JP5820239B2 - Secure access system, home gateway, and secure access method - Google Patents

Description

  The present invention relates to a technology for securely and reliably remotely accessing a home device connected to a home network from a terminal connected to an external network.

  With the spread of the Internet, home devices such as computer devices, AV (Audio Visual) devices, white goods, etc. installed in the end user's home are connected to the home network, and each home device in the home network Increasing communication. Furthermore, with the advancement of home networks that communicate with the Internet, it is important to remotely and securely access each home device in the home network from a terminal outside the home connected to the external network via the home gateway. The nature is increasing. Hereinafter, in the specification and drawings, the home gateway may be abbreviated as HGW (Home GateWay).

  As a conventional technique for remotely accessing a device in a home network from an external terminal connected to an external network, there is a technique for specifying and accessing a specific port number of the home gateway from the external terminal. In this technique, the home gateway sets a firewall for the port number in advance so that it can be connected to a home device having a private IP address corresponding to the port number.

  This technology enables remote access very easily. However, there is a problem that unauthorized access is easily made when a third party knows the IP address of the home gateway.

  As another conventional technique, an authentication system in the network stores in advance a model-specific password pre-installed in a plurality of home devices connected to a home network and a provisional password assigned to each of the plurality of home devices. There is a technique for performing communication when a model-type password and a provisional password transmitted from a device match a type password and a provisional password stored in advance by the authentication system.

  This technology makes it possible to provide a unique authentication means for each home device for each home device by combining a model-specific password and a provisional password, and improve the safety of access to the home device. it can.

  Patent Document 1 describes an invention that makes it possible to easily provide unique authentication information for each information device to the information device. The invention described in Patent Document 1 stores a model-specific password previously incorporated in each of a plurality of home appliances in units of models and a plurality of provisional passwords in association with IDs of corresponding devices. Then, it is verified whether the model-specific password and provisional password transmitted from a certain household electrical appliance match the stored plurality of model-specific passwords and the plurality of provisional passwords, respectively, and the received model-specific password and provisional password are received. If both match, device authentication information that can uniquely authenticate the home appliance of the transmission source for each device is generated, and the generated device authentication information is transmitted to the home appliance of the transmission source.

JP 2004-355396 A

The invention described in Patent Document 1 is considered to be less susceptible to unauthorized access than single password authentication. However, if both the model-specific password and the provisional password are leaked, there is still a problem that the computer is illegally accessed.
Therefore, an object of the present invention is to perform safe and reliable remote access from an out-of-home terminal to a home device.

In order to solve the above-described problem, in the invention according to claim 1, a home gateway and an out-of-home terminal of a home network accommodating a home device are connected to an IP network provided with a call control server that performs call processing. In the secure access system, the call control server corresponds to a telephone number of any home device accommodated in each home network and a telephone number of a remote terminal permitted to communicate with the home device. On the basis of the access permission list indicating that, when permitting / disallowing communication and disallowing communication between the external terminal and the home device, it is determined to block the firewall permitted to communicate by the home gateway , If this communication is permitted, access to the home device, access release, and access based on the phone number of the home device. The home gateway makes a request to the home gateway. When the home gateway receives an access request to the home device from the call control server, the home gateway determines the home gateway based on the telephone number of the home device notified from the call control server. Resolving the device address, notifying the outside terminal of temporary reception port information related to the home device acquired from the home device via the call control server, and a firewall for the reception port information . When the IP packet with the port number related to the home device is received from the outside terminal, the call control is performed by converting the local IP address of the home device to the IP packet by the network address translation operation when the IP packet is received. Do not receive a request to cancel access to the home device from the server If, blocking configure the firewall to the reception port information of the home appliance, and a secure access system, characterized in that.

In this way, according to the present invention, only an out-of-home terminal permitted to communicate with the home network can obtain permission to communicate with the home device. The access permission list can be stored in the home gateway to increase security. Alternatively, the access permission list can be stored in the call control server to improve processing efficiency. Further, since the firewall is set to be cut off when the remote access is completed, it is possible to improve security and prevent unauthorized access, and the outside terminal can access based on the telephone number of the home device. Furthermore, since the home device is accessed by the network address translation operation, unauthorized access to the home device can be prevented.

