JP4483632B2 - Mobile communication system and mobile communication method - Google Patents

Description

  The present invention relates to a mobile communication system and a mobile communication method having a home agent for transferring a communication packet to a mobile communication device connected to a foreign network, and more specifically, high security without requiring complicated maintenance and operation. The present invention relates to a mobile communication system and a mobile communication method.

FIG. 7 is a diagram showing a configuration of a conventional mobile communication system. 8 and 9 are diagrams showing configurations of the mobile communication device 10 and the home agent 20 shown in FIG.
7 to 9, a mobile communication device (hereinafter abbreviated as “device”) 10 can be carried and carried, and the subnetwork to be connected changes as the device 10 moves. The device 10 includes a memory 11, an address generation unit 12, and an authentication unit 13. The device 10 corresponds to communication protocol Mobile IPv6 (Internet Protocol Version 6), and has a mobile node function in a so-called mobile IP. In the memory 11, an identifier (for example, a serial number) for identifying the device 10 and a MAC (Media Access Control) address are stored in the device 10 in advance (for example, when the device 10 is manufactured or repaired). . The address generation unit 12 generates an IP address of the device 10 and stores it in the memory 11. The authentication unit 13 authenticates the communication partner node.

  The home network (Home Network) 100 is a subnetwork to which the device 10 is originally connected. The foreign network 200 is a subnetwork to which the device 10 that has moved from the home network 100 is actually connected.

  The home agent 20 includes a memory 21, a transfer unit 22, and an authentication unit 23. The home agent 20 operates on a node in the home network 100. When the device 10 is in the foreign network 200, the home agent 20 receives a communication packet addressed to the device 10. The transfer means 22 transfers the data to the device 10 with reference to the contents of the memory 21. The authentication unit 23 authenticates the communication partner node.

  The personal computer 30 is a transmission source node, and communicates with the device 10 by transmitting and receiving communication packets. The home network 100, the foreign network 200, and the personal computer 30 are connected by the Internet 300. In addition, each of the routers R1 and R2 is provided in the networks 100 and 200, and is connected to a node in the networks 100 and 200.

  The device 10 is assigned a home address and a care-of address. The home address is an address uniquely assigned to the device 10 without depending on the sub-network, and is the same network address as the home network 100. The care-of address is an address assigned by the foreign network 200.

The operation of such a system will be described.
First, the operation for registering the device 10 in the home agent 20 will be described.
A user activates the home agent 20 on a node having a home agent function on the home network 100 and installs the device 10 in the home network 100. The router R1 gives a prefix (corresponding to the network address of the home network 100) to the device 10. As a result, the address generation means 12 of the device 10 generates the home address of the device 10 from the MAC address stored in the memory 11 of the device 10 and the assigned prefix, and stores the home address in the memory 11. Further, the home address is stored in the memory 21 of the activated home agent 20. Then, a shared key generation unit (not shown) generates a first shared key and stores it in the memories 11 and 21 of the device 10 and the home agent 20, respectively.

  The user creates a list in which the serial number and home address of the device 10 are recorded on the personal computer 30 or the like in order to identify the device 10 from other devices.

Next, an operation of registering that the device 10 is installed in the foreign network 200 with the home agent 20 will be described.
The device 10 is installed in the foreign network 200. Then, the router R2 existing in the foreign network 200 gives a prefix (corresponding to the network address of the foreign network 200) to the device 10. Thereby, the address generation means 12 of the device 10 generates a care-of address of the own device 10 in the foreign network 200 from the MAC address stored in the memory 11 of the device 10 and the assigned prefix, and stores the care-of address in the memory 11. .

  Then, the device 10 transmits a communication packet including the care-of address to the home agent 20. At this time, the device 10 shows validity to the home agent 20 using the first shared key stored in the memory 11. The authentication means 13 and 23 of each of the device 10 and the home agent 20 authenticate with the first shared key. If the authentication is successful, the communication packet encrypted with the first shared key is transmitted and received, and the care-of address in the communication packet is stored in the memory 21, but the home address of the device 10 and the care-of address are associated with each other. Register in the memory 21.

