JP4866930B2 - COMMUNICATION SYSTEM, COMMUNICATION SERVER, ACCESS CONTROL METHOD, ACCESS CONTROL PROGRAM, AND RECORDING MEDIUM CONTAINING ACCESS CONTROL PROGRAM - Google Patents

Description

  The present invention relates to a communication system, a communication server, an access control method, an access control program, and a recording medium on which an access control program is recorded, for controlling access to a home device arranged in an end user's home.

  Conventionally, when trying to discover an IP device in the end user's home from outside the end user's home via the IP network, generally (1) a first IP network outside the end user's home and a second in the end user's home A method of permitting communication from outside the end user's house to the end user's house by operating a firewall of a broadband router installed between the IP network and the end user's house is used.

  Further, instead of the broadband router, there is (2) a method of installing a gateway (see Patent Document 1). In this method, the gateway has a function of holding connection device information of an IP device connected to the first IP network, and a function of protocol conversion for communicating with each IP device. Then, the IP device connected to the second IP network can access the IP device connected to the first IP network via the gateway.

Japanese Patent No. 4041118

  However, the methods (1) and (2) have the following problems.

  In the method (1), an IP device on the first IP network registered in the access permission of the broadband router firewall can be connected to an IP device on the second IP network. However, an end user may want an IP device on the first IP network to discover only a specific device for the purpose of remote maintenance. In this case, in the method (1), all IP devices in the end user's home are discovered, and a security problem such as leakage of information of other IP devices other than the specific device occurs.

  In the method (2), the gateway is limited to devices that can be discovered, but security can be ensured because only the provider that provided the gateway can discover. However, a service provider who manages IP equipment in a user's home such as remote maintenance must individually install a gateway. In addition, when a network provider providing a platform provides a device discovery function to a service provider by installing a gateway, since there is currently no access restriction function for the service provider, the same security as the method (1) The above problem occurs.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to enable a service provider to discover only devices managed by the service provider provided to the end user's home.

  To achieve the above object, the present invention provides a communication system for controlling access to a home device, comprising a home gateway connected to the home device and a communication server, wherein the communication server is a service server. Service server specifying information for specifying the home device, home device specifying information and home device related information for each home device that the service server provides services, home gateway specifying information for specifying the home gateway connected to each home device, And a storage unit that stores a device discovery request from the service server, and a combination of service server identification information, home device identification information, and home gateway identification information included in the device discovery request is stored in the storage unit. If stored, the access controller that permits the device discovery request. If the roll means and the device discovery request are permitted, the home device related information is acquired from the home gateway based on the device discovery request, and the acquired home device related information and the home device related information stored in the storage means And a device finding means for notifying the service server of access information to the home device for the matching home device, and the home gateway from the communication server Collecting means for collecting home device related information from each home device based on the device discovery request and transmitting it to the communication server.

  In addition, the present invention is a communication server that controls access to a home device, the service server specifying information for specifying a service server, the home device specifying information and the home device for each home device for which the service server provides a service Storage means for associating and storing related information and home gateway specifying information for specifying a home gateway connected to each home device; a device discovery request received from the service server; and included in the device discovery request When a combination of service server identification information, home device identification information, and home gateway identification information is stored in the storage means, access control means for permitting the device discovery request, and when the device discovery request is permitted, Based on the device discovery request, the home gateway to the home machine Acquire related information, determine whether the acquired home device related information matches the home device related information stored in the storage means, and for the matching home device, the access information to the home device Device discovery means for notifying the service server.

  The present invention is also an access control method for controlling access to a home device, the service server specifying information for specifying a service server, the home device specifying information and the home of each home device for which the service server provides a service. Acquiring device-related information and home gateway specifying information for specifying a home gateway connected to each home device, registering them in the storage unit in association with each other, and receiving a device discovery request from the service server And, when a combination of service server identification information, home device identification information, and home gateway identification information included in the device discovery request is stored in the storage unit, an access control step for permitting the device discovery request; When the device discovery request is permitted, the home discovery request is based on the device discovery request. Home device related acquisition from the home gateway, and determining whether or not the acquired home device related information matches the home device related information stored in the storage unit, and access to the home device for the matching home device And a notification step of notifying the service server of information.

  The present invention is also an access control program for causing a computer to execute the access control method.

  The present invention is also a computer-readable recording medium on which the access control program is recorded.

  According to the present invention, since the service provider can discover only the devices managed by the service provider provided to the end user's home and no other devices are found, higher security can be ensured.

1 is an overall configuration diagram of a communication system according to an embodiment of the present invention. It is a block diagram of a center server and a home gateway. It is a flowchart of an apparatus discovery process.

  Hereinafter, embodiments of the present invention will be described.