The invention according to claim 2 is a secure access system in which a home gateway of a home network accommodating a home device and an out-of-home terminal are connected to an IP network provided with a call control server for performing call processing, The call control server requests the home gateway to access the home device based on the telephone number of the home device, and the home gateway receives an access request to the home device from the call control server. Then, based on the access permission list indicating the correspondence between the telephone number of any home device accommodated in each home network and the telephone number of a remote terminal that is permitted to communicate with the home device, firewalls communicated permitted upon permission / denial and the communication disallow communication between the outer terminal and the home appliance Le is determined to be blocked by the home gateway, if you allow communication with the home appliance, on the basis of the telephone number of the home device, to resolve the address of the home device via the call control server a temporary reception port information relating to the home device acquired from the home device notifies to the out-of-house terminal Te, the firewall passes set for the reception port information, to the home device from the out-of-home terminal When an IP packet with the port number is received, it is converted into an IP packet whose destination is the local IP address of the home device by a network address translation operation, and an access release request to the home device is received from the call control server Then, based on the access permission list, the remote terminal and the home Determining the corresponding device, blocking configure the firewall to the reception port information of the home appliance if corresponded, and a secure access system, characterized in that.

In this way, according to the present invention, only an out-of-home terminal permitted to communicate with the home network can obtain permission to communicate with the home device. The access permission list can be stored in the home gateway to increase security. Alternatively, the access permission list can be stored in the call control server to improve processing efficiency. Further, since the firewall is set to be cut off when the remote access is completed, it is possible to improve security and prevent unauthorized access, and the outside terminal can access based on the telephone number of the home device. Furthermore, since the home device is accessed by the network address translation operation, unauthorized access to the home device can be prevented.

According to the third aspect of the present invention, there is provided a home gateway of a home network that accommodates a home device, and the home gateway includes a telephone number of any home device accommodated in each home network, and the home device. Based on the access permission list that indicates the correspondence with the telephone number of the outside terminal that is permitted to communicate with, the communication is permitted when communication from the outside terminal to the home device is permitted / not permitted and when communication is not permitted. has been the firewall determines that the blocking by the home gateway, if the home gateway permits the communication, based on the notified telephone number of the home device, to resolve the address of the home device, the home device communication to the out-of-house terminal that is authorized to to, temporary relating to the home device acquired from the home appliance Notifies the signal port information, the firewall passes set for the reception port information, when receiving an IP packet by the port number according to the home appliance from the home outside terminal, the home device by the network address translation operation The local IP address of the home device is converted into an IP packet, and when a request for releasing access to the home device is received, a firewall is set to be blocked for the reception port information of the home device. Home gateway.

In this way, according to the present invention, only an out-of-home terminal permitted to communicate with the home network can obtain permission to communicate with the home device. Further, since the firewall is set to be cut off when the remote access is completed, it is possible to improve security and prevent unauthorized access, and the outside terminal can access based on the telephone number of the home device. Furthermore, since the home device is accessed by the network address translation operation, unauthorized access to the home device can be prevented.

In the invention described in 請 Motomeko 4, the IP network with a call control server that performs call control, home network housing the home device home gateway and out-of-house terminal secure access connection and secure access system In the method, the out-of-home terminal is an access indicating a correspondence between a telephone number of any home device accommodated in each home network and a telephone number of an out-of-home terminal permitted to communicate with the home device. If the home gateway receives an access request to the home device from the call control server when communication is permitted by the permission list or a firewall that is permitted to communicate is blocked, the home gateway can either be accommodated in each home network. Phone number of the home device and the phone of the remote terminal that is allowed to communicate with the home device Based on the access permission list showing correspondence between items, that during the enable / disable and communication disallow communication with the out-of-house terminal and the home device blocks the firewall communicated permitted by the home gateway If the home gateway permits communication, the home device address is resolved based on the notified telephone number of the home device, and the outside of the home that is permitted to communicate with the home device. Notifying the terminal of the temporary reception port information related to the home device acquired from the home device, transparently setting a firewall for the reception port information , and the port number related to the home device from the outside terminal When an IP packet is received by the Converts Le IP address in the IP packet whose destination, if receiving an access release request to the home device, blocking configure the firewall to the reception port information of the home appliance, and wherein the secure Access method.
In this way, according to the present invention, only an out-of-home terminal permitted to communicate with the home network can obtain permission to communicate with the home device. The access permission list can be stored in the home gateway to increase security. Alternatively, the access permission list can be stored in the call control server to improve processing efficiency. Further, since the firewall is set to be cut off when the remote access is completed, it is possible to improve security and prevent unauthorized access, and the outside terminal can access based on the telephone number of the home device. Furthermore, since the home device is accessed by the network address translation operation, unauthorized access to the home device can be prevented.