Next, an operation of transmitting a communication packet from the personal computer 30 to the device 10 connected to the foreign network 200 will be described.
The user refers to the list, finds the home address of the device 10 from the identifier of the device 10, and inputs the home address of the device 10 into the personal computer 30. The personal computer 30 transmits a communication packet with the home address as the transmission destination. The home agent 20 takes this communication packet, knows the transfer destination of the communication packet from the correspondence between the home address in the memory 21 and the care-of address, and transmits the communication packet to the device 10 as the transfer address. As a result, the communication packet issued from the personal computer 30 reaches the foreign network device 10 and communication between the device 10 and the personal computer 30 is started.

Japanese Patent No. 3617952 Japanese Patent No. 3621917

  In this way, the user first identifies the destination device 10 from among a plurality of devices using an identifier (for example, a serial number) of the device 10. Therefore, it is necessary to separately manage a list describing the correspondence between the identifier of the device 10 and the home address. When accessing the device 10 from the personal computer 30, the home address of the device 10 is acquired by the identifier found from the list, and communication is performed using this home address.

  However, as the number of devices 10 increases, (1) it takes time to create a list, (2) there is a high possibility that an error will occur at the time of list creation, and (3) each time a communication with the device 10 is performed, a huge list is created. There is a problem that it takes time to search for the device 10 from the inside, and (4) when setting the home address obtained from the list in the personal computer 30, there is a high possibility that a setting error will occur.

  In addition, the home network 100 to which the device 10 belongs is often built by the user, and there is a problem that it takes time to operate, maintain, and manage the home network 100 and the home agent 20.

  Furthermore, there is a problem that communication with the device 10 is performed by a malicious third party who obtains the list.

  Accordingly, an object of the present invention is to realize a mobile communication system and a mobile communication method having high security without requiring complicated maintenance and operation.

The invention described in claim 1
In a mobile communication system having a home agent for transferring a communication packet to a mobile communication device connected to a foreign network,
Address management means for managing a plurality of IP addresses;
Address generating means for allocating any of the IP addresses managed by the address management means to the mobile communication device as a home address;
A memory device that associates a home address of the mobile communication device with an identifier of the mobile communication device, and stores each of the home address and the identifier ;
A transmission source node that transmits the communication packet with the home address of the memory device as a transmission destination, and the memory device is detachable from the transmission source node and is displayed on a browser of the transmission source node Storing screen information regarding the identifier of
The transmission source node refers to a home address corresponding to the identifier selected by the screen information from the memory device .

The invention according to claim 2 is the invention according to claim 1,
The address management means manages the address block.
The invention according to claim 3 is the invention according to claim 1 or 2,
The home agent and the mobile communication device share the first key,
The memory device and the mobile communication device share a second key,
The mobile communication device includes an authentication unit that performs authentication using each of the first and second keys.
The invention according to claim 4 is the invention according to any one of claims 1 to 3,
The address generation means is provided with equipment information management means for associating a home address assigned to the mobile communication equipment with an identifier of the assigned mobile communication equipment and storing it in the memory device. is there.
The invention according to claim 5 is the invention according to any one of claims 1 to 4,
The screen information is hypertext and includes icon information related to the identifier of the mobile communication device.
The invention according to claim 6 is the invention according to any one of claims 1 to 5,
The mobile communication device is characterized in that the communication protocol is mobile IP.

The invention described in claim 7
In a mobile communication method having a home agent for transferring a communication packet to a mobile communication device connected to a foreign network,
An address management means for managing address blocks;
Allocating the IP address in this address block to the mobile communication device as a home address;
Storing a home address in the home agent;
Storing a shared key in the mobile communication device, and associating and storing the shared key, a home address and an identifier of the mobile communication device in a memory device;
A browser of a source node displaying information about the identifier;
Communication in which the source node refers to the home address corresponding to the identifier selected on the browser from the memory device, and the home address referenced to the mobile communication device using the shared key of the memory device is the destination Transmitting a packet, wherein the home agent transfers a communication packet from a source node;
The authentication unit of the mobile communication device includes a step of authenticating a transmission source node from the stored shared key and starting communication with the transmission source node.

