JP2015180109A - Gateway device with personal authentication function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a gateway device for constituting a radio relay system, capable of preventing masquerade by an illegal communication terminal having a camouflaged MAC address or a camouflaged identification address.SOLUTION: A radio relay system includes: a plurality of radio relay devices 3 for relaying in a multi-hop manner; a communication terminal 2 connected to the radio relay device 3; and a gateway device 1 for relaying communication data with a shopping server 7 which is a communication destination designated by the communication terminal 2. In the radio relay system, a substitutive authentication request command transmitted from the communication terminal 2 is relayed by the radio relay device 3, and the communication terminal 2 is authenticated by collating route information, through which the substitutive authentication request command passes before received by the gateway device 1, with route information stored beforehand in the gateway device 1.

Description

The present invention relates to a gateway device that constitutes a wireless relay system that constitutes a wireless relay network that relays data in a multi-hop manner between a plurality of wireless relay devices.

  2. Description of the Related Art Conventionally, as a technique for preventing unauthorized use of a communication terminal in network access, when a connection request is issued from an unauthenticated identification address by authenticating the identification address of the communication terminal using IEEE 802.1X, Japanese Patent Application Laid-Open No. H10-228707 discloses a method for determining that the connection is not made to the network.

  In addition, as a technique for detecting unauthorized use of an IP telephone line in an IP telephone service, a MAC address that is acquired from a relay device that is specified from the IP address of the IP telephone adapter and a user ID and registered in advance in a verification server Patent Document 2 discloses a technique for preventing unauthorized use by comparing with.

JP 2008-278134 A JP 2006-217194 A

  However, in the above-mentioned Patent Documents 1 and 2, the communication terminal identification address or the MAC address of the IP telephone adapter is compared with the authorized identification terminal or MAC address registered in advance to determine whether the communication terminal is an authenticated communication terminal. It is only judging whether or not. Therefore, if an unauthorized communication terminal impersonates its own identification address or MAC address and the connection is made by impersonating the authenticated identification address or MAC address, the unauthorized communication terminal is denied access. There was a problem that could not.

An object of the present invention is to route a relay destination of a plurality of stages of wireless relay devices between predetermined gateway information and gateways that perform Internet access using predetermined bypass route instruction information, and to perform wireless communication with predetermined bypass route instruction information. A gateway that constitutes a wireless relay system capable of preventing spoofing by an unauthorized communication terminal with a MAC address or identification address impersonated by collating with the route information relayed by the relay device and authenticating the communication terminal To provide an apparatus .

In order to solve the above problems, the present invention provides a plurality of wireless relay devices that relay meter-reading data transmitted from a meter-reading device in a multi-hop manner, one or more communication terminals connected to the wireless relay device, and the wireless a the gateway device configuring the radio relay system including a gateway device for relaying communication data between the communication destination transfer destination or the communication terminal of the meter reading data to the relay apparatus specifies, prior Symbol communication terminal Detour route instruction information storage means for storing predetermined detour route instruction information corresponding to each of the detour route instruction information, and detour route instruction information corresponding to each of the communication terminals stored in the detour route instruction information storage means Via a detour route instruction information transmitting means for transmitting to a communication terminal and one or more of the wireless relay devices to a predetermined communication destination requiring authentication from one of the communication terminals Authentication data proxy transmitting means for transmitting authentication data for authenticating the communication terminal; proxy authentication request command receiving means for receiving a proxy authentication request command for requesting proxy transmission of authentication data from any of the communication terminals; Route information receiving means for receiving route information of one or more of the wireless relay devices through which the received proxy authentication request command has passed from any of the wireless relay devices, and from any of the communication terminals, When the proxy authentication request command is received, the authentication data proxy transmission means stores the path information of one or more wireless relay devices through which the proxy authentication request command received by the path information reception means passes through the bypass path instruction information It is determined whether or not it matches the route information corresponding to the communication terminal stored in the means. Authentication data for authenticating the communication terminal to the predetermined communication destination requested by the request command, and for authenticating the communication terminal to the predetermined communication destination requested by the proxy authentication request command if it is determined that they do not match the characterized the transmission Shinano Ikoto.

  According to the present invention, it is possible to prevent spoofing by an unauthorized communication terminal in which a MAC address or an identification address is disguised.