  FIG. 1 is a diagram showing a communication system according to an embodiment of the present invention. The illustrated communication system includes an HSP server 106 (Home network Service Provider), a center server (communication server) 104, a database (storage means) 105, home devices 101 and 102 installed in an end user's house, and a user terminal 107. And a home gateway 103. The home devices 101 and 102 and the user terminal 107 are connected to the IP network 109 via the home gateway 103.

  In the embodiment shown in FIG. 1, the user terminal 107 exists under the home gateway 103, but the present invention is not limited to this. Since the user terminal 107 only needs to be able to access the center server 104 and the HSP server 106, the user terminal 107 may exist anywhere. For example, when the user terminal 107 is connected to the IP network 109, or when the user terminal 107 is a mobile phone (mobile terminal), the center server 104 and the HSP server 106 may be accessed from a mobile phone network such as i-mode. Conceivable.

  The HSP server 106 owned by the service provider provides various services to the home devices 101 and 102 (end users) via the center server 104, the IP network 109, and the home gateway 103.

  The center server 104 owned by the network operator is connected to the HSP server 106 and the database 105 and can be connected to the home gateway 103 via the IP network 109. In the example shown in FIG. 1, the network operator provides a platform including the center server 104, the database 105, the IP network 109, and the home gateway 103 to the service operator (HSP server 106).

  Information applied by the service provider and the end user is registered in the database 105. The database 105 may be in the center server 104.

  FIG. 2 is a block diagram illustrating configurations of the center server 104 and the home gateway 103.

  The center server 104 includes a data reception unit 201, a data transmission unit 202, a data management unit 203, a database access unit 204, an access control unit 205, a home device discovery unit 206, and a communication processing unit 207.

  The data receiving unit 201 and the data transmitting unit 202 have a communication interface with the HSP server 106. Specifically, the data receiving unit 201 receives a request for device discovery from the HSP server 106 online. The data transmission unit 202 transmits a list of discovered home devices online to the HSP server 106.

  The data management unit 203 registers and manages information transmitted from the HSP server 106 (or service provider) and the user terminal 107 (or end user) in the database 105 using the database access unit 204.

  Based on the information registered in the database 105, the access control unit 205 determines whether the HSP server 106 can access the home devices 101 and 102 under the home gateway 103. The home device discovery unit 206 discovers a home device under the home gateway 103 via the communication processing unit 207, the communication processing unit 208 of the home gateway 103, and the protocol bundle 210, and the discovered home device requests from the HSP server 106. Judgment is made on whether or not the device has been used.

  The communication processing unit 207 of the center server 104 and the communication processing unit 208 of the home gateway 103 perform communication between the center server 104 and the home gateway 103. In addition, the communication processing unit 208 of the home gateway 103 notifies the bundle management unit 209 of the protocol bundle 210 necessary for communication with the home device.

  The bundle management unit 209 manages the presence / absence of a protocol bundle necessary for communication with the home device in the home gateway 103, and requests the agent 211 to install the protocol bundle 210 when there is no such bundle. It is assumed that the agent 211 exists in the center server 104 or the home gateway 103.

  The protocol bundle 210 acquires information for specifying the home device from the home device, and transmits a list of the acquired home device information to the home device discovery unit 206 via the communication processing units 207 and 208.

  As the above-described HSP server 106, center server 104, home gateway 103, home devices 102 and 103, and user terminal 107, for example, a general-purpose computer system including at least a CPU and a memory can be used. In this computer system, each function of each device is realized by the CPU executing a predetermined program loaded on the memory. For example, the functions of the center server 104 and the home gateway 103 are executed by the CPU of the center server 104 in the case of a program for the center server 104, and the CPU of the home gateway 103 in the case of a program for the home gateway 103, respectively. Is realized.

  Next, the processing of this embodiment will be described.

  FIG. 3 is a flowchart of processing for finding a home device.

  First, the HSP server 106 (or service provider) transmits platform use application information to the center server 104 (or network operator). Thereby, the data management unit 203 of the center server 104 registers the application information transmitted from the HSP server 106 in the database 105 (S301). The application information includes HSP server identification information for identifying the HSP server 106 and service provider identification information for identifying the service provider that owns the HSP server 106.

  Then, the HSP server 106 (or service provider) transmits application information of a home device provided by the HSP server 106 to the center server 104 (or network operator). Accordingly, the data management unit 203 of the center server 104 registers the application information of the home device transmitted from the HSP server 106 in the database 105 (S302). The home device application information includes HSP server specifying information, home device specifying information for each home device, and home device related information.

  The home device identification information is identification information for uniquely identifying the home device between the service provider and the network operator. The home device related information is information that can be acquired online from the home device, and is information that can identify the home device (for example, manufacturer name, model number, firmware version, etc.). It is assumed that the home device identification information and the home device related information have a one-to-one relationship.