  ADVANTAGE OF THE INVENTION According to this invention, the safe and reliable remote access from a remote terminal to a home apparatus can be performed.

1 is a schematic configuration diagram showing a secure access system in a first embodiment. It is a figure which shows the access permission list | wrist in 1st Embodiment. It is a sequence diagram which shows operation | movement of the secure access system in 1st Embodiment. It is a schematic block diagram which shows the secure access system in 2nd Embodiment. It is a sequence diagram which shows operation | movement of the secure access system in 2nd Embodiment. It is a sequence diagram which shows operation | movement of the secure access system in 3rd Embodiment.

  Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the drawings.

(Configuration of the first embodiment)
FIG. 1 is a schematic configuration diagram showing a secure access system according to the first embodiment.
The secure access system 60 includes an IP (Internet Protocol) network 100, an out-of-home terminal 20, and a home network 10.

The IP network 100 relays IP packets between the out-of-home terminal 20 and the home network 10, and includes edge routers 50-1 and 50-2 and a SIP (Session Initiation Protocol) server 30 (call control server). And have.
The edge routers 50-1 and 50-2 transfer IP packets. The edge routers 50-1 and 50-2 are not limited to two, and may be one or more. Hereinafter, when the edge routers 50-1 and 50-2 are not individually identified, they are simply referred to as the edge router 50.
The SIP server 30 controls the service by performing call control, and stores an access permission list 31. The access permission list 31 will be described in detail with reference to FIG.

The home network 10 includes an HGW 11 and home devices 13-1 to 13-3. Hereinafter, when the home devices 13-1 to 13-3 are not individually identified, they are simply referred to as home devices 13. The HGW 11 is connected to the IP network 100 and home devices 13-1 to 13-3. The home devices 13-1 to 13-3 are connected to the HGW 11.
The HGW 11 is, for example, a broadband router, and a global IP address is assigned to the IP network 100 side, and a local IP address is assigned to the home network 10 side. The HGW 11 has a processing unit (not shown) that performs NAT (Network Address Translation) or NAPT (Network Address Port Translation), which is a network address translation operation.
The home device 13 is, for example, a computer device, AV system device, white goods, security device (surveillance camera), or the like, and has a function of connecting to a network. The home network 10 of the present embodiment includes three home devices 13. However, the number of home devices 13 is not limited to three.

  The out-of-home terminal 20 is, for example, a fixed phone, a mobile phone, or a computer device. The out-of-home terminal 20 is connected to the IP network 100 via the edge router 50-2. The home network 10 is connected to the IP network 100 via the edge router 50-1. The edge routers 50-1 and 50-2 are connected to the SIP server 30 included in the IP network 100. The number of out-of-home terminals 20 and home networks 10 is not limited to one and may be plural.

FIG. 2 is a diagram showing an access permission list in the first embodiment.
The access permission list 31 is associated with the out-of-home terminal 20 (FIG. 1) that permits access to the home devices 13-1 to 13-3 (FIG. 1) accommodated in the HGW 11 (FIG. 1). The access permission list 31 has a called phone number column that is an identifier of the home device 13 (FIG. 1) and a calling phone number column that is an identifier of the remote terminal 20 (FIG. 1). The access permission list 31 associates the home device 13 (FIG. 1) with the out-of-home terminal 20 (FIG. 1) that is permitted to access the home device 13 (FIG. 1).

In the access permission list 31, by means not shown, the telephone number (AAA-AAA-AAAAA) of the out-of-home terminal 20 (FIG. 1) and the home device 13-1 (FIG. 1) housed in the HGW 11 (FIG. 1) in advance. 1), the incoming call number (YYY-YYY-YYYY) of the home device 13-2 (FIG. 1), and the incoming call of the home device 13-3 (FIG. 1). A number (ZZZ-ZZZ-ZZZ) is registered.
The permission / denial of communication between the remote terminal 20 and the home device 13 is determined based on the access permission list 31.
(Operation of the first embodiment)

  FIG. 3 is a sequence diagram showing the operation of the secure access system in the first embodiment. The sequence among the remote terminal 20, the edge router 50-2, the SIP server 30, the edge router 50-1, the HGW 11, and the home device 13-n (n = 1 to 3) is shown.

