JP5388088B2 - Communication terminal device, management device, communication method, management method, and computer program. - Google Patents

Description

  The present invention relates to a communication terminal device, a management device, a communication method, a management method, and a computer program.

Conventionally, diversification and high functionality of devices having network functions such as mobile phones and information home appliances are progressing. In addition, diversification and speeding up of communication technologies are progressing. Therefore, there is a demand for a technique for performing data sharing and message transmission / reception by performing communication between various devices.
For realizing communication between various devices, for example, VPN (Virtual Private Network) has been proposed (Non-Patent Document 1). With VPN, it is possible to connect to a LAN from a remote terminal. In addition, VPNs prevent unauthorized access and leakage of personal information.
B. Gleeson, A. Lin, J. Heinanen, G. Armitage, A. Malis, “A Framework for IP Based Virtual Private Networks”, IETF RFC 2764, February 2000.

However, with conventional techniques (for example, VPN), it has been difficult to communicate between arbitrary devices while preventing unauthorized access and preventing leakage of personal information. For example, in VPN, it is possible to establish a communication connection from an arbitrary device to an existing LAN, but it is difficult to establish a communication connection only with an arbitrary device connected to the LAN.
Accordingly, an object of the present invention is to provide a technique that enables easy communication between arbitrary devices.

A first aspect of the present invention is a communication terminal device, which is a shared key assigned by the management device to another communication device that is shared with the management device and has been authenticated by an authentication infrastructure, A shared key storage unit for storing a shared key input from the communication device to the own device and a communication request for requesting communication with another communication terminal device using the shared key to the management device A communication request unit that receives and decrypts network information of another communication terminal device that is transmitted and encrypted and transmitted by the management device in response to the communication request, and is notified from the management device in response to the communication request A communication control unit that communicates with the other communication terminal device based on network information of the other communication terminal device.
The second aspect of the present invention is a management device, for each of a plurality of communication terminal devices, a shared key storage unit that stores a shared key shared with each communication terminal device, and a plurality of communication terminal devices, A network information storage unit that stores network information, an authentication unit that receives an encrypted communication request from a communication terminal device, decrypts it using the shared key, and authenticates the communication terminal device, and authenticates by the authentication unit The network information of another communication terminal device is read from the network information storage unit based on the communication request, the network information is encrypted using the shared key, and the source of the communication request is A management unit that transmits to the communication terminal device; receives terminal identification information of the communication terminal device from another communication device via an authentication infrastructure; generates the shared key; and generates the shared key Registered with the terminal identification information to the shared key storage unit, and transmits the shared key via the authentication infrastructure to the other communication apparatus, and a common key generation unit.

  The present invention may be specified as a communication method or a management method performed by a communication terminal device or a management device. The present invention may be specified as a computer program for operating a computer as the communication terminal device or the management device described above.

  According to the present invention, it is possible to easily communicate between arbitrary devices (communication terminal apparatuses).

  FIG. 1 is a diagram showing a system configuration of an inter-terminal communication management system 1. Hereinafter, the inter-terminal communication management system 1 will be described with reference to FIG. The inter-terminal communication management system 1 includes a plurality of communication terminal apparatuses 10 and a management apparatus 20. Each communication terminal device 10 communicates with another communication terminal device 10 and the management device 20 via a general network (for example, the Internet, a dedicated line network, etc.) that does not require authentication by the provider authentication infrastructure 30. Do. Next, the configuration of each device included in the inter-terminal communication management system 1 will be described.

[Communication terminal device]
The communication terminal device 10 includes a CPU, a RAM, an auxiliary storage device, and the like connected by a bus, and operates when the CPU reads and executes a program stored in the auxiliary storage device. Moreover, the communication terminal device 10 may be partially or entirely configured using dedicated hardware.

  FIG. 2 is a diagram illustrating an outline of functional blocks of the communication terminal device 10. The communication terminal device 10 includes a transmission / reception unit 101, a shared key storage unit 102, a communication request unit 103, and a communication control unit 104. Hereinafter, each functional unit of the communication terminal apparatus 10 will be described.

