malicious subscriber terminal B (IP address: B, telephone number: β) is connected to the accommodation position of the physical port 02 of the subscriber accommodation switch 10. 4 and FIG. 5, the SipPort 14 of the physical port 02 of the subscriber accommodation switch 10 is opened to the subscriber terminal B (that is, the SIP of the originating IP address: B) Only open for signals).

  The SipPort 36 of the SIP server 30 is opened to the subscriber terminal A and the subscriber terminal B when the subscriber terminal A and the subscriber terminal B transmit Register signals, respectively (that is, the originating IP address: It is open only for SIP signals of A and calling phone number: α and calling IP address: B and calling phone number: β).

  In the state where the subscriber terminal A and the subscriber terminal B are registered in the SIP server 30 as described above, if the malicious subscriber terminal B spoofs the SIP signal of the legitimate subscriber terminal A, As a pattern, both the “calling IP address” and the “calling phone number” are disguised (pattern 1), or only the “calling phone number” is camouflaged (pattern 2). Attacks can be deterred.

  In <Pattern 1>, the subscriber accommodation switch 10 suppresses the attack of the subscriber terminal B. The malicious subscriber terminal B transmits a SIP signal in which the calling telephone number and the calling IP address are disguised. In the example shown in the figure, a BYE signal spoofing the calling telephone number: α and the calling IP address: A of the subscriber terminal A is transmitted (S31). Since the subscriber terminal B is connected to the physical port 02 of the subscriber accommodation switch 10, the SIP signal transmitted from the subscriber terminal B is accepted by the SipPort 14 of the physical port 02.

  However, it is only the SipPort 12 of the physical port 01 that accommodates the subscriber terminal A that the subscriber accommodation switch 10 opens the SipPort to the IP address: A of the subscriber terminal A, and the physical port The SipPort 14 of 02 is not open to the source IP address: A. Accordingly, when the SIP port 14 of the physical port 02 of the subscriber accommodation switch 10 receives the SIP signal of the originating IP address: A transmitted from the subscriber terminal B, the SIP signal is discarded. Thereby, the attack of the malicious subscriber terminal B can be suppressed.

  In <Pattern 2>, the SIP server 30 suppresses the attack of the subscriber terminal B. The malicious subscriber terminal B transmits a SIP signal in which the calling telephone number is disguised. In the example shown in the figure, a BYE signal in which the calling terminal number: α of the subscriber terminal A is disguised and its own calling IP address: B is set is transmitted (S32). Since the subscriber terminal B is connected to the physical port 02 of the subscriber accommodation switch 10, the SIP signal transmitted from the subscriber terminal B is accepted by the SipPort 14 of the physical port 02. Since the subscriber accommodation switch 10 is open to the SIP signal of the originating IP address: B at the SipPort 14 of the physical port 02, the SipPort 14 of the physical port 02 passes the SIP signal, and the subscriber accommodation switch 10 The SIP signal is received. Then, the subscriber accommodation switch 10 transmits the received SIP signal from the subscriber terminal B to the SIP server 30 via the subscriber accommodation router 20 (S33).

  The SIP signals opened by the SipPort 36 of the SIP server 30 are only the SIP signals of the calling IP address: A and the calling phone number: α and the calling IP address: B and the calling phone number: β. Accordingly, when the SIP port 36 of the SIP server 30 receives the SIP signal of the calling IP address: B and the calling phone number: α transmitted from the subscriber terminal B, the SIP signal is discarded. Thereby, the attack of the malicious subscriber terminal B can be suppressed.

  As described above, in the present embodiment, attacks of pattern 1 and pattern 2 can be suppressed. Even if the malicious subscriber terminal B spoofs a password eavesdropped / deciphered from the communication of the legitimate subscriber terminal A in addition to the originating IP address and calling telephone number, the attack is performed as described above. Can be deterred.

  Next, the detailed operation of this embodiment will be described.

  FIG. 8 is a sequence diagram showing a detailed operation of the present embodiment.