<< Remote access start processing >>
When the process is started, in sequence Q10, the out-of-home terminal 20 requests the SIP server 30 to access the home device 13-n in the home network 10 (FIG. 1).
In sequence Q11, the SIP server 30 performs line authentication of the out-of-home terminal 20.

  In the sequence Q12, the SIP server 30 refers to the access permission list 31 (FIG. 2), and the calling telephone number of the outside terminal 20 is the called telephone number of the home device 13-n accommodated in the HGW 11. (Access permission determination).

If the determination condition is satisfied, the SIP server 30 permits access to the home device 13-n. If the determination condition is not satisfied, the SIP server 30 disallows access to the home device 13-n and indicates that there is an unauthorized access to the home device 13-n. The home device 13-n is notified and displayed. The subsequent sequence shows a case where the determination condition is satisfied.
In sequence Q13, the SIP server 30 requests the HGW 11 to access the home device 13-n.

  In sequence Q14, the HGW 11 broadcasts to all the home devices 13-1 to 13-3, and sets the address of the home device 13-n based on the notified telephone number of the home device 13-n. Solve.

In sequence Q15, the HGW 11 acquires the reception port number corresponding to the notified private IP address of the home device 13-n, and the global IP address and the reception port number on the IP network 100 (FIG. 1) side of the HGW 11 Is associated.
In sequence Q16, the HGW 11 sets the firewall (FW) for the reception port number to be transparent. The firewall may be described as “FW”.

  In sequence Q17, the HGW 11 notifies the SIP server 30 of the global IP address and reception port number on the IP network 100 side, and the reception port number of the home device 13-n acquired in sequence Q15.

  In sequence Q18, the SIP server 30 uses the global IP address and reception port number on the IP network 100 side of the HGW 11 notified from the HGW 11 and the reception port number of the home device 13-n communicated with the outside terminal. 20 to allow access to the home device 13-n.

<Remote access processing>
In sequence Q30, the out-of-home terminal 20 designates the global IP address and reception port number on the IP network 100 side of the HGW 11 and transmits an IP packet. The HGW 11 converts the destination of the IP packet into a combination of the private IP address and the reception port number of the home device 13-n and relays it to the outside terminal 20 by NAT or NAPT which is a network address translation operation. Remote access to the home device 13-n is performed.

<< Remote access termination process >>
Sequences Q40 to Q46 are processes for terminating remote access to the home device 13-n.
When the process is started, the remote terminal 20 requests the SIP server 30 to cancel the access after the remote access to the home device 13-n is completed in sequence Q40.
In sequence Q41, the SIP server 30 performs line authentication.

In sequence Q42, the SIP server 30 refers to the access permission list 31 and confirms that the outgoing telephone number of the out-of-home terminal 20 corresponds to the incoming telephone number of the home device 13-n accommodated in the HGW 11 Determine whether or not.
In sequence Q43, the SIP server 30 requests the HGW 11 to cancel the access to the home device 13-n.

In sequence Q44, the HGW 11 sets the firewall that is set to be transparent to the reception port number corresponding to the private IP address of the home device 13-n as a blocking setting.
In sequence Q45, the HGW 11 notifies the SIP server 30 of the completion of the release of access to the home device 13-n.
In sequence Q46, the SIP server 30 notifies the out-of-home terminal 20 of the completion of the release of access to the home device 13-n.

(Effects of the first embodiment)
The first embodiment described above has the following effects (A) to (C).

(A) A correspondence list between the telephone number of the remote terminal 20 permitted to communicate with the home network 10 and the telephone number of the home device 13 accommodated in the HGW 11 is registered in the network in advance. Thereby, since only the pre-registered out-of-home terminal 20 can communicate with the home network 10, safe and reliable remote access can be performed.
(B) The combination of the IP address and port number used by the remote terminal 20 for remote access is temporary. As a result, even if the combination of the IP address and port number used for remote access leaks, unauthorized access cannot be repeated repeatedly, so that safe and reliable remote access can be performed.
(C) When remote access of the remote terminal 20 is terminated, the firewall of the HGW 11 for the port number is set to be blocked. As a result, even if the combination of the IP address and port number used for remote access leaks, unauthorized access cannot be performed upon termination of the remote access, so that safe and reliable remote access from the home terminal 20 to the home device 13 is possible. It becomes possible.