The present invention has the following effects.
According to the first to sixth aspects, the identifier and home address of the mobile communication device are stored in the memory device that can be attached to and detached from the transmission source node, and the home address of the mobile communication device is managed by the address management means. An IP address is allocated. Thus, for example, if a home agent is provided in the network of the address managed by the address management means, the user does not have to operate the home agent individually, and the identifier and home address are assigned to the source node used for transmission. There is no need to create a list. Thereby, it is possible to prevent a mistake in creating a list, association, a mistake in setting a home address for a transmission source node, and the like. Furthermore, a third party who does not have a memory device cannot communicate with a mobile communication device. Therefore, high security can be achieved without requiring complicated maintenance and operation.

  According to the third aspect, since only the mobile communication device and the memory device have the second shared key, the information of the communication packet between the mobile communication device and the memory device is not easily leaked / falsified. Thereby, even if the operator of the home agent is different from the operator of the mobile communication device or the memory device, high security can be maintained.

  According to the fifth aspect, since the device memory includes icon information related to the identifier of the mobile communication device, a desired identifier can be retrieved from the icon image as compared with the tabular list in text. This makes it possible to easily determine a desired identifier and prevent selection errors in mobile communication devices.

  According to claim 7, the IP address managed by the address management means is assigned to the mobile communication device as a home address, the shared key is stored in the mobile communication device and the memory device, and the identifier and home address of the mobile communication device are stored in the memory device. Remember. Then, the transmission source node transmits a communication packet to the mobile communication device using the home address, identifier, and shared key of the memory device, and the home agent transfers the communication packet from the transmission source node. Further, the authentication means of the mobile communication device authenticates the transmission source node from the stored shared key, and starts communication with the transmission source node. As a result, for example, if a home agent is provided in the home network managed by the address management means, the user does not need to individually operate the home agent, and the identifier and home address of the transmission source node or the like used for transmission can be obtained. There is no need to create a list. Thereby, it is possible to prevent a mistake in creating a list, association, a mistake in setting a home address for a transmission source node, and the like. Furthermore, a third party who does not have a memory device cannot communicate with a mobile communication device. Therefore, high security can be achieved without requiring complicated maintenance and operation. In addition, since only the mobile communication device and the memory device have the shared key, the information of the communication packet between the mobile communication device and the memory device is not easily leaked / falsified. Thereby, even if the operator of the home agent is different from the operator of the mobile communication device or the memory device, high security can be maintained.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing an embodiment of the present invention. 2 and 3 are diagrams showing configurations of the mobile communication device 10 and the USB memory 50 shown in FIG. Here, the same components as those shown in FIGS. 1 to 3, a home network 400 is provided instead of the home network 100. The home network 400 includes a home agent 20, a router R1, and a newly provided address management unit 40. The address management means 40 manages a plurality of IP addresses, for example, manages address blocks acquired from an APNIC (Asia Pacific Network Information Center) by a manufacturer that manufactures the device 10. The home network 400 is the same as the network address of the address block.

  A USB memory 50 that can be carried and carried is newly provided. The USB memory 50 is detachable from the personal computer 30 and stores the home address of the device 10 and the identifier of the device 10 in association with each other. Further, the USB memory 50 stores GUI data to be displayed on the browser 31 operating on the personal computer 30. This data has a hypertext HTML format file as screen information, and has a different shape for each serial number. Icon information and the like are included. The HTML format file also includes hyperlink information to the home address of the device 10. The USB memory 50 is a type of memory device.

  Instead of the address generation means 12 of the device 10, an address generation means 14 is provided. The address generation unit 14 assigns one of the IP addresses managed by the address management unit 40 to the own device 10 as a home address and stores it in the memory 11.

The operation of such a system will be described.
First, the operation of registering the device 10 in the home agent 20 will be described with reference to FIG. A manufacturer of the device 10 activates the home agent 20 on the node having the home agent function on the home network 400 and installs the device 10 in the home network 400. The router R1 refers to the address managed by the address management means 40 and assigns a first prefix for the home address (corresponding to the network address of the home network 400) to the device 10 (SQ10).