Network configuration diagram in the wireless relay system of the present invention Block configuration diagram of a gateway device, a communication terminal, and a wireless relay device in the wireless relay system of the present invention Relay destination information table in the wireless relay system of the present invention Detour route instruction information table in wireless relay system of the present invention Operation flowchart of gateway apparatus in wireless relay system of the present invention Operation flowchart of communication terminal in wireless relay system of the present invention Operation flowchart of radio relay apparatus in radio relay system of the present invention

  Hereinafter, as an example of an embodiment of the present invention, when Internet shopping is performed, access to a shopping server is performed using a wireless relay system that relays data in a multi-hop manner to which a communication terminal owned by a user is connected. The method to perform is demonstrated.

  FIG. 1 is a network configuration diagram in the wireless relay system of the present invention. The wireless relay system of the present invention includes a gateway device 1, a communication terminal 2, a wireless relay device 3, a meter reading device 4, and a meter reading server 5, and communicates with a shopping server 7 via the Internet 6.

  First, an operation when no detour route instruction information is stored between the communication terminal 2-1 and the gateway device 1 will be described. When the wireless relay device 3-1 is installed in the wireless relay system, the meter reading device 4-1 locally connected to the wireless relay device 3-1 relays the meter reading data by relaying the wireless relay devices 3-1 and 3-2. Transmit to the gateway device 1. The gateway device 1 reads the ID of the transmission source wireless relay device 3-1 (hereinafter referred to as relay device ID) from the meter reading data, generates detour route instruction information, and is a communication terminal locally connected to the wireless relay device 3-1. Send to 2-1 The communication terminal 2-1 stores the received detour route instruction information.

  It should be noted that the route through which the meter reading data is relayed is not designated in advance so as to relay the wireless relay devices 3-1 and 3-2. It can be done.

  Next, a case where the communication terminal 2-1 transmits a proxy authentication request command and the gateway device 1 transmits authentication data to the shopping server 7 will be described. When the communication terminal 2-1 accesses the shopping server 7 that requires authentication, it sends the proxy authentication request command with the stored detour route instruction information. The wireless relay device 3-1 extracts the detour route instruction information from the proxy authentication request command, and assigns the proxy authentication request command to the next-stage radio relay device 3-6 according to the detour route instruction information, and the relay device ID of the own wireless relay device. And relay. Here, it is assumed that the detour route instruction information indicates a route that reaches the gateway device 1 via the wireless relay devices 3-1, 3-6, 3-5, and 3-3.

  The gateway device 1 indicates a route through which the proxy authentication request command that is the relay device ID of the wireless relay devices 3-1, 3-6, 3-5, and 3-3 actually passes from the received proxy authentication request command. The information is read out and collated with the stored detour route instruction information. Authentication data for authenticating the communication terminal 2-1 is transmitted to the shopping server 7 via the Internet 6 only when the collated route information matches the stored detour route instruction information. The authentication data indicates the user ID and password of the user who uses the communication terminal, which is necessary for accessing the shopping server.

  FIG. 2 is a block configuration diagram of the gateway device 1, the communication terminal 2, and the wireless relay device 3 in the wireless relay system of the present invention. The gateway device 1 includes a wireless transmission / reception unit 101, a data identification unit 102, a route information extraction unit 103, a relay device ID extraction unit 104, a control unit 105, a meter reading data transmission unit 106, and a detour route instruction information generation unit. 107, a relay destination information storage unit 108, a detour route instruction information storage unit 109, a route information verification unit 110, an authentication data storage unit 111, and a communication destination transmission unit 112. The operation of each block will be described below.

  The wireless transmission / reception unit 101 performs wireless communication with the wireless relay device 3, receives meter reading data and proxy authentication request command, and transmits detour route instruction information received from the control unit 105.

  The data identification unit 102 identifies the data received from the wireless transmission / reception unit 101 as a proxy authentication request command and meter reading data. If the command is a proxy authentication request command, the data is passed to the path information extraction unit 103. Data is passed to the ID extraction unit 104.

  The route information extraction unit 103 extracts the route information given to the proxy authentication request command received from the data identification unit 102 and passes the proxy authentication request command and the route information to the control unit 105.

  The relay device ID extraction unit 104 extracts the relay device ID included in the meter reading data received from the data identification unit 102, and passes the meter reading data and the relay device ID to the control unit 105.

  The control unit 105 controls each block of the gateway device 1.

  The meter reading data transmission unit 106 receives meter reading data from the control unit 105 and transmits it to the meter reading server 5.

  The detour route instruction information generation unit 107 receives a detour route instruction information generation instruction from the control unit 105, and generates detour route instruction information based on the relay destination information in the relay destination information storage unit 108.