  The transmission / reception unit 101 transmits / receives data to / from another communication terminal device 10 and the management device 20 via the Internet by wireless communication or wired communication. The transmission / reception unit 101 sends the data generated by the communication request unit 103 and the communication control unit 104 to the Internet. In addition, when the transmission / reception unit 101 receives data from the Internet, the transmission / reception unit 101 passes the received data to the communication request unit 103 and the communication control unit 104.

  The shared key storage unit 102 stores a shared key. The shared key is a shared key shared between the management device 20 and the communication terminal device 10. The shared key is a shared key that is different for each communication terminal device 10. The shared key is a shared key previously given to a legitimate user. For example, the communication terminal device 10 and the management device 20 are shared by the following method.

  First, the cellular phone 40 (“another communication device” in the present invention) creates data for requesting the assignment of a shared key (hereinafter referred to as “shared key assignment request”) by the operator authentication infrastructure 30 (the operator). To be transmitted to the management apparatus 20 via the “authentication infrastructure” in the present invention). The shared key assignment request includes the terminal identification information of the communication terminal device 10. The carrier authentication infrastructure 30 is configured by an IMS network. At this time, the provider authentication infrastructure 30 performs an authentication process on the mobile phone 40 based on information of a USIM (Universal Subscriber Identity Module). When the mobile phone 40 is authenticated, the operator authentication infrastructure 30 permits the mobile phone 40 to communicate with the management device 20.

  The shared key generation unit 206 of the management device 20 receives the shared key grant request from the mobile phone 40 via the business operator authentication infrastructure 30. The shared key generation unit 206 generates a shared key corresponding to the terminal identification information of the communication terminal device 10 and transmits the shared key to the mobile phone 40 via the provider authentication infrastructure 30. Also, the shared key generation unit 206 associates the terminal identification information with the shared key and registers them in the shared key storage unit 202.

  The mobile phone 40 receives the shared key and inputs the received shared key to the communication terminal device 10. At this time, the cellular phone 40 may display the shared key as a barcode such as a QR code on the screen, and the communication terminal device 10 may pick up and decode the image to input. Alternatively, the cellular phone 40 may transmit a shared key to the communication terminal device 10 using short-range wireless communication such as FeliCa or Bluetooth, and the communication terminal device 10 may receive the input to input. Further, the cellular phone 40 may include the electronic mail message and transmit the shared key, and the communication terminal device 10 may receive the input to input. Further, the user of the communication terminal device 10 may directly input the shared key to the communication terminal device 10.

  The communication request unit 103 establishes a highly secure communication path with the management apparatus 20 using the shared key, and performs communication. For example, the communication request unit 103 may perform data transmission / reception with the management apparatus 20 by performing encryption using a shared key. Further, for example, the communication request unit 103 further transmits / receives data to / from the management apparatus 20 by performing an electronic signature using a hash function such as MD5 (Message Digest 5) or SHA (Secure Hash Algorithm). May be.

In addition, the communication request unit 103 transmits a communication request to the management apparatus 20. At this time, the communication request unit 103 creates a communication request, encrypts the communication request using the shared key, and transmits the encrypted communication request. The communication request is data for requesting the management apparatus 20 to perform communication with another communication terminal apparatus 10. The communication request includes the terminal identification information of another communication terminal device 10 that is desired to communicate and the terminal identification information of the own device. The terminal identification information is identification information that uniquely indicates each communication terminal device 10.
Further, the communication request unit 103 receives the network information encrypted by the management device 20 (network information of another communication terminal device 10) from the management device 20. Then, the communication request unit 103 decrypts the received network information using the shared key. The network information of the communication terminal device 10 is information necessary to communicate with the communication terminal device 10, for example, the IP address or port number of the communication terminal device 10, or the communication terminal device 10 is connected. The IP address and port number of the network gateway.

The communication control unit 104 communicates with another communication terminal device 10 based on the network information acquired by the communication request unit 103. The communication control unit 104 may perform communication with another communication terminal device 104 by encrypting it. In this case, the communication control unit 104 generates a shared key for inter-terminal communication that is shared with other communication terminal devices 104. The communication control unit 104 encrypts the inter-terminal communication shared key using the shared key shared with the management apparatus 20 and transmits the encrypted key to the management apparatus 20.
Thereafter, the inter-terminal communication shared key is transmitted from the management apparatus 20 to the other communication terminal apparatus 10, whereby the inter-terminal communication shared key is exchanged between the communication terminal apparatus 10 and the other communication terminal apparatus 10. Shared. Note that the inter-terminal communication shared key may be generated by the management apparatus 20 in response to a communication request.