  Thereby, the address generation unit 14 of the device 10 generates the home address of the device 10 from the MAC address stored in the memory 11 of the device 10 and the prefix for the assigned home address (SQ11). It stores in the memory 21 of the activated home agent 20 (SQ12, SQ13). At this time, the home address is an IP address included in one of the address blocks. That is, the address generation unit 14 generates a home address according to a certain rule from the prefix from the router R1 and the MAC address unique to the device 10, and thus becomes an address in the address block.

  Also, the device information management means (not shown in FIG. 1) reads the identifier and home address stored in the memory 11 of the device 10 and associates the identifier and home address in the USB memory 50 to form a set. Store (SQ14). The device information of the read identifier and home address may be stored and managed by the device information management means.

  Further, for example, a screen information generation unit that operates on a personal computer (not shown in FIG. 1) associates an identifier of the device 10 with a home address, and describes an HTML file or device in which the home address is described as a hyperlink destination. The icon information representing 10 is generated and stored in the USB memory 50. When a plurality of pairs of identifiers and home addresses are stored in the USB memory 50, the icon shape may be changed for each identifier (SQ15).

  Then, a shared key generating means (not shown in FIG. 1) generates a first shared key and stores it in the memories 11 and 21 of the device 10 and the home agent 20 (SQ16, SQ17).

  Next, an operation for registering that the device 10 is installed in the foreign network 200 with the home agent 20 will be described with reference to FIG. The user receives the device 10 and the USB memory 50 shipped from the manufacturer. Then, a shared key generation unit (not shown in FIG. 1) generates a second shared key, and stores the generated shared key only in the memory 11 and the USB memory 50 of the device 10. The identifier corresponding to the device 10, the home address, and the second shared key are associated and stored as a set (SQ20, SQ21).

  Then, the device 10 is installed in the foreign network 200. Further, the router R2 existing in the foreign network 200 gives the device 10 a second prefix (corresponding to the network address of the foreign network 200) for the foreign network 200 (SQ22). Thereby, the address generation unit 14 of the device 10 generates the care-of address of the device 10 in the foreign network 200 from the MAC address stored in the memory 11 of the device 10 and the assigned second prefix (SQ23). And stored in the memory 11 (SQ24).

  Then, the device 10 transmits a communication packet including the care-of address to the home agent 20, and at that time, authentication is performed. In other words, the device 10 shows validity to the home agent 20 using the first shared key stored in the memory 11, and the authentication unit 23 of the home agent 20 authenticates with the first shared key in the memory 21. Perform (SQ25). If authentication is performed, communication starts, and a care-of address is extracted from the communication packet received from the device 10 and stored in the memory 21. Of course, the home address and care-of address of the device 10 are associated and registered in the memory 21 (SQ26). After authentication is performed, communication is performed using encryption and decryption using the first shared key.

Next, the operation of transmitting a communication packet from the personal computer 30 to the device 10 connected to the foreign network 200 will be described using FIG.
A user connects a USB memory to the personal computer 30 and activates the browser 31 of the personal computer 30. Then, the browser 31 reads the HTML format file and icon information of the USB memory 50 (SQ30), and displays the icon including the identifier information of the device 10 along the description of the file (SQ31). When the user selects an icon indicating a desired identifier using an interface such as a mouse (SQ32), the home address paired with the selected identifier is referred to by a hyperlink described in the file. (SQ33), a communication packet is transmitted with the home address as the transmission destination (SQ34). At this time, authentication is performed using the second shared key stored in the USB memory 50 and paired with the identifier.

  The home agent 20 picks up the communication packet, determines the transfer destination of the communication packet and the first shared key for authentication from the correspondence between the home address and the care-of address in the memory 21 (SQ35), and the transfer means 22 takes care of A communication packet is transmitted to the device 10 using the address as a transfer destination. Then, authentication between the device 10 and the home agent 20 is performed by the authentication means 13 and 23 (SQ36).