  It is assumed that the data management unit 203 of the center server 104 registers the information registered in S301 and the information registered in S302 in the database 105 in association with the HSP server specifying information as a key.

  Next, the user terminal 107 (or an end user) transmits home device application information for applying for a home device that uses a service provided by the HSP server 106 to the center server 104 (or a network operator). . As a result, the data management unit 203 of the center server 104 registers the home device application information transmitted from the user terminal 107 in the database 105 (S303). The home device application information includes HSP server specifying information, home device specifying information, home gateway specifying information for specifying the home gateway 103, an end user ID, and the like.

  The data management unit 203 of the center server 104 registers the information registered in S301 and S302 and the information registered in S303 in the database 105 in association with the HSP server specifying information and the home device specifying information as keys. To do.

  Through the registration processing from S301 to S303 in the database 105, the center server 104 associates the HSP server 106 with the home device, and can discover the home device in the end user's home from the HSP server 106. However, at this stage, since the HSP server 106 does not hold information for specifying the home gateway 103 of the end user, the HSP server 106 cannot substantially find the home device.

  Then, the HSP server 106 receives a service start request from the user terminal 107 (or end user) (S304). This service start request includes home gateway specifying information (for example, a telephone number or a line number) for specifying the home gateway 103. As a result, the HSP server 106 is in a state where it can find a home device to be used in its own service in the end user's house.

  When the HSP server 106 accepts the service start request, the HSP server 106 transmits a device discovery request for a home device that can be used in its own service to the center server 104 (S305). This device discovery request includes HSP identification information, home gateway identification information, and home device identification information of the home device to be discovered.

  Next, the access control unit 205 of the center server 104 determines whether or not to permit access to the end user's house in response to the device discovery request transmitted from the HSP server 106 (S306). Specifically, the access control unit 205 permits the device discovery request when the combination of the service server identification information, the home device identification information, and the home gateway identification information included in the device discovery request is registered in the database 105. Then, the home device discovery process in the end user's home is started. On the other hand, if not registered in the database 105, the access control unit 205 rejects the device discovery request and ends the process.

  When the access permission is determined, the home device discovery process is started. That is, the home device discovery unit 206 of the center server 104 notifies the home gateway 103 of home device discovery conditions for discovering home devices. The home device discovery condition includes a communication protocol for accessing the home device, an acquisition method from the home device, and acquired information (for example, HTTP, an access destination address, etc.). This home device discovery condition is included in the home device related information registered in the database 105. The home device discovery unit 206 obtains home device related information corresponding to the home device identification information of the device discovery request from the database 105, and transmits a home device discovery condition that is a part of the obtained home device related information to the home gateway. To do.

  Next, the home gateway 103 installs a protocol bundle 210 necessary for home device discovery (S307). Specifically, when receiving the home device discovery condition from the center server 104, the communication processing unit 208 of the home gateway 103 notifies the bundle management unit 209 of the protocol bundle 210 necessary for the home device discovery condition.

  The bundle management unit 209 that manages the life cycle of the protocol bundle acquires the protocol bundle 210 from the agent 211 and installs the protocol bundle 210 in the home gateway 103 when the necessary protocol bundle does not exist in the home gateway 103 at the present time. To do. Generally, in the home gateway 103, resources that can be secured (available memory and program storage area) are limited, so that a protocol bundle is installed only when necessary. This mechanism can be realized by, for example, a framework of OSGi (Open Services Gateway Initiative). OSGi is a standardization organization that promotes the formulation and spread of technical specifications OSGi for connecting home devices to the Internet and providing services between personal computers and home devices.

  Next, the protocol bundle 210 of the home gateway 103 collects home device related information from each home device (S308). The home device related information is information for specifying the home device. For example, when the home device is a UPnP device device, the manufacturer name, product number, firmware version, etc. included in the device description that can be acquired from the home device Corresponds to home device related information. The protocol bundle 210 collects home device-related information that can be acquired under the home device discovery condition for each home device and transmits it to the center server 104.

  Next, the home device discovery unit 206 of the center server 104 determines home device related information of each home device received from the home gateway 103 (S309). For example, the home device related information (manufacturer name, model number, firmware version, etc.) acquired in S308 is compared with the home device related information of the home device for the company service registered in the database 105. Access from the HSP server 106 is permitted. Thereby, it can be determined whether or not the home device is requested to be discovered by the service provider.