[Management device]
The management device 20 includes a CPU, a RAM, an auxiliary storage device, and the like connected by a bus, and operates when the CPU reads and executes a program stored in the auxiliary storage device. Further, the management device 20 may be partially or entirely configured using dedicated hardware.

  FIG. 3 is a diagram illustrating an outline of functional blocks of the management apparatus 20. The management device 20 includes a transmission / reception unit 201, a shared key storage unit 202, a network information storage unit 203, an authentication unit 204, a management unit 205, and a shared key generation unit 206. Hereinafter, each functional unit of the management apparatus 20 will be described.

  The transmission / reception unit 201 transmits / receives data to / from the communication terminal device 10 via the Internet by wireless communication or wired communication. The transmission / reception unit 201 transmits the data generated by the authentication unit 204 and the management unit 205 to the Internet. In addition, when the transmission / reception unit 201 receives data from the Internet, the transmission / reception unit 201 passes the received data to the authentication unit 204 and the management unit 205.

The shared key storage unit 202 stores a shared key stored in each communication terminal device 10.
The network information storage unit 203 stores terminal identification information of each communication terminal device 10 and network information in association with each other.

  When the communication request is received, the authentication unit 204 performs an authentication process on the communication terminal device 10 that is the transmission source of the communication request by using the shared key. For example, the authentication unit 204 performs authentication using a hash function such as MD5 or SHA. The authentication unit 204 passes the result of the authentication process disconnection to the management unit 205.

The management unit 205 reads network information corresponding to the terminal identification information included in the communication request from the network information storage unit 203 when the transmission source of the communication request is authenticated by the authentication unit 204. Then, the management unit 205 encrypts the read network information using a shared key corresponding to the communication terminal device 10 that is the transmission source of the communication request, and transmits the encrypted network information.
The operation of the shared key generation unit 206 is as described in the description of the shared key.

  FIG. 4 is a diagram illustrating an operation example of the inter-terminal communication management system 1. FIG. 4 shows the flow of processing until the communication terminal device 10a communicates with the communication terminal device 10b. In the example of FIG. 4, the communication terminal device 10 b has already stored the shared key generated by the management device 20 through authentication by the provider authentication infrastructure 30 described above. First, the mobile phone 40 communicates via the operator authentication infrastructure 30 to receive authentication in the operator authentication infrastructure 30 and share a shared key with the management apparatus 20 (step 1). Next, this shared key is input to the communication terminal device 10a (step 2). The communication request unit 103 of the communication terminal device 10a creates a communication request including the terminal identification information of the communication terminal device 10b and the terminal identification information of the own device. Then, the communication request unit 103 encrypts the created communication request with the shared key and transmits it to the management apparatus 20 (step 3). At this time, the communication terminal device 10 a and the management device 20 communicate without going through the provider authentication infrastructure 30.

  Next, the authentication unit 204 of the management apparatus 20 performs authentication processing based on the received communication request, and passes the authentication result to the management unit 205. When the authentication result is an error, the management unit 205 returns an error to the communication terminal device 10a. On the other hand, when the authentication result can be authenticated, the management unit 205 reads the network information of the communication terminal device 10b from the network information storage unit 203 based on the communication request. Then, the management unit 205 encrypts the network information of the communication terminal device 10b (network information of the other communication terminal device 10) using the shared key of the communication terminal device 10a, and does not pass through the operator authentication infrastructure 30. It transmits to the communication terminal device 10a (step 4). And the communication terminal device 10a starts communication with the communication terminal device 10b based on the received network information (step 5).

  In the inter-terminal communication management system 1 configured as described above, it is possible to easily start communication between the terminal communication apparatuses 10 whose terminal identification information is known but whose network information is unknown.

  In addition, the communication terminal device 10 that intends to start communication with another communication terminal device 10 needs to be authenticated by the management device 20 based on the shared key. The shared key is a shared key assigned to the mobile phone 40 that has been authenticated by the provider authentication infrastructure 30. Therefore, the correctness of the communication destination is secured between the communication terminal devices 10 that are about to start communication.