  Further, the authentication means 13 of the device 10 authenticates the personal computer 30, that is, the USB memory 50, with the second shared key of the memory 11, and determines whether or not the personal computer 30 can be accessed (SQ37).

  After the authentication means 13 authenticates, the browser 31 of the personal computer 30 encrypts and transmits the communication packet with the second shared key (SQ38), and the home agent 20 transmits the first shared in the memory 21. The communication packet from the personal computer 30 is encrypted with the key. Then, the transfer unit 22 transfers the encrypted communication packet to the device 10 (SQ39).

  Further, the device 10 receives the communication packet transferred from the home agent 20, decrypts it with the first shared key, and decrypts it with the second shared key 2. As described above, the communication packet from the personal computer 30 reaches the device 10 existing in the foreign network 200, and communication is started between the device 10 and the personal computer 30.

  As described above, the identifier and home address of the device 10 are stored in the USB memory 50 that can be attached to and detached from the personal computer 30, and an IP address managed by the address management means 40 is assigned to the home address of the device 10. Thereby, for example, if the home agent 20 is provided in the home network 400 managed by the address management means 40, the user does not need to individually operate the home agent, and the identifier and the home information are transmitted to the personal computer 30 used for transmission. There is no need to create a list of addresses. Thereby, it is possible to prevent a mistake in creating a list, association, a mistake in setting a home address for the personal computer 30, and the like. Furthermore, a third party who does not have the USB memory 50 cannot communicate with the device 10. Therefore, high security can be achieved without requiring complicated maintenance and operation.

  Further, since only the device 10 and the USB memory 50 have the second shared key, the information of the communication packet between the device 10 and the USB memory 50 is not easily leaked / tampered. Thereby, even if the operator of the home agent 20 is different from the operator of the device 10 or the USB memory 50, high security can be maintained.

  In addition, since the USB memory 50 includes icon information related to the identifier of the device 10, it is possible to search for a desired identifier from the icon image as compared with a list in a tabular form. Thereby, a desired identifier can be easily discriminated, and a selection error of the device 10 can be prevented.

The present invention is not limited to this, and may be as shown below.
Although the configuration in which the home agent 20 is operated on a node different from the router R1 is shown, it may be operated on the router.

  Moreover, although the configuration in which the address management unit 40 is provided separately from the home agent 20 is shown, it may be provided in a node where the home agent 20 operates.

  Further, the configuration in which the device 10 and the USB memory 50 are provided with the second shared key has been described. For example, if the security between the personal computer 30 to which the device 10 and the USB memory 50 are connected is guaranteed, the second shared key is provided. The shared key may not be stored.

  Further, although the configuration using mobile IPv6 as the communication protocol of the device 10 has been shown, a foreign agent may be installed in the foreign network 200 and mobile IPv4 may be used.

  Further, the personal computer 30 may be provided with IPv4-IPv6 tunnel means, the personal computer 30 may be set to IPv4, and the networks 200 and 400 may be set to IPv6.

  In addition, although the configuration using the USB memory 50 as the memory device has been shown, any device that can be connected to the interface of the personal computer 30 (for example, floppy disk, SD card, MO, CD, CF) Card etc.).

  Also, the device information management means (not shown) reads the home address and identifier from the memory 11 of the device 10 and stores them in the USB memory 50. If it is a memory device, an interface corresponding to another memory device) may be provided, and the USB memory 50 may be connected and stored directly in the USB memory 50 from the device 10.

  In addition, the device information management unit (not shown) reads the home address and the identifier from the memory 11 of the device 10 and stores them in the USB memory 50. However, the device information management unit stores the identifier and home address in advance. In addition, an identifier and a home address may be stored in the USB memory 50. That is, since the identifier and MAC address of the device 10 are known and the address block of the address management unit 40 is also known if the manufacturer of the device 10, the address generated by the address generation unit 14 of the device 10 from the prefix and the MAC address. Is calculated and stored in advance.