  First, in the initial setting, the SIP server 30 sets a reception port number (reception UDS port number) for each SIP signal type. In the illustrated example, 49152 is set as the reception port number of the Register signal, and 5060 is set as the reception port number of the SIP signal other than the Register signal.

  Then, the SIP server 30 performs filtering using the reception port number for the SIP signal received from the subscriber terminal. That is, the reception port (RegPort) of the reception port number: 49152 is always open. For the receiving port (SipPort) of the receiving port number: 5060, the opening / closing operation is performed for each IP address and telephone number of the subscriber terminal. The opening / closing operation timing is triggered by the authentication of the subscriber terminal by the Register signal as shown in the sequence shown in FIG. Note that the SIP signal addressed to the subscriber terminal is not filtered.

  Further, the subscriber accommodation switch 10 performs filtering using the reception port number for the SIP signal received from the subscriber terminal. That is, the reception port (RegPort) of the reception port number: 49152 (for Register signal) is always open. Receiving port number: 5060 (for SIP signals other than Register) The receiving port (SipPort) is opened / closed in units of physical ports (subscriber accommodating ports). The opening / closing operation timing follows the instruction from the SIP server 30. Note that the SIP signal addressed to the subscriber terminal is not filtered.

  Hereinafter, authentication and filtering operations for the subscriber terminal A will be described. The subscriber terminal A is accommodated in the physical port 01 of the subscriber accommodation switch 10 and has an IP address A and a telephone number α.

  Further, in a state before the subscriber terminal A is registered in the SIP server 30, the reception port (RegPort) of 49152 of the physical port 01 of the subscriber accommodation switch 10 is opened, and the reception port (SipPort) of 5060 is closed. ing. In the open / closed state of the reception port for the SIP signal with the IP address: A and telephone number: α of the SIP server 30, the reception port (RegPort) of 49152 is open and the reception port (SipPort) of 5060 is closed.

  In this state, the subscriber terminal A transmits a Register signal to the SIP server 30 via the subscriber accommodation switch 10 and the subscriber accommodation router 20 (S41). In the Register signal, the calling terminal IP address: A and the calling telephone number: α of the subscriber terminal A are set. The Register signal is transmitted via a reception port (RegPort) of 49152 in which the subscriber accommodation switch 10 and the SIP server 30 are always open.

  Upon receiving the Register signal, the SIP server 30 transmits a request signal (challenge) for requesting a password to the subscriber terminal A (S42).

  When the subscriber terminal A receives the password request signal, the subscriber terminal A transmits a Register signal in which a one-time password is set to the SIP server 30 (S43). For a one-time password, for example, the subscriber has a one-time password generator (terminal), and when the generator generates and displays the displayed one-time password and transmits a Register signal (terminal When registering, the one-time password is input to the subscriber terminal A. Alternatively, the subscriber terminal A has a one-time password generation function, and when the register signal is transmitted, the one-time password is automatically generated, set in the register signal, and transmitted. The one-time password generator or the one-time password generation function is time-synchronized with the one-time password generated by the authentication unit 32 of the SIP server 30. That is, the one-time password generated at a certain time matches the one-time password generated by the subscriber terminal A and the one-time password generated by the SIP server 30.

  When receiving the Register signal including the one-time password, the SIP server 30 performs authentication (digest authentication) of the subscriber terminal A (S44). Specifically, the authentication unit 32 of the SIP server generates a one-time password for the subscriber terminal A (IP address: A, telephone number: α) using the same algorithm as that on the subscriber terminal A side. The time password is compared with the one-time password included in the Register signal. If they match, it is determined that the authentication is successful, and the subscriber terminal A is registered. If they do not match, it is determined that the authentication has failed.

  If it is determined that the authentication is successful, the SIP server 30 opens the 5060 reception port (SipPort) for the SIP signal of the calling IP address: A and the calling phone number: α (S45). As a result, the receiving port (SipPort) 5060 of the SIP server 30 discards the SIP signal when receiving a SIP signal other than the originating IP address: A and the originating telephone number: α. Therefore, the SIP signals other than Register received by the SIP server 30 are only when the calling IP address is A and the calling phone number is α.