(Configuration of Second Embodiment)
FIG. 4 is a schematic configuration diagram showing a secure access system according to the second embodiment.
The secure access system 60A of the second embodiment has a SIP server 30A different from the SIP server 30 (FIG. 1) of the first embodiment, and is different from the home network 10 (FIG. 1) of the first embodiment. Other than having a different home network 10A, it is configured in the same manner as the secure access system 60 (FIG. 1) of the first embodiment.

  The home network 10A of the second embodiment is configured in the same manner as the home network 10 (FIG. 1) of the first embodiment, except that it has an HGW 11A different from the HGW 11 of the first embodiment. .

The SIP server 30A of the second embodiment has the same configuration as the SIP server 30 (FIG. 1) of the first embodiment, except that it does not have the access permission list 31 (FIG. 2) of the first embodiment. Has been.
The HGW 11A of the second embodiment has an access permission list 12 in addition to the same configuration as the HGW 11 (FIG. 1) of the first embodiment.
The access permission list 12 of the second embodiment has the same configuration as the access permission list 31 (FIG. 2) of the first embodiment.

(Operation of Second Embodiment)
FIG. 5 is a sequence diagram showing the operation of the secure access system in the second embodiment.

<< Remote access start processing >>
After starting the processing, the processing of sequences Q10 to Q11 is the same as the processing of sequences Q10 to Q11 (FIG. 3) of the first embodiment. When the processes of the sequences Q10 to Q11 are completed, the SIP server 30A performs the same process as the sequence Q13 (FIG. 3) of the first embodiment.

  In sequence Q13A, the HGW 11A refers to the access permission list 12 to determine whether or not the calling telephone number of the out-of-home terminal 20 corresponds to the called telephone number of the home device 13-n accommodated in the HGW 11A. .

  When the determination condition is satisfied, the HGW 11A permits access to the home device 13-n. If the determination condition is not satisfied, the HGW 11A disallows access to the home device 13-n and indicates that there is an unauthorized access to the home device 13-n. 13-n is notified and displayed. The subsequent sequence shows a case where the determination condition is satisfied.

In the second embodiment, the access permission list 12 (FIG. 4) is stored in the HGW 11A of each home network 10A (FIG. 4). Thus, the access permission list 12 (FIG. 4) can be easily realized, and information leakage can be suppressed by not storing the access permission list 12 (FIG. 4) in the SIP server 30A.
The processing of sequences Q14 to Q18 is the same as the processing of sequences Q14 to Q18 (FIG. 3) of the first embodiment.

《Remote access execution》
The process of sequence Q30 is the same as the process of sequence Q30 (FIG. 3) of the first embodiment.

<End remote access>
After starting the processing, the processing of sequences Q40, Q41, and Q43 is the same as the processing of sequences Q40, Q41, and Q43 (FIG. 3) of the first embodiment.
In the sequence Q43A, the HGW 11A refers to the access permission list 12 (FIG. 4) as in the sequence Q13A, and receives an incoming call of the home device 13-n in which the calling number of the outside terminal 20 is accommodated in the HGW 11A. It is determined whether or not it corresponds to the number.
The processes of sequences Q44 to Q46 are the same as the processes of sequences Q44 to Q46 (FIG. 3) of the first embodiment.

(Effect of 2nd Embodiment)
The second embodiment described above has the following effect (D).

(D) In the second embodiment, the access permission list 12 is stored in the HGW 11A of each home network 10A. Thereby, since it is not stored in the SIP server 30A, information leakage of the access permission list 12 can be suppressed, and access control by the access permission list 12 can be easily realized.

(Configuration of Third Embodiment)
The secure access system 60 of the third embodiment is configured similarly to the secure access system 60 (FIG. 1) of the first embodiment. Furthermore, each of the home devices 13-1 to 13-3 is assigned a global IP address.

(Operation of Third Embodiment)
FIG. 6 is a sequence diagram showing an operation of the secure access system according to the third embodiment.