  The relay destination information storage unit 108 stores the relay destination of each wireless relay device 3 in advance, receives the relay destination information transmission instruction of the detour route instruction information generation unit 107, and passes the relay destination information to the detour route instruction information generation unit 107. .

  The detour route instruction information storage unit 109 stores the detour route instruction information generated by the detour route instruction information generation unit 107. In response to the transmission request for the detour route instruction information from the control unit 105, the detour route instruction information is passed to the control unit 105. In response to a request to send detour route instruction information from the route information matching unit 110, the detour route instruction information is passed to the route information matching unit 110.

  The route information collation unit 110 receives a collation instruction between the route information extracted from the proxy authentication request command from the control unit 105 and the detour route instruction information stored in the detour route instruction information storage unit 109, and receives the detour route instruction information storage unit 109. The detour route instruction information transmission request is passed, the detour route instruction information is received, the route information extracted from the proxy authentication request command is compared with the detour route instruction information stored in the detour route instruction information storage unit 109, The result is passed to the control unit 105.

  The authentication data storage unit 111 stores authentication data of a user who uses the communication terminal 2 for the shopping server 7, receives an authentication data transmission request from the communication destination transmission unit 112, and passes the authentication data to the communication destination transmission unit 112.

  The communication destination transmission unit 112 transmits authentication data to the shopping server 7 via the Internet 6.

  The communication terminal 2 includes a wireless relay device local communication unit 201, a control unit 202, and a detour route instruction information storage unit 203.

  The wireless relay device local communication unit 201 performs local communication with the wireless relay device 3, receives detour route instruction information, passes it to the control unit 202, and transmits the proxy authentication request command received from the control unit 202.

  The control unit 202 controls each block of the communication terminal 2.

  The detour route instruction information storage unit 203 stores the detour route instruction information received from the control unit 202, and passes the detour route instruction information to the control unit 202 when transmitting a proxy authentication request command.

  The wireless relay device 3 includes a wireless transmission / reception unit 301, a data identification unit 302, a detour route instruction information extraction unit 303, a control unit 304, a relay device ID assignment unit 305, a relay device ID storage unit 306, and a communication terminal. The local communication unit 307 and the meter reading device local communication unit 308 are configured.

  The wireless transmission / reception unit 301 performs wireless communication with the gateway device 1 or the wireless relay device 3 to transmit / receive meter-reading data, proxy authentication request command, and detour route instruction information.

  The data identification unit 302 identifies the data received from the wireless transmission / reception unit 301 as a proxy authentication request command and meter reading data. If the command is a proxy authentication request command, the data identification unit 302 passes the data to the detour route instruction information extraction unit 303. Data is passed to the control unit 304.

  The detour route instruction information extraction unit 303 extracts detour route instruction information given to the proxy authentication request command received from the data identification unit 302 or the communication terminal local communication unit 307, and sends the proxy authentication request command and detour to the control unit 304. Pass the routing information.

  The control unit 304 controls each block of the wireless relay device 3.

  The relay device ID assigning unit 305 receives the proxy authentication request command from the control unit 304, passes the relay device ID transmission request to the relay device ID storage unit 306, receives the relay device ID, and uses the relay device ID as the proxy authentication request command. Assigned to the control unit 304.

  The relay device ID storage unit 306 stores the relay device ID of the own wireless relay device 3, receives a relay device ID transmission request from the relay device ID assigning unit 305, and passes the relay device ID to the relay device ID assigning unit 305.

  The communication terminal local communication unit 307 performs local communication with the communication terminal 2, receives the proxy authentication request command, passes it to the detour route instruction information extraction unit 303, and transmits the detour route instruction information received from the control unit 304.

  The meter reading device local communication unit 308 performs local communication with the meter reading device 4, receives meter reading data, and passes it to the control unit 304.

  FIG. 3 is a relay destination information table in the wireless relay system of the present invention, and is stored in the relay destination information storage unit 108. The relay destination information table 400 includes a relay device ID of each wireless relay device 3 constituting the wireless relay system in a column 401, and a wireless relay that is a relay destination in which each wireless relay device 3 can relay data in a column 402. The relay device ID of the device 3 is stored. The gateway device 1 creates detour route instruction information based on the information stored in the relay destination information table 400.