  Finally, the home device discovery unit 206 of the center server 104 notifies the HSP server 106 of access information to the matched home device (S310). Here, the information for accessing the home device (for example, the MAC address of the home device, the UUID of UPnP, etc.) included in the home device related information acquired from the home device is listed as a list for each discovered home device. The server 106 is notified. Thereafter, the HSP server 106 can use the information for accessing the home device and the home gateway specifying information to access the home device for the company service in the end user's home via the center server. The center server 104 or the home gateway 103 converts information for accessing the home device into an IP address necessary for communication, and accesses the home device using the converted IP address. It is assumed that the conversion table is held in the database 105 when the IP address of each home device is converted by the center server 104 and in the protocol bundle 210 when converted by the home gateway 103.

  In the present embodiment described above, the network operator that provides the platform obtains information on the device that the service operator wants to discover from the end user in advance and obtains the device discovery approval from the end user. It is possible to discover a device to be used in this service, and the end user is prevented from discovering a device other than the device. Therefore, it is possible to avoid the problem of personal information leakage such that a malicious service provider obtains device information of the end user's home and provides it to a third party.

  That is, in this embodiment, the HSP server (service provider) registers information (home device related information) that can be acquired online of the home device used by the company in the database, and the user terminal (end user) is registered by the HSP server. By registering home devices that are allowed to be discovered in the database, the HSP server can only discover home devices that provide its own services, and cannot discover other home devices. Can be secured.

  In addition, since the home gateway according to the present embodiment can acquire a necessary protocol bundle from an agent and install it, the home gateway can cope with a home device having a new communication protocol.

  In addition, this invention is not limited to the said embodiment, Many deformation | transformation are possible within the range of the summary.

101, 102 Home device 103 Home gateway 104 Center server 105 Database 106 HSP server 107 User terminal 109 IP network 201 Data reception unit 202 Data transmission unit 203 Data management unit 204 Database access unit 205 Access control unit 206 Home device discovery unit 207, 208 Communication processing unit 209 Bundle management unit 210 Protocol bundle

Claims (8)

A communication system for controlling access to a home device,
A home gateway connected to the home device and a communication server;
The communication server is
Service server specifying information for specifying a service server, home device specifying information and home device related information for each home device that the service server provides services, and a home gateway specifying for specifying a home gateway connected to each home device Storage means for storing information in association with each other;
When a device discovery request is received from the service server and a combination of service server identification information, home device identification information, and home gateway identification information included in the device discovery request is stored in the storage unit, the device discovery request Access control means to allow
When the device discovery request is permitted, home device related information is acquired from a home gateway based on the device discovery request, and the acquired home device related information matches the home device related information stored in the storage unit. And a device finding means for notifying the service server of access information to the home device for a matching home device,
The home gateway is
A communication system comprising: a collection unit that collects home device related information from each home device based on the device discovery request from the communication server and transmits the information to the communication server. The communication system according to claim 1,
The device discovery means acquires home device related information corresponding to home device identification information of the device discovery request from the storage means, and sets a home device discovery condition that is a part of the acquired home device related information to the home gateway. Send
The home gateway collects home device related information from home devices that can be acquired under the device discovery condition, and transmits the home device related information to the communication server. A communication system according to claim 1 or claim 2, wherein
The home gateway further includes bundle management means for installing a protocol bundle necessary for collecting home device related information. A communication server that controls access to home devices,
Service server specifying information for specifying a service server, home device specifying information and home device related information for each home device that the service server provides services, and a home gateway specifying for specifying a home gateway connected to each home device Storage means for storing information in association with each other;
When a device discovery request is received from the service server and a combination of service server identification information, home device identification information, and home gateway identification information included in the device discovery request is stored in the storage unit, the device discovery request Access control means to allow
When the device discovery request is permitted, home device related information is acquired from a home gateway based on the device discovery request, and the acquired home device related information matches the home device related information stored in the storage unit. And a device finding means for determining whether or not the matching home device is a service device, and notifying the service server of access information to the home device. The communication server according to claim 4, wherein
The device discovery means acquires home device related information corresponding to home device identification information of the device discovery request from the storage means, and sets a home device discovery condition that is a part of the acquired home device related information to the home gateway. A communication server that transmits and acquires home device related information collected from home devices that the home gateway can acquire under the device discovery condition. An access control method for controlling access to a home device,
Service server specifying information for specifying a service server, home device specifying information and home device related information for each home device that the service server provides services, and a home gateway specifying for specifying a home gateway connected to each home device A registration step of acquiring information and associating them with each other and registering them in the storage unit;
When a device discovery request is received from the service server and a combination of service server identification information, home device identification information, and home gateway identification information included in the device discovery request is stored in the storage unit, the device discovery request An access control step to allow
When the device discovery request is permitted, home device related acquisition is performed from a home gateway based on the device discovery request, and whether the acquired home device related information matches the home device related information stored in the storage unit or not. And a notification step of notifying the service server of access information to the home device for the matching home device.   An access control program for causing a computer to execute the access control method according to claim 6.   A computer-readable recording medium on which the access control program according to claim 7 is recorded.

Images