<< Remote access start processing >>
After starting the processing, the processing of sequences Q10 to Q13 is the same as the processing of sequences Q10 to Q13 (FIG. 3) of the first embodiment.
In sequence Q16B, the HGW 11 sets the firewall for the notified global IP address of the home device 13-n to be transparent.
In sequence Q17B, the HGW 11 notifies the SIP server 30 of the notified global IP address of the home device 13-n.

  In sequence Q18B, the SIP server 30 notifies the out-of-home terminal 20 of the notified global IP address of the home device 13-n and permits access.

<Remote access processing>
In sequence Q30B, the out-of-home terminal 20 designates the notified global IP address of the home device 13-n and transmits an IP packet. The home device 13-n designates the global IP address of the remote terminal 20 and transmits an IP packet.

<< Remote access termination process >>
When the process is started, the processes of sequences Q40 to Q43 are the same as the processes of sequences Q40 to Q43 (FIG. 3) of the first embodiment.
In sequence Q44B, the HGW 11 sets the firewall that is set to be transparent with respect to the global IP address of the home device 13-n as a blocking setting.
The processes of sequences Q45 to Q46 are the same as the processes of sequences Q44 to Q46 (FIG. 3) of the first embodiment.

(Effect of the third embodiment)
The third embodiment described above has the following effects (E) and (F).

(E) The HGW 11 notifies the remote terminal 20 of remote access by notifying the remote terminal 20 of the global IP address of the home device 13-n. As a result, the network address translation operation (NAT or NAPT) of the HGW 11 at the time of remote access becomes unnecessary, so that IP packets can be transmitted and received between the out-of-home terminal 20 and the home device 13 at high speed.

(F) During remote access, the HGW 11 does not use a conversion table such as a static IP masquerade table. That is, since the conversion table of the HGW 11 is not exhausted, stable remote access can be performed between the out-of-home terminal 20 and the home device 13.

(Modification)
The present invention is not limited to the above embodiment, and can be modified without departing from the spirit of the present invention. For example, the following forms (a) to (d) are used as the usage form and the modified examples.

(A) The HGW 11 of the first embodiment obtains the reception port number corresponding to the private IP address of the home device 13, and after resolving the address in sequence Q14, the port number is changed from the home device 13 in sequence Q15. I have been notified. However, the present invention is not limited to this, and the HGW 11 holds the private IP address of the home device 13-1 corresponding to the pre-registered outgoing call number of the out-of-home terminal 20, and the global IP address of the HGW 11 on the IP network 100 side. Are associated with each other, the global IP address on the IP network 100 side and the reception port number are notified to the SIP server 30, and the reception port number of the home device 13-1 from the SIP server 30 is notified in response to the inquiry. The SIP server 30 may be notified of a reception port number dynamically assigned to the home device 13-1 from among a plurality of reception port numbers registered in advance.

(B) When the remote access ends, the HGW 11 according to the first embodiment sets the firewall for the port number related to the home terminal to be blocked. However, the present invention is not limited to this, and if remote access is not performed for a predetermined period (timeout), the firewall for the port number related to the home terminal may be set to be blocked.

(C) When the remote access ends, the HGW 11 of the third embodiment sets a firewall for the global IP address related to the home terminal to be blocked. However, the present invention is not limited to this, and if remote access is not performed for a predetermined period (timeout), the firewall for the global IP address related to the home terminal may be set to be blocked.

(D) The access permission list 31 of the first and third embodiments and the access permission list 12 of the second embodiment include a calling number field that is an identifier of the out-of-home terminal 20 (FIG. 1), a home And a called telephone number column that is an identifier of the device 13 (FIG. 1). However, the present invention is not limited to this, and the correspondence between the calling telephone number column that is the identifier of the out-of-home terminal 20 (FIG. 1) and the called telephone number of the HGW 11 (FIG. 1) may be recorded. Thereby, the out-of-home terminal 20 is based on the access permission list indicating the correspondence between the phone number of any device accommodated in each home network and the phone number of the out-of-home terminal permitted to communicate. Whether communication with the home device is permitted or not is determined.