  Then, the SIP server 30 instructs the subscriber accommodation switch 10 to open the 5060 reception port (SipPort) at the accommodation position (physical port) accommodating the subscriber terminal A having the IP address: A (S46). . When the subscriber accommodation switch 10 receives an instruction from the SIP server 30, the physical port 01 at the accommodation position of the IP address: A sets the 5060 reception port (SipPort) only for the SIP signal of the source IP address: A. Open (S47). As a result, when a receiving port (SipPort) 5060 of the physical port 01 of the subscriber accommodation switch 10 accepts a SIP signal other than the originating IP address: A, the SIP signal is discarded. Therefore, the SIP signal other than the register received by the subscriber accommodation switch 10 at the physical port 01 is only in the case of the originating IP address: A.

  As described above, when the registration of the subscriber terminal A to the SIP server 30 is completed, the subscriber terminal A transmits a SIP signal such as an Invite signal to the SIP server 30 via the 5060 reception port (SipPort), and performs communication. I do.

  As described above, when the Register signal is transmitted (when the subscriber terminal is registered), the SIP server 30 and the 5060 reception port (SipPort) of the subscriber accommodation switch 10 are limited to the registered subscriber terminal A in S45 to S47. By opening up the network, attacks from malicious subscriber terminals can be prevented.

  Specifically, the IP address of the subscriber terminal A is prevented from being spoofed by S47. That is, the subscriber accommodation switch 10 prevents an attack in which a malicious third party terminal accommodated in another physical port spoofs the IP address of the subscriber terminal A and transmits a SIP signal to the SIP server 30. be able to.

  Further, S45 prevents the telephone number of subscriber terminal A from being spoofed. In other words, the third party terminal having an IP address different from the IP address: A of the subscriber terminal A is attacked by the SIP server 30 by spoofing the telephone number of the subscriber terminal A and transmitting a SIP signal to the SIP server 30. Can be prevented.

  Therefore, only the subscriber terminal A can transmit the SIP signal of the calling telephone number α to the SIP server 30, and a third party terminal other than the subscriber terminal A can impersonate the subscriber terminal A. Therefore, the communication of the subscriber terminal A cannot be interrupted.

  After the communication is completed, the subscriber terminal A transmits a registration deletion Register signal to the SIP server 30 via the reception port (RegPort) 49152 (S51). This Register signal includes a one-time password. Upon receiving the Register signal including the one-time password, the SIP server 30 performs authentication (digest authentication) of the subscriber terminal A, and when the authentication is successful (when the one-time password matches), Logout is performed (S52). Then, the SIP server 30 closes the receiving port (SipPort) of 5060 for the SIP signal (originating IP address: A and calling telephone number: α) of the subscriber terminal A (S53). As a result, the receiving port (SipPort) 5060 of the SIP server 30 discards the SIP signal when receiving the SIP signal with the calling IP address: A and the calling phone number: α.

  Then, the SIP server 30 instructs the subscriber accommodation switch 10 to close the reception port (SipPort) of 5060 at the accommodation position in which the subscriber terminal A having the IP address: A is accommodated (S54). Upon receiving an instruction from the SIP server 30, the subscriber accommodation switch 10 closes the 5060 reception port (SipPort) with respect to the SIP signal of the originating IP address: A at the physical port 01 at the accommodation location of the IP address: A. (S54). As a result, the receiving port (SipPort) 5060 of the physical port 01 of the subscriber accommodation switch 10 discards the SIP signal when receiving the SIP signal of the originating IP address: A.

  In the embodiment described above, the SIP server and the subscriber accommodation switch cooperate to authenticate the subscriber terminal using a dynamic line authentication method. More specifically, the SIP server limits the authentication for identifying the subscriber terminal to only the Register, and dynamically allocates the accommodation line of the subscriber terminal as a dedicated line for each authentication. As a result, it is possible to suppress the misrepresentation of a subscriber terminal by a malicious third party in a service that allows the subscriber to freely select the installation location of the terminal without increasing the processing load on the subscriber terminal and the SIP server. .