  Further, in the inter-terminal communication management system 1 configured as described above, the communication path (the mobile phone 40, the provider authentication infrastructure 30, the management apparatus 20) when the shared key is assigned, and the communication terminal apparatuses 10 are mutually connected. The communication path (terminal device 10a, management device 20, communication terminal device 10b) when starting communication is different. For this reason, even if the mobile phone 40 is authenticated by the operator authentication infrastructure 30 and the shared key is issued from the management device 20, the communication path used for communication between the communication terminal devices 10 may change. Communication between the communication terminal apparatuses 10 can be continued without performing another authentication process or issuing a shared key.

  For example, conventionally, when the transmission / reception unit 101 of the communication terminal apparatus 10 includes a plurality of communication means (wired LAN, wireless LAN, mobile phone communication, PHS communication, etc.), authentication is performed again each time the communication means changes. It was necessary to perform processing and reissue the shared key. However, in the inter-terminal communication management system 1 configured as described above, since the authentication process and the communication path between the communication terminal devices 10 are different, without performing such re-authentication process or re-issuance of the shared key, Communication between the communication terminal apparatuses 10 can be continued.

<Modification>
The communication request may be configured to include identification information (PN identification information) of a personal network desired to be connected and terminal identification information of the own device. The personal network is a logical network composed of a plurality of communication terminal devices 10 belonging to different LANs. The PN identification information is identification information that uniquely indicates each personal network. The communication terminal device 10 transmits the PN identification information of the personal network desired to be connected in the communication request. In this case, the network information storage unit 203 further corresponds to the PN identification information of each personal network and the terminal identification information of the communication terminal device 10 (one or more units) connected to each personal network. Add and remember. The management unit 205 reads the terminal identification information of each communication terminal device 10 corresponding to the PN identification information included in the communication request, and reads the network information corresponding to each terminal identification information. Then, the management unit 205 transmits the read network information to the communication terminal device 10 that is the transmission source of the communication request. In the inter-terminal communication management system 1 configured as described above, even if the PN identification information is known but the network information of the other communication terminal device 10 connected to the personal network is unknown, the communication terminal The device 10 can easily start communication with another communication terminal device 10 connected to the personal network.

Registration of network information in the network information storage unit 203 may be registered by an artificial procedure such as mailing.
The communication terminal device 10 and the mobile phone 40 may be integrated.
Further, the shared key generation unit 206 of the management device 20 may read the user identification information of the mobile phone 40 from the USIM information. Then, the shared key generation unit 206 may register the terminal identification information, the user identification information, and the shared key in the shared key storage unit 202 in association with each other.

Note that a part of the communication terminal device 10 or the management device 20 in the above-described embodiment, for example, the functions of the communication request unit 103, the communication control unit 104, the authentication unit 204, and the management unit 205 may be realized by a computer. . In that case, a program for realizing this function may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory inside a computer system serving as a server or a client in that case may be included and a program that holds a program for a certain period of time. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.
The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

It is a figure which shows the system configuration | structure of a communication management system between terminals. It is a figure which shows the outline of the functional block of a communication terminal device. It is a figure which shows the outline of the functional block of a management apparatus. It is a figure which shows the operation example of the communication management system between terminals.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication management system between terminals, 10 ... Communication terminal device, 101 ... Transmission / reception part, 102 ... Shared key memory | storage part, 103 ... Communication request part, 104 ... Communication control part, 20 ... Management apparatus, 201 ... Transmission / reception part, 202 ... Shared key storage unit, 203 ... Network information storage unit, 204 ... Authentication unit, 205 ... Management unit, 206 ... Shared key generation unit

Claims (6)