  FIG. 4 is a detour route instruction information table in the wireless relay system of the present invention, and is stored in the detour route instruction information storage unit 109. The detour route instruction information table 500 includes the relay device ID of each wireless relay device 3 constituting the wireless relay system in column 501 and the detour route instruction information corresponding to the relay device ID in column 502. The relay device ID is stored for each stage number.

  FIG. 5 is an operation flowchart of the gateway device 1 in the wireless relay system of the present invention. Hereinafter, the operation of the gateway device 1 will be described with reference to FIGS. 1, 2, 3, and 4.

  This flow starts when the gateway device 1 is powered on (S100). When the wireless transmission / reception unit 101 receives data from the preceding wireless relay device 3 (S101), the data identification unit 102 identifies whether the received data is a proxy authentication request command (S102). If it is not a proxy authentication request command (S102, No), that is, in the case of meter reading data, the relay ID extraction unit 104 extracts the relay device ID of the wireless relay device 3 that is the relay source from the received meter reading data (S103).

  Next, it is determined whether or not the detour route instruction information corresponding to the extracted relay device ID is stored in the detour route information storage unit 109, and if the detour route instruction information is stored (Yes in S104). Then, the meter reading data transmission unit 106 transmits the meter reading data to the meter reading server 5, and the flow is finished (S105).

  If the detour route instruction information corresponding to the relay device ID extracted in S103 is not stored (S104, No), the meter reading data transmission unit 106 transmits meter reading data to the meter reading server 5 (S106), and the detour route. The instruction information generation unit 107 generates detour route instruction information based on the relay destination information table 400 shown in FIG. 3 stored in the relay destination information storage unit 108 (S107), and detours the generated detour route instruction information. It memorize | stores in the route instruction information storage part 109 (S108). Next, the generated detour route instruction information is transmitted to the communication terminal 2 locally connected to the wireless relay device 3 having the relay device ID extracted in S103 (S109), and the flow ends.

  If the data received by the wireless transmission / reception unit 101 in S102 is a proxy authentication request command (S102, Yes), the route information attached to the proxy authentication request command is extracted by the route information extraction unit 103 (S110). The route information collating unit 110 collates the extracted route information with the detour route instruction information stored in the detour route instruction information table 500 shown in FIG. 4 stored in the detour route instruction information storage unit 109 ( S111).

  When it is determined that the route information verified in S111 matches (S112, Yes), the communication destination transmission unit 112 transmits the authentication data stored in the authentication data storage unit 111 to the shopping server 7 (S113). An authentication data transmission completion message indicating that the transmission of authentication data has been completed to the server 7 is transmitted to the corresponding communication terminal 2 (S114), and the flow ends. Note that the notification method of the authentication data transmission completion message transmitted in S114 is assumed to be a text message or the like. However, as long as the notification method is within a range in which the user can notify that the authentication data has been transmitted, It may be something like this.

  If it is determined that the route information collated in S111 does not match (S112, No), it is determined that the route differs from the detour route instruction information instructed by the gateway device 1, and the authentication data cannot be transmitted. Is sent to the communication terminal 2 (S115), and the flow ends.

  Note that the notification method of the authentication data transmission completion message transmitted in S115 is assumed to be a text message or the like, but the notification method is within a range in which the user can be notified that the authentication data cannot be transmitted. Anything can be used. Further, for simplification, it is assumed that the transmission impossible message is transmitted in S115 and the flow is ended. However, a message for prompting retransmission to the communication terminal 2 may be transmitted.

  FIG. 6 is an operation flowchart of the communication terminal in the wireless relay system of the present invention. Hereinafter, the operation flow of the communication terminal 2 will be described with reference to FIG.

  This flow starts when the communication terminal 2 is powered on (S200). When the detour route instruction information is received from the gateway device 1 (S201, Yes), the detour route instruction information is stored in the detour route instruction information storage unit 203 (S202), and the flow ends.

  Next, when the detour route instruction information is not received from the gateway device 1 (S201, No), the communication terminal 2 waits until receiving a proxy authentication request command transmission instruction (S203, No). When the proxy authentication request command transmission instruction is received (S203, Yes), it is determined whether or not the detour path instruction information is stored in the detour path information storage unit 203 (S204).

  When the detour route instruction information is stored (S204, Yes), the detour route instruction information is added to the proxy authentication request command (S205), and the proxy authentication request command is transmitted to the wireless relay device 3 (S206). Next, a message to notify whether or not the authentication data can be transmitted is received from the gateway device 1 (S207), and the flow ends. For the sake of simplification, in S207, a message notifying whether or not authentication data can be transmitted is received and the flow is terminated. However, a message prompting retransmission is received from the gateway device 1, and the process returns to S203. You may make it return.