  In this embodiment, the strength of authentication is increased by using a one-time password. However, since the authentication target is only a Register signal, the one-time password update timing is low, and processing to the subscriber terminal and the SIP server is performed. The load can be reduced.

  In addition, the subscriber terminal's accommodation line is identified by the Register signal, and filtering is performed on the identified line each time. Therefore, the subscriber terminal's accommodation line is not fixed, and the subscriber can freely install the terminal. You can choose.

  In addition, this invention is not limited to the said embodiment, Many deformation | transformation are possible within the range of the summary.

10: Subscriber accommodation switch 11: Reception port (RegPort)
12: Receive port (SipPort)
20: Subscriber accommodating router 30: SIP server 31: Setting unit 32: Authentication unit 33: Control unit 34: Call processing unit 35: Reception port (RegPort)
36: Receive port (SipPort)
A, B: Subscriber terminal

Claims (8)

A communication system comprising a SIP server and a subscriber accommodation device,
The SIP server is
Setting means for setting the receiving port separately for the register signal and the SIP signal other than the register,
An authentication means for authenticating a one-time password included in the register signal upon receiving the register signal from the subscriber terminal via the register signal receiving port;
When the authentication is successful, the SIP signal receiving port other than the register is opened for the SIP signal of the calling address and the calling telephone number of the subscriber terminal, and the SIP signal of the calling address of the subscriber terminal is opened. Control means for transmitting an instruction to open the SIP signal receiving port other than the register of the subscriber accommodation device to the subscriber accommodation device;
The subscriber accommodation device is:
A communication system, wherein a SIP signal receiving port other than a register is opened for a SIP signal of the calling address at a receiving position where a subscriber terminal of the calling address specified by the SIP server is stored. The communication system according to claim 1,
The SIP signal receiving port other than the register of the SIP server discards the SIP signal when receiving a SIP signal other than the calling address and the calling telephone number opened by the control means. The communication system according to claim 1 or 2, wherein
When the SIP signal receiving port other than the register at the accommodation position where the subscriber terminal of the subscriber accommodation device is accommodated receives a SIP signal other than the originating address opened by the release means, the SIP signal is discarded. A communication system characterized by: The communication system according to any one of claims 1 to 3,
The register signal receiving port of the SIP server and the subscriber accommodation device is open to all register signals. Setting means for setting the receiving port separately for the register signal and the SIP signal other than the register,
An authentication means for authenticating a one-time password included in the register signal upon receiving the register signal from the subscriber terminal via the register signal receiving port;
When the authentication is successful, the SIP signal receiving port other than the register is opened for the SIP signal of the calling address and the calling telephone number of the subscriber terminal, and the SIP signal of the calling address of the subscriber terminal is opened. A SIP server comprising: control means for transmitting to the subscriber accommodation device an instruction to open a SIP signal reception port other than the register of the subscriber accommodation device. An authentication method performed by a communication system including a SIP server and a subscriber accommodation device,
The SIP server is
A setting step for setting a receiving port separately for a register signal and a non-register SIP signal;
When receiving a register signal from the subscriber terminal via the register signal receiving port, an authentication step of authenticating the one-time password included in the register signal;
When the authentication is successful, the SIP signal receiving port other than the register is opened for the SIP signal of the calling address and the calling telephone number of the subscriber terminal, and the SIP signal of the calling address of the subscriber terminal is opened. A control step of transmitting an instruction to open the SIP signal receiving port other than the register of the subscriber accommodation device to the subscriber accommodation device, and
The subscriber accommodation device is:
A release step of releasing the SIP signal reception port other than the register from the SIP signal of the calling address at a holding position where the subscriber terminal of the calling address specified by the SIP server is stored; Authentication method. The authentication method according to claim 6, wherein:
The SIP signal receiving port other than the SIP server register discards the SIP signal when it receives a SIP signal other than the calling address and the calling telephone number released by the control step. The authentication method according to claim 6 or 7, wherein
When the SIP signal receiving port other than the register at the accommodation position where the subscriber terminal of the subscriber accommodation device is accommodated receives a SIP signal other than the originating address opened by the release step, the SIP signal is discarded. An authentication method characterized by

Images