10, 10A Home network 11, 11A HGW (home gateway)
12 Access permission list 13 Home device 20 Outside terminal 30, 30A SIP server (call control server)
31 access permission list 50 edge router 60, 60A secure access system 100 IP network

Claims (4)

A secure access system in which a home gateway and an out-of-home terminal of a home network accommodating a home device are connected to an IP network including a call control server that performs call processing,
The call control server is based on an access permission list indicating correspondence between a telephone number of any home device accommodated in each home network and a telephone number of a remote terminal permitted to communicate with the home device. If it is determined that the firewall permitted communication is blocked by the home gateway when communication is permitted / denied and communication is not permitted between the external terminal and the home device, and if this communication is permitted, Based on the telephone number of the home device, the home gateway is requested to access and release the home device,
The home gateway, when receiving an access request to the home device from the call control server, resolves the address of the home device based on the telephone number of the home device notified from the call control server, Notifying the out-of-home terminal of temporary reception port information related to the home device acquired from the home device via the call control server, and transparently setting a firewall for the reception port information ,
When receiving an IP packet with a port number related to the home device from the out-of-home terminal, it is converted into an IP packet destined for the local IP address of the home device by a network address translation operation,
If an access release request to the home device is received from the call control server, a firewall is set to be blocked for the reception port information of the home device.
A secure access system characterized by that. A secure access system in which a home gateway and an out-of-home terminal of a home network accommodating a home device are connected to an IP network including a call control server that performs call processing,
The call control server requests the home gateway to access the home device based on the telephone number of the home device,
When the home gateway receives an access request to the home device from the call control server, the home gateway is allowed to communicate with the home device's telephone number and the home device. out-of-house based on the access permission list showing correspondence between the telephone number of the terminal, the out-of-house terminal and the home appliances and the communication enable / disable and communication disallowed the home firewall communicated permitted upon If it is determined to be blocked by the gateway and communication with the home device is permitted, the address of the home device is resolved based on the telephone number of the home device, and the home device is connected via the call control server. a temporary reception port information related to the home device notifies to the out-of-house terminal acquired from, with respect to the reception port information Passes set the Aiaworu,
When receiving an IP packet with a port number related to the home device from the out-of-home terminal, it is converted into an IP packet destined for the local IP address of the home device by a network address translation operation,
If a request for canceling access to the home device is received from the call control server, the correspondence between the outside terminal and the home device is determined based on the access permission list. A firewall is set to be blocked for the reception port information of
A secure access system characterized by that. A home network home gateway that houses home devices,
The home gateway is based on an access permission list indicating the correspondence between the telephone number of any home device accommodated in each home network and the telephone number of an external terminal that is permitted to communicate with the home device. In the case of permitting / disapproving communication and disapproving communication from the outside terminal to the home device, it is determined to block the firewall that is permitted to communicate by the home gateway ,
If the home gateway permits communication, resolve the address of the home device based on the notified telephone number of the home device,
Notifying the out-of-home terminal that is permitted to communicate with the home device of the temporary reception port information related to the home device acquired from the home device, and transparently setting a firewall for the reception port information . ,
When receiving an IP packet with a port number related to the home device from the out-of-home terminal, it is converted into an IP packet destined for the local IP address of the home device by a network address translation operation,
If a request for releasing access to the home device is received, a firewall is set to be blocked for the reception port information of the home device.
A home gateway characterized by that. A secure access method for a secure access system in which a home gateway of a home network accommodating a home device and an out-of-home terminal are connected to an IP network including a call control server that performs call control,
The out-of-home terminal communicates with an access permission list indicating correspondence between the telephone number of any home device accommodated in each home network and the number of the out-of-home terminal permitted to communicate with the home device. Blocked firewalls that are allowed or allowed to communicate,
When the home gateway receives an access request to the home device from the call control server, the home gateway is allowed to communicate with the home device's telephone number and the home device. out-of-house based on the access permission list showing correspondence between the telephone number of the terminal, the out-of-house terminal and the home appliances and the communication enable / disable and communication disallowed the home firewall communicated permitted upon determines that the blocking by the gateway,
If the home gateway permits communication, resolve the address of the home device based on the notified telephone number of the home device,
Notifying the out-of-home terminal that is permitted to communicate with the home device of the temporary reception port information related to the home device acquired from the home device, and transparently setting a firewall for the reception port information . ,
When receiving an IP packet with a port number related to the home device from the out-of-home terminal, it is converted into an IP packet destined for the local IP address of the home device by a network address translation operation,
If a request for releasing access to the home device is received, a firewall is set to be blocked for the reception port information of the home device.
The secure access method characterized by the above-mentioned.

Images