  If the detour route instruction information is not stored (S204, No), the transmission of the proxy authentication request command is stopped (S208), and the flow ends.

  FIG. 7 is an operation flowchart of the wireless relay device in the wireless relay system of the present invention. Hereinafter, the operation flow of the wireless relay device 3 will be described with reference to FIGS.

  This flow starts when the wireless relay device 3 is powered on (S300). When the wireless transmission / reception unit 301 receives data (S301, Yes), the data identification unit 302 identifies whether the received data is a proxy authentication request command (S302).

  When the received data is a proxy authentication request command (S302, Yes), or when the wireless transmission / reception unit 301 does not receive data (S301, No) and the communication terminal local communication unit 307 receives data (S303, Yes) ), The detour route instruction information extraction unit 303 extracts detour route instruction information from the proxy authentication request command (S304).

  Next, the relay device ID assigning unit 305 assigns the relay device ID of the own wireless relay device stored in advance in the relay device ID storage unit 306 to the proxy authentication request command (S305), and the detour route instruction information extracted in S304. Accordingly, a proxy authentication request command is transmitted to the next relay destination (S306), and the flow is terminated.

  If the received data is not a proxy authentication request command (S302, No), that is, if it is meter reading data, the meter reading data is transmitted to the wireless relay device 3 or gateway device 1 at the next stage (S307), End the flow.

  When the wireless transmission / reception unit 301 does not receive data (S301, No) and the communication terminal local communication unit 307 does not receive data (S303, No), that is, when the meter reading device local communication unit 308 receives meter reading data, Data is transmitted to the wireless relay device 3 or the gateway device 1 which is the next relay destination of the meter reading data transmission path (S308), and the flow ends.

DESCRIPTION OF SYMBOLS 1 ... Gateway apparatus 2 ... Communication terminal 3 ... Wireless relay apparatus 4 ... Meter-reading apparatus 5 ... Meter-reading server 6 ... Internet 7 ... Shopping server 101, 301 ... Wireless transmission / reception Units 102, 302 ... data identification unit 103 ... route information extraction unit 104 ... relay device ID extraction unit 105, 202, 304 ... control unit 106 ... meter reading data transmission unit 107 ... detour Route instruction information generation unit 108 ... Relay destination information storage units 109 and 203 ... Detour route instruction information storage unit 110 ... Path information collation unit 111 ... Authentication data storage unit 112 ... Communication destination transmission unit 201: wireless relay device local connection unit 303 ... detour route instruction information extraction unit 305 ... relay device ID assigning unit 306 ... relay device ID storage unit 307 ... communication terminal local communication unit 08 ... meter reading device local communication unit

Claims (1)

A plurality of wireless relay devices that relay the meter reading data transmitted from the meter-reading device in a multi-hop manner, one or more communication terminals connected to the wireless relay device, the wireless relay device and the transfer destination of the meter-reading data, or the The gateway device constituting a wireless relay system comprising a gateway device that relays communication data with a communication destination designated by a communication terminal,
And a predetermined bypass path detour route instruction information stored beforehand instruction information storing means corresponding to each of the previous SL communication terminal, bypassing corresponding to each of said communication terminal stored in the detour routing information storing means Authentication for authenticating the communication terminal to a predetermined communication destination that requires authentication from one of the communication terminals via one or more of the wireless relay devices, and detour route instruction information transmitting means for transmitting the route instruction information to the communication terminal Authentication data proxy transmission means for transmitting data on behalf of the user, proxy authentication request command reception means for receiving a proxy authentication request command for requesting proxy transmission of authentication data from any of the communication terminals, and the received proxy authentication request Route information receiving means for receiving route information of one or more of the wireless relay devices through which a command has passed from any of the wireless relay devices;
When the proxy authentication request command is received from any of the communication terminals, the authentication data proxy transmission means transmits the path of one or more wireless relay devices through which the proxy authentication request command received by the path information reception means passes It is determined whether or not the information matches the route information corresponding to the communication terminal stored in the bypass route instruction information storage means, and if it is determined to match, the predetermined communication destination requested by the proxy authentication request command the communication terminal sends the authentication data to authenticate to a feature transmission Shinano Ikoto authentication data if it is determined that they do not match to a predetermined destination to which the proxy authentication request command requests to authenticate the communication terminal Gateway device.

Images