A shared key assigned by the management apparatus to another communication apparatus that is shared with the management apparatus and authenticated by the authentication infrastructure by performing communication via the authentication infrastructure, and is automatically transmitted from the other communication apparatus. A shared key storage unit for storing a shared key input to the device;
A communication request for requesting communication with another communication terminal device is transmitted to the management device after being encrypted using the shared key using a communication path different from the authentication infrastructure, and in response to the communication request A communication request unit that receives and decrypts network information of another communication terminal device encrypted and transmitted by the management device;
A communication control unit that communicates with the other communication terminal device based on network information of the other communication terminal device notified from the management device in response to the communication request;
A communication terminal device comprising: For each of a plurality of communication terminal devices, a shared key storage unit that stores a shared key shared with each communication terminal device;
A network information storage unit for storing network information for each of a plurality of communication terminal devices;
An authentication unit that receives an encrypted communication request from the communication terminal device, decrypts it using the shared key, and authenticates the communication terminal device;
When authenticated by the authentication unit, the network information of another communication terminal device is read from the network information storage unit based on the communication request, the network information is encrypted using the shared key, and the communication request A management unit for transmitting to the communication terminal device which is a transmission source;
Generates the shared key by receiving terminal identification information of the communication terminal device via the authentication infrastructure from another communication device authenticated by the authentication infrastructure by performing communication via the authentication infrastructure. The shared key and the terminal identification information registered in the shared key storage unit, and transmit the shared key to the other communication device via the authentication infrastructure,
With
The authentication unit and the management unit are management devices that communicate with the communication terminal device using a communication path different from the authentication infrastructure. A shared key assigned by the management apparatus to another communication apparatus that is shared with the management apparatus and authenticated by the authentication infrastructure by performing communication via the authentication infrastructure, and is automatically transmitted from the other communication apparatus. A communication terminal device including a shared key storage unit that stores a shared key input to the device,
Encrypting a communication request for requesting communication with another communication terminal device using the shared key, and transmitting to the management device using a communication path different from the authentication infrastructure;
The communication terminal apparatus communicates with the other communication terminal apparatus based on network information of the other communication terminal apparatus notified from the management apparatus in response to the communication request;
Including a communication method. A shared key storage unit that stores a shared key shared with each communication terminal device for each of a plurality of communication terminal devices; a network information storage unit that stores network information for each of the plurality of communication terminal devices;
A management device comprising:
Generates the shared key by receiving terminal identification information of the communication terminal device via the authentication infrastructure from another communication device authenticated by the authentication infrastructure by performing communication via the authentication infrastructure. Registering the shared key and the terminal identification information that have been performed in the shared key storage unit, and transmitting the shared key to the other communication device via the authentication infrastructure,
The management device receives a communication request encrypted from the communication terminal device using a communication path different from the authentication infrastructure, decrypts it using the shared key, and authenticates the communication terminal device; ,
When the management device is authenticated by an authentication unit, the network information of another communication terminal device is read from the network information storage unit based on the communication request, and the network information is encrypted using the shared key, Transmitting to the communication terminal device that is the transmission source of the communication request using a communication path different from the authentication infrastructure;
Management method including. A shared key assigned by the management apparatus to another communication apparatus that is shared with the management apparatus and authenticated by the authentication infrastructure by performing communication via the authentication infrastructure, and is automatically transmitted from the other communication apparatus. For a computer having a shared key storage unit for storing a shared key input to the device,
Encrypting a communication request for requesting communication with another communication terminal device using the shared key, and transmitting to the management device using a communication path different from the authentication infrastructure;
Communicating with the other communication terminal device based on the network information of the other communication terminal device notified from the management device in response to the communication request;
A computer program for running. A shared key storage unit that stores a shared key shared with each communication terminal device for each of a plurality of communication terminal devices; a network information storage unit that stores network information for each of the plurality of communication terminal devices;
For computers with
Generates the shared key by receiving terminal identification information of the communication terminal device via the authentication infrastructure from another communication device authenticated by the authentication infrastructure by performing communication via the authentication infrastructure. Registering the shared key and the terminal identification information that have been performed in the shared key storage unit, and transmitting the shared key to the other communication device via the authentication infrastructure,
Using a communication path different from the authentication infrastructure, receiving an encrypted communication request from the communication terminal device, decrypting using the shared key, and authenticating the communication terminal device;
When authenticated by an authentication unit, the network information of another communication terminal device is read from the network information storage unit based on the communication request, and the network information is encrypted using the shared key. Transmitting to the communication terminal device that is the transmission source of the communication request using a different communication path;
A computer program for running.

Images