  In addition, the configuration in which the identifier, home address, and screen information are stored in the USB memory 50 before the USB memory 50 is shipped to the user is shown. Also good. For example, it may be printed on paper, mailed / faxed, or transmitted to the user in the form of electronic data. As a result, the degree of freedom in sending data is increased, and the degree of freedom in managing the home agent 20 and the address block including the home address is increased. The address block can be changed flexibly, and the user can use a desired memory device.

  The second shared key has been shown to be stored in the device 10 and the USB memory 50 by the user after shipment. However, the second shared key may be stored before shipment of the device 10 and the USB memory at the time of shipment. This saves the user the trouble of storing the second shared key.

  Further, although only one personal computer 30 and device 10 are shown, any number of personal computers 30 and devices 10 may be provided. Similarly, any number of foreign networks 200 may be provided.

  Furthermore, although the configuration using a serial number as the identifier of the device 10 is shown, any identifier may be used as long as it is unique. The screen information generation means may create screen information in which a name different from the identifier is associated with the identifier. As a result, the user can identify the device 10 with a user-specific name that is easier to manage than the serial number.

It is the block diagram which showed the 1st Example of this invention. It is the block diagram which showed an example of the mobile communication apparatus shown in FIG. It is the block diagram which showed an example of the USB memory shown in FIG. It is the figure which showed one example of operation | movement of the system shown in FIG. It is the figure which showed the other operation example of the system shown in FIG. It is the figure which showed the other operation example of the system shown in FIG. It is the figure which showed the structure of the conventional mobile communication system. It is the block diagram which showed an example of the mobile communication apparatus shown in FIG. It is the block diagram which showed an example of the home agent shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Mobile communication apparatus 11 Memory 13 Authentication means 14 Address generation means 20 Home agent 30 Personal computer 31 Browser 50 USB memory 200 Foreign network 400 Home network

Claims (7)

In a mobile communication system having a home agent for transferring a communication packet to a mobile communication device connected to a foreign network,
Address management means for managing a plurality of IP addresses;
Address generating means for allocating one of the IP addresses managed by the address management means to the mobile communication device as a home address;
A memory device that associates a home address of the mobile communication device with an identifier of the mobile communication device, and stores each of the home address and the identifier ;
A transmission source node that transmits the communication packet with the home address of the memory device as a transmission destination, and the memory device is detachable from the transmission source node and is displayed on a browser of the transmission source node Storing screen information regarding the identifier of
The mobile communication system , wherein the transmission source node refers to a home address corresponding to the identifier selected by the screen information from the memory device .   2. The mobile communication system according to claim 1, wherein the address management means manages an address block. The home agent and the mobile communication device share the first key,
The memory device and the mobile communication device share a second key,
The mobile communication system according to claim 1 or 2, wherein the mobile communication device includes an authentication unit that performs authentication using each of the first and second keys. The apparatus according to claim 1, further comprising: a device information management unit that associates a home address assigned to the mobile communication device by the address generation unit with an identifier of the assigned mobile communication device and stores the set in the memory device. The mobile communication system in any one of 1-3.   The mobile communication system according to claim 1, wherein the screen information is hypertext and includes icon information related to an identifier of the mobile communication device.   The mobile communication system according to any one of claims 1 to 5, wherein the mobile communication device has a communication protocol of mobile IP. In a mobile communication method having a home agent for transferring a communication packet to a mobile communication device connected to a foreign network,
An address management means for managing address blocks;
Allocating the IP address in this address block to the mobile communication device as a home address;
Storing a home address in the home agent;
Storing a shared key in the mobile communication device, and associating and storing the shared key, a home address and an identifier of the mobile communication device in a memory device;
A browser of a source node displaying information about the identifier;
Communication in which the source node refers to the home address corresponding to the identifier selected on the browser from the memory device, and the home address referenced to the mobile communication device using the shared key of the memory device is the destination Transmitting a packet, wherein the home agent transfers a communication packet from a source node;
A mobile communication method comprising: an authenticating unit of the mobile communication device authenticating a transmission source node from the stored shared key and starting communication with the transmission source node.

Images